Security Archives - Wrangu

AI, Security & the Future of Risk

Rachel Tobin — Tue, 14 Apr 2026 15:09:27 +0000

In this episode, Sam Allison and Dipak Varsani explore how artificial intelligence is reshaping the security and risk landscape for large organisations, and why governance is key.

The post AI, Security & the Future of Risk appeared first on Wrangu.

Security Meets Reality: Influence, Alignment & Breaking Silos

Rachel Tobin — Tue, 14 Apr 2026 15:07:22 +0000

In this episode Dipak and Sam discuss the cultural factors that define cybersecurity outcomes and the importance of aligning people, priorities, and perspectives.

The post Security Meets Reality: Influence, Alignment & Breaking Silos appeared first on Wrangu.

The Bare Minimum

Rachel Tobin — Tue, 14 Apr 2026 15:02:12 +0000

In this episode of Wrangu’s Not a Podcast, Podcast, we explore the operational side of cybersecurity: the real challenges security teams face, what it takes to build true organisational resilience, and why compliance is sometimes bare minimum.

The post The Bare Minimum appeared first on Wrangu.

Cybersecurity in the Real World

Rachel Tobin — Tue, 14 Apr 2026 14:58:06 +0000

In this episode Maciej and Dipak discuss career paths into cybersecurity and explore real-world challenges, operational pressures, and how organisations can strengthen resilience in an increasingly complex threat landscape.

The post Cybersecurity in the Real World appeared first on Wrangu.

Cyberattacks Break Culture

Rachel Tobin — Tue, 14 Apr 2026 14:54:56 +0000

James shares why cybersecurity is a global issue that often goes unnoticed when done well, and why most people only relate to security when it becomes personal, whether that’s protecting your mailbox, your identity, or your home.

The post Cyberattacks Break Culture appeared first on Wrangu.

Modern Cybersecurity, Timeless Security Thinking

Rachel Tobin — Tue, 14 Apr 2026 14:52:21 +0000

In this episode of Wrangu’s Not a Podcast, Podcast, we sit down with James Taylor to explore the mindset behind meaningful security, from childhood curiosity and taking computers apart, to 25 years in tech and becoming a trusted security leader.James shares why cybersecurity is a global issue that often goes unnoticed when done well, and why most people only relate to security when it becomes personal, whether that’s protecting your mailbox, your identity, or your home.

The post Modern Cybersecurity, Timeless Security Thinking appeared first on Wrangu.

Cybersecurity is a Leadership Issue

GladiorDeveloper — Thu, 02 Apr 2026 08:04:44 +0000

In this episode of Wrangu’s Not a Podcast, Podcast, we dig into the SecOps challenges most teams are struggling with: alert overload, tool sprawl, inefficient workflows and the burnout that follows.Featuring:Bobbi McCord – With 12 years in IT and a specialism in cybersecurity, Bobbi is Wrangu’s ‘Cyber Simplifier,’ helping organisations turn complex security challenges into actionable strategies.Dipak Varsani – With 15 years in the Public Sector, Dipak is a Risk & Assurance SME, bridging governance, risk, and operational performance. Whether you’re a CISO, ITSM professional, or cybersecurity leader, this episode opens important conversations and offers practical insights on strengthening your organisation’s approach to security and resilience.#CyberSecurity #SecOps #Wrangu #SecurityOperations #ThreatIntelligence #CyberResilience

The post Cybersecurity is a Leadership Issue appeared first on Wrangu.

UK Cyber Security and Resilience Bill: Key Changes Explained

Wrangu — Fri, 27 Feb 2026 17:06:07 +0000

What the UK Cyber Security and Resilience Bill means for organisations in 2026: scope expansion, reporting timelines, penalties, and raised expectations.

The post UK Cyber Security and Resilience Bill: Key Changes Explained appeared first on Wrangu.

The Future‑Ready SOC

Abi Adesanya — Tue, 06 Jan 2026 17:36:29 +0000

“The technology to build an intelligent SOC exists today. The difference I have seen between teams that thrive and teams that stall isn’t access to features – it is the operating model around them.”

