ServiceNow, Inc. (NOW) Earnings Call Transcript & Summary

So welcome, everyone. we're going live on ServiceNow with Snyk. My name is Aaron Bennett. I'm Tech Clients' manager here at ServiceNow, I'm proud to welcome the Snyk team, plus one of our own to present to you this community webinar. So Marco Morales, Wendy Swank. Welcome, and I'll turn it over to you. And go ahead and feel free Wendy, Akhila to talk about the results of our poll.

Wendy, do you want to take that?

Sure thing. Okay. So -- our first question, what brought everyone to the webinar today, looks like we have a good balance of our press release, which hopefully everyone did see on the 24th. We issued a great press release that really shows the journey of ServiceNow and Snyk from being a client of Snyk, now our partners and investment news as well. So that was very exciting. Looks like our second question, are you leveraging Snyk and ServiceNow today, a good mix of about 15% of the audience leveraging Snyk 45%, leveraging ServiceNow; 9%, leveraging both and 30% neither. So -- this is a great opportunity for those of an either camp to learn more about what we're doing together, you'll see the strengths of ServiceNow, the strengths of Snyk, but of course, the better together solution is the real power here who'll win the big football game? This is kind of sick and 45% said what game? Well, all right, so we've got to have some additional enablement here. We have 27% on the Chiefs. I think they have won too much, and I'm a Patriots fan, so I'm sure people will say, don't say that,patriots have won too much, but really have been looking terrible this year, naturally. The Eagles 27% all right. Even on the teams but -- surprising part is the what game ? All right. So with that...

We welcome the disinterest in. absolutely.

Of course.

Why don't you go ahead and introduce yourselves once to get this thing going.

Sure. I'll leave it. Wendy, why don't you go ahead and since you've been talking.

Excellent. Well, thank you again all for joining. My name is Wendy Swank. I'm located outside of Boston, if my team affiliation didn't give it away. I'm Alliance Manager here at Snyk working with our strategic partner, ServiceNow and working very closely with Aaron and Akhila and a lot of the other ServiceNow folks very happy to be here today. Marco, why don't you go?

Yes sure. My name is Marco Morales. I'm a Partner Solutions Architect at Snyk, and I'll be doing the Snyk side of the demonstration. I am from Chicago. I presently live in Philadelphia, so I'm supposed to be rooting for the Eagles.

I'll go next Marco. Hi, everyone. I'm Akhila Managoli. I'm a [indiscernible] architect for Alliance team from ServiceNow work closely with Aaron and of course, on the partnership on Snyk with Wendy and Marco and I'm from Bay area.

Okay. So today, we're going to be in the next, say, half hour or so, we're going to show you a couple of slides to introduce and give you context. Our goal today is to describe the latest and the new and improved or however you want to call it, integration Snyk has with ServiceNow. So we'll show you some of the things, and then we'll do some demoing to show you how people use Snyk to provide context. Some of you may not be developers, some of you may be, but it's going to be, here's how a developer uses Snyk and then how it plugs into ServiceNow. So we are brand new as of January 24, we have a new app on the ServiceNow store. We do this over a period of several months. We're really excited. We want to start conveying certain ideas that we're going to hit home a couple of times during this presentation or at this demonstration. First is that we're going to help you all your entire team track and manage vulnerability. So what's happening is with today's DevSecOps teams, sometimes people don't have full visibility. So we want to help your entire team track and manage those vulnerabilities. We also want to give with this enhanced visibility, the chance for your team to make decisions a little bit faster, which we believe. And we also want to pull on the idea that this is a unified view across your entire team, including your application security team, security professionals, which may have been previously disconnected. This whole idea here is to give everybody a view so that you can all understand the risk of what your vulnerabilities are. And I'll show you a couple of examples of what that means. Let's start introducing Snyk. So Snyk, It's a developer security platform. If you've seen any demonstration or visited our website, you'll see and hear us talk about we're a developer first. Really, what that means is we try to work within the day-to-day workflow from developers. We try to provide all these tools and experiences for their benefit. So they feel very comfortable using our products. We have more than one. We have Snyk code, which is for what people use when they write code -- some people call that SaaS or software application security testing, that is one of our products. We also have Snyk open source, which is going to be the primary emphasis in this webinar. Open source are the libraries that developers may bring in as they build and create software. We also have other products for a Snyk container. This question does come up often. We are not covering that today. But is for those people who create containers. We have Snyk IaC infrastructure as code. We have Snyk cloud for cloud deployed assets. Again, we are going to emphasize Snyk open source. I know that people have other questions, but you'll see a lot of the conversation only around this solution here. Why Snyk? So this is why should you care? So we have a bunch of different assets out here. And I'm going to speak to a couple on numbers. So Snyk has the world's largest open-source library database, and that's pretty cool for us. We have more vulnerabilities in our database than any other company, which we find is really helpful because oftentimes, we've learned and the example here in the middle that some vulnerabilities hit our database first before anybody else at a pretty good rate. We also offer ideas around how to help your teams work with low false positives. Many of you have seen a phone book, a very large number of vulnerabilities. We're trying to limit this as much as possible. And we also want to provide you and your team the right context and guidance so that they know how to solve and address these vulnerabilities. It's one thing to be told, you have an issue here. It's anotherone that we told here's why it exists. And as the third thing for us to tell you here is how you fix it. And we'll show you a little bit of that today. Where do we fit in? So this comes up often in terms of where does Snyk fit in? How does it work? I am a security professional. We want to emphasize that we are primarily in the application space. Many of you may be familiar with perimeter or networking defenses, Snyk is not that -- and those are great solutions. We have partnerships. We were friends with them. We respect them, but we are primarily around the software application that you and your teams to develop. At this point, I'd like to turn it over to Akhila to give you an overview briefly about ServiceNow.

