Evaluate vulnerability exposure data with Security Exposure 360

task australia Updated Sep 10, 2026 1 min read now-assist-review-vulnerability-exposure-data.md

Use the Security Exposure 360 agentic workflow to review vulnerability data about your environment. Vulnerability analysts and remediation owners can enter questions in plain language and receive comprehensive answers about host, container, and test results vulnerabilities.

Before you begin

Note: Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see ServiceNow product tiers.

Roles required: sn_vul.vulnerability_analyst or sn_vul.vulnerability_admin

Procedure

Navigate to Workspaces > Security Exposure Management.
Select the ServiceNow Otto® icon ([Omitted image "bus-ai-otto.svg"] Alt text:) on the header page from anywhere in your instance.

The ServiceNow Otto® panel is displayed. If you don't see the ServiceNow Otto® icon in the header on the page, you must activate the ServiceNow Otto® panel. For more information, see Activate the ServiceNow Otto panel standard chat.
Select Exposure 360 from the available options.
At the prompt, enter your question in natural language.

For example: How many active vulnerable items have a 'Critical' risk rating?

Note: The responses generated by the Security Exposure 360 agentic workflow are based on the data available in your environment. Review answers for accuracy before acting on them.

The agentic workflow supports results for all types of findings in Unified Security Exposure Management (USEM) that include host vulnerable items (VITs), container vulnerable items (CVITs), and container test results (CTRs) in your environment.

Note: To view CVITs and CTRs, you must have the Container Vulnerability Response and Configuration Compliance applications installed.
If the response indicates no records, you might refine your question so it is more specific.

If you choose to enter them, it is helpful to be sure field labels and field values on records match the information on vulnerability records exactly. For example, a 'Critical' risk rating might correspond exactly to the value 1 - Critical in the Risk rating fields on vulnerability records. Rephrasing your question to include information such as specific field labels or field values can help you improve the accuracy of your returned results.

Keywords Exposure 360vulnerability exposureSecurity Exposure Managementagentic workflowServiceNow Otto

49 lines · 3.4 KB Wrap lines

---
title: Evaluate vulnerability exposure data with Security Exposure 360
description: Use the Security Exposure 360 agentic workflow to review vulnerability data about your environment. Vulnerability analysts and remediation owners can enter questions in plain language and receive comprehensive answers about host, container, and test results vulnerabilities.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/now-assist-review-vulnerability-exposure-data.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [Exposure 360, vulnerability exposure, Security Exposure Management, agentic workflow, ServiceNow Otto]
breadcrumb: [Use, Unified Security Exposure Management, Security Operations]
---

# Evaluate vulnerability exposure data with Security Exposure 360

## Before you begin

**Note:** Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/ai-native-sku-overview.md).

Roles required: sn\_vul.vulnerability\_analyst or sn\_vul.vulnerability\_admin

## Procedure

1. Navigate to **Workspaces** &gt; **Security Exposure Management**.

2. Select the ServiceNow Otto® icon \(\[Omitted image "bus-ai-otto.svg"\] Alt text:\) on the header page from anywhere in your instance.

The ServiceNow Otto® panel is displayed. If you don't see the ServiceNow Otto® icon in the header on the page, you must activate the ServiceNow Otto® panel. For more information, see [Activate the ServiceNow Otto panel standard chat](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/activate-now-assist-panel.md).

3. Select **Exposure 360** from the available options.

4. At the prompt, enter your question in natural language.

For example: `How many active vulnerable items have a 'Critical' risk rating?`

**Note:** The responses generated by the Security Exposure 360 agentic workflow are based on the data available in your environment. Review answers for accuracy before acting on them.

The agentic workflow supports results for all types of findings in Unified Security Exposure Management \(USEM\) that include host vulnerable items \(VITs\), container vulnerable items \(CVITs\), and container test results \(CTRs\) in your environment.

**Note:** To view CVITs and CTRs, you must have the Container Vulnerability Response and Configuration Compliance applications installed.

5. If the response indicates no records, you might refine your question so it is more specific.

If you choose to enter them, it is helpful to be sure field labels and field values on records match the information on vulnerability records exactly. For example, a 'Critical' risk rating might correspond exactly to the value `1 - Critical` in the Risk rating fields on vulnerability records. Rephrasing your question to include information such as specific field labels or field values can help you improve the accuracy of your returned results.