About the Author

Abi Adesanya

Abi Adesanya, Wrangu’s Senior ServiceNow Security Specialist, is a Certified Master Architect with over 15 years’ experience driving successful SecOps implementations on the ServiceNow platform.

Executive Summary

The SOC that earns a seat at the business table does not just react faster, it anticipates, adapts, and learns. Since the uptake of AI into everyday life, I have watched AI-assisted workflows change the posture of security teams I work with. The shift is subtle at first: less time lost to swivel-chair triage, fewer déjà-vu incidents, and a steadier hand during spikes. Then it becomes unmistakable: the SOC moves from firefighting to forward-looking risk management, and the rest of the organisation starts to plan with security rather than around it.

This Blog

This chapter is a practical guide to building that future-ready SOC with ServiceNow; one that uses Predictive Intelligence, AI-powered automation, and intelligent orchestration to amplify human judgement.

No magic numbers, no silver bullets. Just a blueprint I’ve used in the field to turn promising features into reliable outcomes.

Business value you can expect

Fewer interruptions: Repetitive work is handled by automation and AI-assisted workflows, freeing analysts to focus on nuance.
Faster, safer decisions: The right context lands with the signal, and high-impact actions are wrapped in human-in-the-loop guardrails.
Clearer risk posture: Patterns across incidents, vulnerabilities, and changes inform roadmaps, not just reports.
Credible, repeatable performance: Evidence of what happened and why lives in the record by design.

Beyond Traditional SOAR: Toward the Intelligent SOC

The industry has long promised “automation,” but in many deployments that meant scripted responses to known situations. The future-ready SOC goes further. It learns from data, predicts likely next steps, and adapts workflows so people spend their judgement where it matters most.

In practice, this looks like three reinforcing capabilities inside ServiceNow:

Predictive Intelligence for signal handling; classifying and routing incidents based on historical patterns and current context.
AI-assisted triage and response, suggesting similar cases, relevant knowledge, enrichment steps, and probable next actions.
Autonomous but accountable playbooks, automation that runs to completion where safe, pauses for approval where impact could be high, and records rationale along the way.

Business value in practice

Noise reduction: Analysts see fewer, clearer work items.
Consistent outcomes: The same signal produces the same baseline response, regardless of who is on shift.
Better learning loops: Every resolved case feeds the models that assist the next one.

AI-Powered Threat Prediction and Response

I have seen teams gain real traction by using ServiceNow’s Predictive Intelligence to handle two perennial bottlenecks: classification and assignment. Models trained on your history can propose category, severity, and owning team with surprising accuracy, especially when you have done the foundational work to normalise fields and align services to the Common Service Data Model (CSDM).

From there, AI assistance can surface similar incidents, reusable work notes, and recommended enrichment (CMDB context, identity details, recent changes, related vulnerabilities). That turns the first five minutes from guesswork into guided action. The analyst still decides, but they start closer to the answer.

How I operationalise it

Start with a well-scoped incident type (e.g. phishing, suspicious process, failed login storms).
Train models using clean, representative cases; retire edge-case labels that confuse patterns.
Pair predictions with Flow Designer steps that gather context automatically.
Capture acceptance or rejection of suggestions to continuously improve.

Business value in practice

Shorter time to confident first action.
Higher right-queue rate on day one of triage.
Less analyst fatigue during alert spikes.

Autonomous AI Agents

“Autonomous” in a SOC should never mean “unaccountable.” Where I’ve seen AI Agents thrive is in handling bounded, repetitive tasks with clear blast-radius limits; think gathering evidence, running targeted scans, pulling user or device history, closing duplicates, or executing low-risk blocks.

The pattern that works is tiered autonomy:

Tier 0: Observe and suggest. The agent proposes actions, references similar cases, and queues enrichment for approval.
Tier 1: Auto-execute low-risk steps. Examples: attach CMDB or identity context, correlate with known IOCs, open a vulnerability record for a known signature.
Tier 2: Human-in-the-loop actions. For host isolation, firewall rules, or production changes, the agent preps the action with evidence and rationale, then waits for a human click.
Tier 3: Post-action verification. The agent validates outcomes (e.g. endpoint isolated, misconfiguration corrected) and updates the record.