Thank you, Marco. I was just thinking where to start with ServiceNow, right? I don't know. I'll just start from the beginning. So I don't -- we have a lot of people on the webinar. I don't know how much you know about ServiceNow. So historically, we know that ServiceNow -- is noted as IT ticketing solution, right? But over the past few years, folks have seen just how much more ServiceNow has done and is doing. So it's the ServiceNow starts with the now platform and its breadth of capabilities. All of which we can leverage in various industries we serve today. It could be Finserv, it could be health care, it could be many other industries and also the verticals we serve, like solutions portfolios we serve, like IT service management, IT ops management, it could be security operations, risk and the latest one to add to our [ feather ] is the ESG, the HR service delivery and so much more. And as we say, ServiceNow helps the world work better. That's what ServiceNow stands for. But as Marco was sharing in today's presentation, we are going to limit to vulnerability response. So as I was talking about security operation, the vulnerability response module is part of that at the broader SecOps module, which really helps organizations to manage their attack service management. So when it comes to attack service management, you might be familiar, there are multiple different kinds of vulnerabilities and organization that makes pose to. There's infravulnerability, there is cloud vulnerabilities, there is, as Marco was talking about container. And all of that, the vulnerability response module supports basically by bringing in the data from integrating with multiple scanners you bring in the data to service the platform. And then on top of it, you can add the features are part of the well response module Comingle all that and which makes the remediations fastest for the target teams. But again, dwelling -- just going a level deep within that is application vulnerability response, which is part of the broader well response, which focuses mainly on the application vulnerabilities. So within application vulnerabilities, if you were to think there are multiple different kinds of vulnerabilities, there is SAST, which is a frequently started application testing, security testing and theres DAST, which is dynamic application security testing and there is software composition analysis. So with Snyk and ServiceNow integration, we are going to bring the software composition analysis results found from Snyk platform in to the ServiceNow vulnerability response module. And you might be familiar that developers tend to use the open source components in their code, which is a very, very familiar concept. That said, that exposes so much risk and that the open source components does have multiple vulnerabilities inbuilt into them and how do we mitigate them? And Snyk is one of the top planning tools that is known for SCA vulnerabilities, and Snyk -- integration of Snyk with ServiceNow brings all the data for you in a much handable fashion within the Service of platform and makes developers' life really easily. Marco, can you go to the next slide? Yes. So I touched base on this already a little bit. As you see application vulnerability response expandable SAST, DAST, SCA, pen test and furthermore and could be -- a security in today's -- right? So we -- for today's conversation, we'll be focusing on software composition analysis results of integration with Snyk and ServiceNow. Marco, you want to take it from here?

