Best AI Agent Security Software for ServiceNow AI Agents and Now Assist Agents

For most US companies running ServiceNow, the best AI agent security software for ServiceNow AI agents starts with things they already own: a current patch level, agent teams split by duty, supervised mode on every tool that writes, and Now Assist Guardian. Add AI Control Tower or a ServiceNow posture tool such as AppOmni when nobody can say which agents exist, and add a gate only where agents call MCP servers that move money or change vendor and customer records outside the instance.

We sell that last gate. Starting with "you may not need us" is deliberate, because for a service desk whose agents summarize incidents and draft replies, it is the right answer.

Why ServiceNow teams are reviewing AI agent security now

Three things landed in about seven weeks. On August 5, 2026 ServiceNow put AI Agent Access Security and Non-Human Identity Remediation on sale inside AI Control Tower, which made agent governance a line item. On August 27 it published three AI Platform vulnerabilities rated CVSS 10.0, and a fourth followed on September 24. And the MCP Client application, which lets agents built in AI Agent Studio use tools on external MCP servers, has moved agent work past the edge of the instance.

• Self-hosted patching is on you. ServiceNow "deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers" (KB3152242, KB3159623).
• Agents find each other by default. Published agents are discoverable and grouped into one team per channel, so a prompt-injected agent can recruit a more capable teammate.
• Agents borrow the session. By default an agent runs as the dynamic user, the person who invoked it, with that person's rights.
• Outbound calls leave ServiceNow roles behind. Once a call goes to an MCP server or a REST endpoint, the credential on the connection decides what happens.

Six options compared

Option 1, patching and ServiceNow's own configuration

This option costs nothing and fixes the most. Self-hosted instances need the August and September updates: CVE-2026-18885 (code injection), CVE-2026-18886 (improper access control leading to privilege escalation) and CVE-2026-74820 (SQL injection), all rated 10.0 by ServiceNow, plus CVE-2026-86858 at 8.7. A runtime product does nothing for an unauthenticated request to a vulnerable endpoint.

Then the agent settings. AppOmni's research found that published Now Assist agents "are automatically grouped into the same team by default" and "marked as being discoverable by default when published," and ServiceNow confirmed the behavior is intended. Split agents into teams by duty, so a read-only triage agent cannot reach one that assigns roles. Put tools that change records or send email in supervised mode. Leave the sn_aia.enable_usecase_tool_execution_mode_override property at its default of false, because when it is true an agent with one autonomous tool runs all its tools autonomously.

The gap is who approves. Supervised mode puts the review in front of the user in the conversation. For a privilege change or a payment, that is the requester approving their own agent. Our ServiceNow AI agents security page walks through each setting with the documentation behind it.

Option 2, Now Assist Guardian

Guardian ships with Now Assist and covers "offensive content, prompt injection, and sensitive subject detection." Turn it on before anything else in this list. It is built in, it needs no new integration, and it sees model traffic on the platform. What it does not do is hold a specific outbound call for a person, or check that the amount in a payment call matches the invoice the agent was told to pay. Detection and decision are different jobs.

Option 3, AI Control Tower and AI Agent Access Security

AI Control Tower is ServiceNow's register for AI agents and models, with activity tracking for what agents do and what data they touch. The August 2026 additions push it toward identity: AI Agent Access Security "manages access for AI agents across every platform," and Non-Human Identity Remediation "automatically revokes permissions and rotates keys," per trade coverage of the launch. If your estate has dozens of agents and nobody owns the list, this is the right first purchase, and it may already be in your contract. It governs standing access. It does not decide whether the call an agent proposes right now should run.

Some teams find on inventory that half their agents never act at all. If an agent only summarizes and tags tickets so a team can spot recurring complaints, it is really a reporting job, and customer feedback analytics may answer that question better than another agent with tool access.

Option 4, AppOmni AgentGuard

AppOmni did the research that made default agent discovery a known risk, and it sells AgentGuard as real-time analysis of Now Assist agent actions and thought processes, alerting on deviations from the original task. For ServiceNow shops whose agents mostly change records inside the instance, it is a better fit than an MCP gateway, and we would point you there. It sits on the SaaS platform side. If your risk is an outbound call that pays a vendor, the decision has to happen on that call path.

Option 5, build the gateway yourself

The MCP Client connects to whatever server address you configure, so you can put your own proxy in front of the MCP servers your team runs and evaluate each call. The rules engine is the easy part. The work is approval routing to a person who is not the requester, timeouts so a waiting agent does not hang an incident, an audit store the agent cannot touch, and keeping rules current as the server's tool list changes. Our MCP gateway page lists what a complete build needs. The Copilot Cowork buyer guide shows how the same build-versus-buy trade looks on Microsoft.

Option 6, AgentShield as the MCP gateway

You point the MCP Client connection at an AgentShield gateway endpoint, and the gateway holds the real credential to the downstream system. Every call is evaluated against per-tool, per-argument permissions: which tools an agent may call, which records, which amounts, which destinations. A vendor bank change or a payment above a threshold waits for a named approver who is not the requester, inputs are checked for injected instructions, and each decision lands in an AI agent audit trail outside the agent's reach.

What it does not do: see record operations inside the instance, replace ACLs, or patch the platform. For those, use Options 1 to 4. Pricing for the gateway is on our AI security pricing page.

Which option fits your situation

Three of six situations buy nothing new, and a fourth often uses a license you already hold. That ratio shifts as more ServiceNow agent work reaches outside the instance, which is where the approval stops being personal.

How much does ServiceNow AI agent security cost

The ServiceNow side depends on your Now Assist and AI Control Tower entitlements, which ServiceNow prices by contract rather than on a public list, so ask your account team what your current SKUs already include. Patching, agent teams, discoverability and supervised mode cost staff time only. A self-built gateway costs engineering time and on-call ownership; a hosted one is a subscription. Either way, scope the gate to the connections that write outside the instance, not to every agent.

Frequently asked questions

What is the best security tool for ServiceNow AI agents?

There is no single best tool. For most instances, the strongest start is free: patch the August and September 2026 advisories, split agent teams, use supervised mode and turn on Now Assist Guardian. AppOmni fits agents that work inside the instance, AI Control Tower fits large inventories, and an MCP gateway fits agents that write to outside systems.

Can ServiceNow AI agents be prompt injected?

Yes. AppOmni showed that hostile text in a record field can redirect a benign Now Assist agent to recruit a more capable agent on its team, even with built-in prompt injection protection enabled. The agent then acts with the privileges of the user who started the interaction. Splitting teams by duty and supervised mode on write tools limit the impact.

Does AgentShield replace AppOmni or AI Control Tower?

No. AI Control Tower governs inventory and standing access, and AppOmni analyzes agent behavior on the ServiceNow platform. AgentShield governs outbound MCP calls: which ones run, with which arguments, and who approves the risky ones. Teams with agents that write outside the instance often keep one of those and add the gateway only for those connections.