---
title: Analyze vulnerability remediation status with generative AI
description: Chat with an AI agent to help you gain insights into your monthly remediation compliance metrics for vulnerable items.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/sla-targets-vr-aiagent.html
release: australia
topic_type: task
last_updated: "2026-07-24"
reading_time_minutes: 4
breadcrumb: [Use, Unified Security Exposure Management, Security Operations]
---

# Analyze vulnerability remediation status with generative AI

Chat with an AI agent to help you gain insights into your monthly remediation compliance metrics for vulnerable items.

## Before you begin

**Note:** Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/ai-native-sku-overview.md).

The ServiceNow Otto® panel must be activated. For more information, see [Activate the ServiceNow Otto panel standard chat](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/activate-now-assist-panel.md).

Roles required: sn\_vul.vulnerability\_admin or sn\_vul.vulnerability\_analyst admin

## Procedure

1.  Select the ServiceNow Otto® icon \(\[Omitted image "bus-ai-otto.svg"\] Alt text:\) on the header page from anywhere in your instance.

    The ServiceNow Otto® panel is displayed. If you don't see the ServiceNow Otto® icon in the header on the page, you must activate the ServiceNow Otto® panel. For more information, see [Activate the ServiceNow Otto panel standard chat](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/activate-now-assist-panel.md).

2.  Select the **Analyze vulnerability remediation status** option in the panel.

    The Analyze vulnerability remediation status agentic workflow is on-demand. You can enter any query in natural language, but consider using the prompts described in the following table and steps to familiarize yourself with the available data and what you can do with it.

    These steps give you insights into your compliance metrics for how well your teams meet their monthly remediation target dates for vulnerable item records as reported in your Service Level Agreement \(SLA\).

<table id="table_mkj_j3l_y2c"><thead><tr><th>

Your request or response

</th><th>

Description

</th></tr></thead><tbody><tr><td>

**What is my compliance for remediation for the month of October 2024?**

</td><td>

By default the lookup is based on assignment group.

 If you do not specify a month, the AI agent looks for the current month and then starts going backwards in time, a month at a time.

 Alternatively, you might ask the agent for a breakdown by configuration item class or vulnerability. For example, type **What is my compliance for the month of October 2024 for Windows servers?**

</td></tr><tr><td>

**Which asset types accounted for the most missed SLAs?**

</td><td>

The results are organized based on the data for the month of your original request by asset type.

</td></tr><tr><td>

**Which assignment group had the fewest missed Critical SLAs?**

</td><td>

Get the assignment group that had the most or least missed SLAs based on the vulnerable item \(VIT\) severity: `Critical`, `High`, `Medium`, and `Low`. Additionally, you can ask the AI agent to look up missed SLAs by VIT category.

</td></tr><tr><td>

**Show output for the previous question.**

</td><td>

Request the agent to review your previous question if it doesn't give you an answer.

</td></tr><tr><td>

**End the session**, or **Stop**.

</td><td>

End the conversation.

</td></tr></tbody>
</table>3.  Enter a request in natural language to see your remediation metrics for a given month and year, for example, `What is my compliance for remediation for the month of October 2024?`

    The results are organized into sections.

    -   Summary - Total records that had SLA remediation targets for the month and year you requested and the percent totals for missed and met target dates.
    -   Breakdown by severity - Vulnerable items that missed remediation targets are broken down by critical, high, medium, and low severity.
    -   Breakdown by assignment groups - Percent of the total records with missed targets broken out by assignment groups.
    -   More information: Remediation Compliance for October 2024 link - View more information about the data. A new tab opens in UI16.
    Your conversation is saved until you start a new chat. If the conversation ends unexpectedly, start a new chat. To start a new chat select the new chat icon \(\[Omitted image "icon-zoom-in.png"\] Alt text: New chat icon.\).

4.  You might ask for more specific information about missed SLAs, for example, `Which asset types accounted for the most missed SLAs?`

    The results are organized for the data for the month of your original request by asset type, for example, Windows Server, Database, Linux Server, and so on.

5.  You might ask for more specific information about your teams' productivity during that month, for example, `Which assignment group had the fewest missed Critical SLAs?`

    The assignment group is returned that had the least number of `Critical` VITs that missed the SLA.

6.  You might compare these results to another month, for example, `How does this data compare with November 2024?`

    The results are organized into sections.

    -   Comparison Summary - Total records that had SLA remediation targets for the time period that you first requested \(**October 2024**\) compared to your latest request \(**November 2024**\).
    -   Breakdown by severity - Vulnerable items that missed remediation targets are broken down by severity: `Critical`, `High`, `Medium`, and `Low`.
    -   Observations - Analysis of data and insights into data trends based on the comparison.
    -   More information: Remediation Compliance for November 2024 link - View more information about the data used for the comparison. A new tab opens in UI16.
    Retrieved SLA metrics for your requests are cached by the agentic transactions, in addition to the metrics that are retrieved monthly by a background job. All retrieved metrics are cached on the Remediation Compliance Insights \[sn\_vul\_ai\_remediation\_insights\] caching table.

    This table has ACLs that limit access to the records. However, if you determine that you want additional control over the permissions to this table, you can grant access to users with the sn\_vul\_ai.write\_rem\_insights and sn\_vul\_ai.read\_rem\_insights granular roles that are inherited automatically by the sn\_vul.vulnerability\_admin and sn\_vul.vulnerability\_analyst roles.

    The VR.System role also inherits these granular roles so background job execution for the workflow can occur.


**Parent Topic:**[Using Unified Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/using-unified-security-exposure-management.md)