---
title: Application Vulnerability Response user groups and roles
description: Before you can successfully remediate vulnerabilities with Application Vulnerability Response \(AVR\), you must assign users to user groups.Assign users to groups using the User Administration module in your instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/avm-manage-roles.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Reference, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Application Vulnerability Response user groups and roles

Before you can successfully remediate vulnerabilities with Application Vulnerability Response \(AVR\), you must assign users to user groups.

Roles define what you and your groups can see and do in Application Vulnerability Response, Performance Analytics for Vulnerability Response, and third-party integrations with Application Vulnerability Response.

## User groups

Following are the default user groups supporting Application Vulnerability Response:

-   App-Sec Manager: Contains security managers. Starting from Application Vulnerability Response v15.0, it will also contain application owners who manage the penetration test assessment requests.
-   Security Champion: Contains liaisons between the development group and security managers.
-   Developer: Contains individual contributors.
-   V15.0: Ethical Hacker: Contains members of the ethical hacking team who perform penetration testing of applications.

The system admin \[admin\] role is required to assign users to the Application Vulnerability Response default user groups, using the User Administration module,

**Note:**

Assigning AVR users to the Application Vulnerability Response user groups for Application Vulnerability Response is not available in the Vulnerability Response Setup Assistant feature. Only Vulnerability Response roles are assigned there.

The following table lists the available Application Vulnerability Response user groups and the roles associated with them. Use this table to determine which users should be assigned which groups.

<table id="table_z5k_bwb_glk"><thead><tr><th>

User Group

</th><th>

Roles in this group

</th></tr></thead><tbody><tr><td>

Security Champion

 Members of this group can:

-   Read and write application vulnerable items \(AVIs\) assigned to you.
-   Assign an AVI, that is assigned to you, to another individual or group.
-   V20.0: Create, update, delete and cancel \(deactivate\) exception rules.

</td><td>

-   sn\_vul.app\_read\_assigned
-   sn\_vul.app\_write\_assigned
-   sn\_vul.app\_update\_assignment\_group
-   sn\_vul.app\_update\_assigned\_to
-   sn\_vul.app\_manage\_auto\_exception\_rule

</td></tr><tr><td>

App-Sec Manager

 Members of this group can:

-   V20.0: Create, update, delete and cancel \(deactivate\) exception rules.
-   Read, write, delete, and all operations on application remediation task rules.
-   Read and write all AVIs.
-   Configure AVR by create and manage rules, calculators, and severity maps.
-   Configure integrations.
-   Delete AVIs.
-   Assign AVI to individuals or groups.
-   Manage applications.
-   Allows access to the Application module.
-   Schedule, configure, execute integration.
-   Read and execute integrations.
-   View AVR Performance Analytics dashboards and reports.
-   V15.0: Manage penetration test assessment requests.

</td><td>

-   sn\_vul.app\_manage\_auto\_exception\_rule
-   sn\_vul.app\_manage\_group\_rules
-   sn\_vul.app\_read\_all
-   sn\_vul.app\_write\_all
-   sn\_vul.app\_update\_assignment\_group
-   sn\_vul.app\_update\_assigned\_to
-   sn\_vul.app\_configure\_integrations

**Note:** By default, this role contains granular roles for third-party integration configuration. To define or edit an App-Sec Manager user group by single or specific integrations, see [Vulnerability Response personas and granular roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-persona-overview.md).

-   sn\_vul.app\_manage\_assignment\_rules
-   sn\_vul.app\_manage\_remediation\_target\_rules
-   sn\_vul.app\_manage\_risk\_score\_configurations
-   sn\_vul.app\_manage\_applications
-   sn\_vul.app\_manage\_app\_vul\_permissions
-   sn\_vul.app\_manage\_normalized\_severity
-   Version 13.0: sn\_vul.app\_manage\_app\_sc
-   Version 12.0 only: sn\_vul.app\_read\_application\_release

\[Removed in v12.1. Do not use\]

-   sn\_sec\_int.admin
-   Version 13.0: pa\_power\_user
-   pa\_viewer

**Note:** Starting with Vulnerability Response v13.0, pa\_viewer is included in pa\_power\_user and no longer needed by itself.

-   V15.0: sn\_vul.app\_manage\_pen\_test\_request
-   V15.0: sn\_vul.app\_update\_state
-   V15.0: cmdb\_read

</td></tr><tr><td>

Developer

 Members of this group can:

-   Read and write AVR records assigned to you.
-   Assign an AVI, that is assigned to you, to another individual or group.

</td><td>

-   sn\_vul.app\_read\_assigned
-   sn\_vul.app\_write\_assigned
-   sn\_vul.app\_update\_assignment\_group
-   sn\_vul.app\_update\_assigned\_to
-   sn\_vul.app\_pa\_sc\_view

</td></tr><tr><td>

V15.0: Ethical HackerMembers of this group can:

-   Configure default assignment group and assignee for penetration test assessment requests.
-   Manage penetration test findings.
-   Manage penetration test assessment requests.
-   View application vulnerable items.
-   Update assignment for application vulnerable items.

</td><td>

-   V15.0: sn\_vul.app\_update\_state
-   V15.0: sn\_vul.app\_manage\_pen\_test\_request
-   V15.0: itil
-   V15.0: sn\_vul.app\_read\_all
-   V15.0: sn\_vul.app\_manage\_pen\_test\_request\_config
-   V15.0: sn\_vul.app\_manage\_manual\_avits
-   V15.0: sn\_vul.app\_update\_assigned\_to
-   V15.0: sn\_vul.app\_update\_assignment\_group

</td></tr></tbody>
</table>## Assign users to user groups in Application Vulnerability Response

Assign users to groups using the User Administration module in your instance.

### Before you begin

Role required: admin

### Procedure

1.  To assign or remove a user from a group:

    1.  Navigate to **Administration** &gt; **Groups**.

    2.  Locate and open the appropriate group, for example, **App-Sec Manager**.

        The group record is displayed.

    3.  Select the **Group Members** tab.

        The current members of the group are displayed.

    4.  Click **Edit**.

        The Edit members form is displayed.

    5.  From **Collection** list, select users to add to or remove from the group.

    6.  Once all users have been added to the **Group Members List** or removed, click **Save**.

        You are returned to the **Group Members** tab.

    7.  Click **Update** to save your changes and return to the Groups list.


**Related topics**  


[Components installed with Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/installed-with-avm.md)