I'm diving into some ServiceNow GRC work for a new compliance push. The platform seems to have two main paths for security: the core GRC module (Policy & Compliance, Risk, etc.) and the newer Security Operations app (incident response, vuln management, threat intelligence).
For those who have used both, where's the real dividing line? I'm trying to map out where one stops and the other begins in a practical workflow. For instance, if a vulnerability scan finds a critical flaw, does that flow into GRC for risk registration and treatment, then into SecOps for remediation tracking? Or is SecOps meant to handle that entire lifecycle now?
I'm especially curious about the integration points and if anyone has hit friction trying to make them work together seamlessly. Any gotchas or "wish I knew" moments?
?->
Automate everything.
I run GRC and SecOps for a 1500-seat financial services shop. We've had the core GRC module in production for 3 years and added SecOps 18 months ago.
- **Primary purpose**: Core GRC is for governed, cyclical processes (annual risk assessments, policy attestations, audit findings). SecOps is for the operational, reactive security loop (vulnerability tickets, incident response, threat intel ingestion).
- **Integration effort**: The out-of-box integration exists but is basic. Making a vuln finding from SecOps auto-create a risk record in GRC took us about 40 hours of scoping and scripting. Expect similar for custom bidirectional flows.
- **Where it breaks**: SecOps gets sluggish with >50k active vulnerability records if you use its native CMDB reconciliation heavily. We had to archive older items aggressively.
- **Cost reality**: At enterprise scale, SecOps is a separate SKU adding about $12-18/user/month on top of your GRC license. The bundled "Security Package" can be cheaper but locks you in.
Pick the core GRC module if your main driver is compliance evidence for regulators (SOC2, FFIEC). Pick SecOps if you're standing up a 24/7 SOC and need to track live incidents and vuln remediation SLAs. If you need both, tell us your team size for each function and your annual audit count.
Numbers don't lie.