ServiceNow is where a lot of the business runs. The ticket queue is there, HR cases are there, so is the CMDB and the service catalog, and so are the credential stores that let it reach Active Directory, Workday and the CRM. That combination is what makes it worth attacking, and it's also what makes an attack there hard to see.
"Nobody would ever blink at a ServiceNow integration account making a lot of API calls."
Mitiga security researcher Idan Cohen thinks we mislabel the platform. Treating it as one more SaaS application undersells what it is. In his view it behaves like infrastructure as a service, and it carries the log volume to match: more than 20 default table types, and that counts only the security-relevant ones.
The gap isn't volume, though. It's what the records leave out. A log showing that someone changed a record can arrive with no IP address and no user agent attached. For an investigator that's close to useless on its own, and Idan is blunt about what happens next. An alert with no IP gets closed and the analyst moves on. Recovering the actor means correlating that change against the HTTP request logs by hand, which he puts at twice the time the same question would take in any other SaaS application, plus some luck.
Correlation across platforms is where teams give up, and he calls that the blind spot directly. The episode's second screenshot is a real customer incident with the identifying details removed. A page view in SharePoint, then the same actor minutes later triggering alerts in ServiceNow, with the IP address and user agent attached to both.
Brian Contos puts the industry frame around it. Agentic and autonomous SOCs are response mechanisms, and they rest on a data layer that has to be trustworthy before anyone lets a machine act on it with humans outside the loop, or near it.
Idan closes with the number that explains why this is not a niche problem. In a large organization, 96% of the logs you are looking at belong to non-human identities.