Business value in practice

Machine-speed where safe, human judgement where wise.
Lower cognitive load for analysts without ceding accountability.
Reliable audit trails, every suggestion, approval, and action captured in the record.

Security as Competitive Advantage

The strongest proof that the SOC is future-ready is outside the SOC: product teams ship with fewer surprises, customers see resilience in action, and leaders make better bets because risk signals are timely and clear.

Where I have seen the advantage show up

Enabling business agility: Security gates become guardrails that accelerate delivery; pre-approved change windows, well-tested playbooks, and clear ownership paths.
Customer and partner trust: Demonstrable control evidence and consistent response make due diligence conversations short and boring, the best kind.
Informed strategy: Patterns from incidents, vulnerabilities, and cloud findings shape investment; modernise a brittle service, retire a risky dependency, or double down on controls that are paying off.
Optimised spend: Automation shifts budget from low-leverage labour to risk-reducing improvements and talent development.

Business value unlocked

Faster routes to market with fewer late surprises.
Shorter sales cycles when security due diligence is easy to verify.
Higher return on security spend directed where it changes outcomes.

Operating Model for an AI-Ready SOC

AI capabilities do not deliver on their own. They need clean data, clear ownership, and calm processes. The operating model I recommend is intentionally simple:

1. Data Foundations

Normalise severities, entities, and key fields across sources.
Align services and owners to CSDM so routing, escalation, and reporting are trustworthy.
Treat CMDB hygiene as a security control; stale ownership is a hidden tax.

2. Decision-First Design

For each top use case (e.g. phishing, credential abuse, misconfigurations), define the first five-minute decision.
Design enrichment and recommendations to make that decision obvious.
Put actions in the record where the decision is made.

3. Tiered Automation and Guardrails

Classify actions by blast radius (no approval, one click, approval required).
Require rationale capture for high-impact moves.
Always model the rollback path.

4. Product, Not Project

Run SecOps as a product with a backlog, releases, and a small cross-functional council.
Use blameless reviews to refine playbooks and models.
Rehearse with tabletops so the process holds under pressure.

Business value in practice

Predictable delivery, improvements land on a cadence the business can plan around.
Reduced rework, normalisation and guardrails prevent brittle builds.
Sustained adoption, teams stick with workflows they helped design.

Measuring What Matters in an AI-Enabled SOC

Vanity metrics do not teach you anything. Directional indicators do.

I focus on signals teams can influence and leaders can trust:

Time to confident first actionon AI-assisted incidents.
Manual touchpoints per incidentbefore and after automation.
Right-queue ratefor AI-classified records.
Remediation reliabilityfor playbook-driven fixes (completed within window, minimal rollbacks).
Override patterns: Where humans routinely disagree with AI, fix the data, the thresholds, or the playbook.

About Wrangu

Wrangu partners with organisations to build future-ready security operations on ServiceNow. We combine platform expertise with pragmatic product thinking: get the data right, design for decisions, add guardrails, then automate deliberately. The result is a SOC that feels calmer and performs better, one where AI amplifies the team instead of replacing it.

What we bring

Strategic advisory: Roadmaps aligned to business outcomes, not just feature checklists
ServiceNow SecOps Implementation: Expert-led deployment using best-practice architecture to unify security data and automate incident response workflows
Ongoing optimisation: A cadence of sprints, reviews, and metrics so value compounds.

Closing: Build the SOC Your Business Can Bet On

The technology to build an intelligent SOC exists today. The difference I have seen between teams that thrive and teams that stall is not access to features, it is the operating model around them. Invest in clean data, decision-first design, and guard railed automation. Treat SecOps as a product. Measure what changes adoption and let your records tell a clear story of judgement and action.

