ServiceNow Brings AI Agents to Continuous Control Monitoring

ServiceNow has announced agentic AI capabilities for continuous control monitoring in ServiceNow Integrated Risk Management (IRM). The update takes control monitoring beyond the ServiceNow platform and gives AI agents an active role: setting up compliance checks, interpreting the results and acting on failed controls rather than simply reporting them. General availability is expected in Q1 2027.

Why continuous control monitoring matters now

Traditional assurance runs on a cycle. Controls are tested, evidence is documented and the organisation moves on until the next audit. Risk doesn't follow the audit calendar, though. A misconfigured cloud resource, a vendor control that quietly fails or an AI model that drifts can create new exposure within minutes, often in tools no single team owns. Boards and regulators increasingly expect proof that controls are working today, not just at the last point of testing.

ServiceNow's answer is to make assurance continuous. Vasant Balasubramanian, Group Vice President and GM of Risk, Super Intelligence Control Tower, and ESG at ServiceNow, describes the goal as closing the gap between what an organisation's last audit showed and what is true right now, turning assurance into a live signal across the enterprise.

What's new in ServiceNow IRM

AI agents that configure, interpret and act. Agents help teams set up checks, read the results and identify controls that are drifting or have failed. When a control breaks, the platform flags it, opens a ticket and can remediate automatically within policies the organisation defines. Control owners and GRC teams spend less manual effort between detection and fix.

Monitoring beyond ServiceNow. IRM already monitors controls across security operations, IT service management, IT asset management and the CMDB. More than 100 pre-built integrations now extend that reach to third-party cloud, container, AI, SaaS, on-premises and business tools, as well as connected assets including OT, IoT and medical devices. The capability works alongside ServiceNow's Super Intelligence Control Tower, which governs how AI is built and used across the enterprise, so organisations can see in real time whether the controls around that AI are holding.

Identity and access for humans, machines and agents. Through Access Graph, part of ServiceNow's Context Engine, the full lifecycle of access for people, machines and AI agents is brought into monitoring. The platform can verify that access is revoked as soon as an employee or agent leaves.

Always-current evidence. Evidence from every connected source flows into a central layer around the clock, so audit-ready proof is maintained continuously instead of being assembled after the fact.

Control orchestration in a single view. Each control is mapped to the tools that enforce it across connected systems, showing what is in place and how well it performs. Compliance Graph links signals across those systems to highlight what is genuinely at risk. Control owners see what needs their attention and respond in the tools they already use, so attestations get done faster.

Test once, comply many times. Unified control mapping connects each control to equivalent requirements across frameworks such as SOX, PCI-DSS, ISO 27001, HIPAA and the EU AI Act. An access control tested for SOX also counts toward the matching PCI-DSS and ISO 27001 requirements. Auditors receive framework-specific results drawn from a single control repository.

Support for all three lines of defence

The capability serves each line of a typical risk programme and works within the communication, collaboration and project management platforms people already use:

• First line: business units can monitor their own controls before compliance teams come knocking.
• Second line: risk and compliance leaders see failed controls surfaced, assigned and resolved in their existing channels, with a full audit trail and context on what was exposed.
• Third line: internal audit gets complete test results with supporting evidence rather than samples, plus the option to run independent monitoring for added assurance.

ServiceNow positions the outcome as fewer surprises, less last-minute audit preparation, lower audit costs and reduced risk exposure.

Industry perspective

Jackson Munuo, Global VP of Technology Risk & Control at CNA Insurance, describes the shift as resilience moving from recovery to adaptability, with AI workflows helping his team anticipate issues faster and respond more accurately.

Philip D. Harris, Research Director for Governance, Risk, and Compliance Solutions at IDC, points to the closed loop: a control fails, an agent works out why, a ticket is raised with remediation steps, the fix is verified and the risk register updates itself. In his view, running that full lifecycle continuously across cloud, identity and on-premises systems, rather than inside one platform, is what sets agentic monitoring apart from the dashboard-style reporting most GRC tools have offered so far.

Availability

General availability of Agentic AI for Continuous Controls Monitoring is expected in Q1 2027.

How Sequal Consultancy can help

For organisations already using ServiceNow IRM, or considering it, agentic monitoring is a good reason to review your control framework, integration landscape and audit approach. Sequal Consultancy can help you assess readiness, map controls across frameworks, plan integrations with your cloud, identity and on-premises systems, and prepare your teams to get the most from continuous assurance when the capability becomes available.

Source: ServiceNow press release, 10 November 2026.