Do that consistently, and security becomes a competitive advantage: fewer surprises in delivery, faster recovery when incidents land, and leadership that plans boldly because the SOC is a dependable partner.

The post The Future‑Ready SOC appeared first on Wrangu.

Optimising SecOps for Maximum ROI

Abi Adesanya — Tue, 09 Dec 2025 14:07:23 +0000

“Technology rarely fails — operating models do.”

About the Author

Abi Adesanya

Abi Adesanya, Wrangu’s Senior ServiceNow Security Specialist, is a Certified Master Architect with over 15 years’ experience driving successful SecOps implementations on the ServiceNow platform.

Executive Summary

After years rescuing under‑performing SecOps programs, I have learned that technology rarely fails but operating models do. Teams buy a powerful platform, wire a few integrations, and then run yesterday’s processes in today’s tool. The result is familiar: a sophisticated system used mostly as a ticket queue, automation that stays on the shelf, and dashboards that report activity instead of impact.

In this chapter, I distill the patterns I routinely encounter; the value traps that quietly erode return on your ServiceNow SecOps investment, and the practical moves that unlock compounding value. None of this requires heroics or risky overhauls. It does require disciplined design, strong ownership, and the courage to simplify.

Four Value Traps That Kill SecOps ROI (and How to Escape)

Trap 1: The “Lift-and-Shift” Mentality

Symptom: Old processes are copied into ServiceNow unchanged, manual triage, ambiguous ownership, approval chains designed for email.

Why it hurts:

You automate very little and simply move friction into a new interface. Analysts still swivel between tools and guess at the next step.
The new tool may not support all the old playbook functions. Trying to mimic legacy patterns instead of rethinking the logic leads to missed opportunities; achieving the same business objective often requires a new approach.

Escape path: Redesign around the first five-minute decision for each alert type. Enrich automatically (CMDB, identity, changes, threat intel), route by service ownership, and codify the decision tree in workflows/runbooks.

Business value unlocked

Shorter time to action: Decisions become obvious because context arrives with the alert.
Fewer handoffs: Clear routing to accountable owners reduces delay and confusion.

Trap 2: Customisation Without Business Justification

Symptom: Every edge case gets a custom field, table, or script “just in case.” Forms overwhelm users; upgrades become fragile.

Why it hurts: Complexity raises maintenance costs, slows delivery, and discourages adoption. Your best analysts become part‑time platform engineers.

Escape path: Default to out‑of‑the‑box capabilities and configuration over code. Establish a lightweight design review that asks two questions: What business decision does this enable? What is the OOTB alternative? Time‑box exceptions and retire what is not used.

Business value unlocked

Lower total cost of ownership: Less custom code to maintain, test, and refactor.
Faster iteration: Teams ship improvements quickly without worrying about breaking bespoke parts.

Trap 3: Treating SecOps as “Just Another Ticketing System”

Symptom: Stakeholders think of SIR and VR as record keepers, not decision and action hubs. Automation is optional; containment actions live in other consoles.

Why it hurts: You lose the value of ITSM feeding security issues and real-time CMDB enrichment. When actions happen outside ServiceNow, teams must manually sync data, which is rarely up to date so context quickly becomes stale and responders may act on outdated information.

Escape path: Bring action to the record. Use Flow Designer and IntegrationHub to execute containment (isolate host, kill process, block hash), kick off scans, or open change windows from inside the incident or vulnerability record. Add human‑in‑the‑loop approvals for high‑impact steps.

Business value unlocked

Machine‑speed response with human judgment: Low‑risk steps flow automatically; risky moves require a click, not a meeting.
Unified evidence: What you did and why you did it are captured in a single place.

Trap 4: Ignoring Change Management and User Adoption

Symptom: The technical build finishes and everyone goes back to old habits. Playbooks sit unused; ownership is unclear; reports do not match how teams actually work.

Why it hurts: The platform’s potential never becomes muscle memory. Improvements fade after go‑live.

Escape path: Treat SecOps as a product, not a project. Publish runbooks that explain the why behind each step; run blameless reviews to tune enrichment and guardrails; conduct regular tabletops; hold joint ceremonies with IT and cloud owners – aim to remove frictions.

Business value unlocked

Durable adoption: Teams trust the process because they help shape it.
Resilience under pressure: When incidents spike, the system bends but doesn’t break.

Make It Stick: People, Data, and Guardrails

Great SecOps programs feel calm because the foundations are tidy and the human experience is thoughtful.

People:

Write runbooks that teach the rationale, not just the clicks.

Celebrate analysts who improve playbooks, not only those who close the most tickets.

Pair junior analysts with senior reviewers on high‑impact actions to build judgment.

Data:

Normalise across sources – severities, entities, and key fields, so an incident looks and behaves the same regardless of origin.

Align services and owners to CSDM; vague ownership is a tax you pay every day.

Guardrails:

Classify actions by blast radius. Default to automation for low‑risk steps.

Require approvals (and provide context) where business impact could be high.

Always design an escape hatch: the rollback path should be as obvious as the execution button.

Business value in practice

Higher decision quality: Analysts spend their judgment on edge cases, not data gathering.
Controlled speed: You move fast where it is safe and pause where it is wise.
Consistent outcomes: The same signal leads to the same response, regardless of who is on shift.

Measuring Progress (Without Playing the Numbers Game)

Directional metrics tell you if the system is getting healthier. I rely on a small set that teams can influence directly:

Time to confident first action: How long until we take a meaningful, justified step (contain, escalate, assign)?
Manual touchpoints per incident: Clicks, hand‑offs, and hops you can remove through enrichment and automation.
Right‑queue rate: Do high‑impact incidents land with the correct service owner on the first pass?
Remediation reliability (VR): Do planned fixes complete within the window without emergency rollbacks?
Narrative completeness: Can someone reconstruct what happened, who decided what, and why -using only the record?

Business value in practice

Trustworthy reporting: Leaders see progress in trends, not vanity counts.
Sharper investment calls: Metrics point to where another playbook or enrichment will move the needle.
Cultural reinforcement: Clarity, ownership, and learning become the norm.

A Note on Compliance: Make Audit the Exhaust, Not the Engine

When enrichment, approvals, and remediations happen inside ServiceNow, audit evidence is created by the work itself. Reporting for GDPR, SOX, NIS2 and sector standards becomes selection and export rather than reconstruction across five systems.

Business value in practice

Less audit prep time: Fewer ad‑hoc artifact hunts.
Lower compliance risk: Guardrails reduce variance in how work gets done.
Reclaimed focus: Teams spend energy improving controls, not assembling binders.

Putting It All Together

Optimising ServiceNow SecOps for maximum ROI is not a one‑time sprint; it is a steady cadence of thin, high‑leverage improvements. Avoid the traps; do not lift‑and‑shift broken processes, resist unnecessary customisation, bring action into the record, and invest in adoption. Then run the framework, baseline, audit, sprint, and govern. Keep the integration imperative front and centre: connect what matters, orchestrate the decisions that follow, and measure what improves the business.

When you build this way, the SOC feels different. Interruptions are rarer. Investigations start with answers instead of questions. Leaders trust what the metrics say because the work and the evidence live in the same place. And you, as the steward of that calm, trade fire drills for strategy.

Coming Next: The Future‑Ready SOC

In Part 6, “The Future‑Ready SOC: AI, Automation, and Strategic SecOps Evolution,” we will explore how leading organizations are using artificial intelligence, predictive analytics, and adaptive automation to stay ahead of evolving threats and turn operational excellence into competitive advantage.

Special thanks to Ayner Perez for his thoughtful review comments

About Wrangu

Wrangu specialises in maximising ServiceNow SecOps value through systematic optimisation, workflow reengineering, and organisational change management. Our proven methodologies consistently deliver measurable ROI improvements and sustainable security operations transformation.

Contact our specialists to optimise your SecOps platform for maximum ROI and long-term success

The post Optimising SecOps for Maximum ROI appeared first on Wrangu.