I was on mute. Thank you. So today, we're going to show you how we cover these assets here. It is a new app. We're excited. We want to show you how we provide visibility, and let's now start getting into a demonstration of the everyday workflow of a developer and how this gets absorbed and fed into ServiceNow. So if I'm right, this next slide, again, we're here better together, Infinity. This is fantastic stuff. But the part here is we're going to show you Snyk, I'll do that for about 5, 10 minutes. And then Akhila is going to pick it up with how this information is picked up in ServiceNow. So from here, I'll transition over to a different tab. I'll have more than one tab that I'll navigate into to just give you a feel of the everyday life cycle of a developer. So first and foremost, I want to just draw attention to a public GitHub repository that Snyk host. And we have a number of deliberately vulnerable applications. We have them with different languages. This one happens to be node. We have a job and other ones, but we provide these as public assets for you and your team to inspect and try out. One thing we do recommend is that you do not, again, do not run this in a production environment. These are deliberately vulnerable because we run exploits. Today, I'm going to leverage some of these vulnerabilities to just show you how it works and how it works within Snyk. Next what I want to do is show you an IDE I've made the fonts big and high contrast for your benefit. So you can see, if you like small finds and dark mode, we'll do that at a different time. But for today, we'll just look at it in a nice and easy in an easy view. So what I have here is the actual clone repositor, I created a fork and I have it in my environment. And what I want you to appreciate it if you're a developer or not is we try very hard at Snyk to give the developers an in-line experience. And if I do this right, all the stuff that I'll show you is going to stay within the IDE -- of course, your developers can go elsewhere. But when your development team is writing their code and using open source. One thing I forgot to mention during the presentation is we've discovered that anywhere between 70 and 90% of the total application payload in modern applications is actually open source. So that means developers may be running 10% to 30%, but they bring in a lot of open source, and that's where this example comes in. So I'm a known developer. I have certain files to file in the middle, which is package Jason, is something most know developers are filming with and they'll say, "I know what this means. On the left, what I've already done is I've navigated into the Snyk extension on Visual Studio Code. You may be wondering, do we support others? The answer is yes, we do have IntelliJ and Eclipse. But in my day-to-day, I tend to use Visual Studio code because it just hemps to be of my benefit. If you look at my screen closely, you'll see I have the open source security panel open. But I've closed the code security and the code quality, which are around the other products. Again, I want to emphasize one more time. We're only looking at Snyk open source for this ServiceNow integration at this time. So developer has this information. They're looking at it and they manage their own work within their life cycles. Maybe they make changes whenever they can or maybe they use ticketing systems. But the idea that Snyk is trying to support is we will give your development team all the information they need as they're doing the work so they can triage and do the right thing. -- you'll see the letters like C for critical, H for high. These indicate high and critical severities for vulnerabilities. There is a lot more that we're going to dive into, but these are all signals for your development teams to know what am I working with? What am I looking at? I've highlighted 1 as [Jason package] because it happens to be a critical, it's like the second one, but I [ better ] than handle bars. The information we have here you will notice is going to be available in a variety of formats. Here is 1 of the IDE. Later, I'll show you the UI on the web application. What we try to do is we try to provide people as much context as possible, including the CBE database entries, which are public assets that contain all this information, anyone can look at it. This is a way for you. If you're curious or you just want to know more, can click into and study them. But at your fingertips here, you have a number of things like we described the problem. We tell you what they do in this case, a version upgrade. And you can then choose to operate within your team's workflow, your SDLC to address this issue. And one of the things I do want to show -- and your team will have different ways of using this information if they want to use pull requests and so on. We support all those things. A question that sometimes comes up is what repositories that we support? We support all popular Git repositories. This happens to be based from GitHub, Gitbucket and GitLab. Those are all equally find on-premise or host that are also good. What I'm going to show you here is some developers do like using the command line. I already have it in my history. I'm going to run a Snyk scan for open source, and it's only going to look at the critical issues. It takes a few seconds, I get my results. This kind of information is useful for those teams that I'll make this big -- this kind of information is useful for those teams who have members who really enjoy or like using the command line, maybe they use Jason output or maybe they include this into their build operation for any number of pipelines that we do support. This, again, I hope you can see, helps you see how a developer can do all of this work to manage their workload within their IDE environment. They don't have to leave it and they can do everything as they know and they love. Next, I'll transition over to a more global view, which has the same information in our UI. Snyk is a hosted application. I have -- there's organization structure we have these things called groups and projects we really think about it, it's like a nested [filtering ] type of structure. The application I have happens to be forked under my name, and the information we have here is in graphical format and UI, same kind of information that you have with the ID. Where this helps people is if you and I are working the same team, maybe I don't have my laptop or maybe I just want to open up a browser, -- or maybe I'm a leader or someone doing a drive by. And I just want to visually inspect the status of my teammates to other activities without having to do all the IDE work and other things. This is available for them. Package Jason, if I click into it, is going to give me the same information. But in a more familiar UI-centric way that most people are accustomed to when they use these different tools. I can talk through all the different fields that we use to help your teams prioritize, but really, the biggest point here is you can probably start to deduce that much of what we've been doing is around the structure to help developers work, help them collaborate, help them do all this work so that they are best equipped to address software vulnerabilities. AppSec is probably on the side wondering when can we see, when can we do stuff? And Akhila will show you that in a couple of minutes, but I want to close out with just a few more points. The details I'd like to show you here kind of go along the lines of how we provide the explanation to developers. But one of the things we know is really important and it's used in the ServiceNow side of the demo is that we have a concept of a priority score. What we learned over time is that sometimes people use 1 dimension like a CVSS score to prioritize. What Snyk has done with this Intel database and other proprietary and open information as we've used information on us, does this vulnerability have a known exploit in this case, to mature exploit. Doesn't this vulnerability have a fix available. You can imagine if there is an exploit that is known and there is a fix that's available, your priority score should get bumped up. The filters on the left, help you do some of the right things, if I were to click on critical to limit to just 3 and see which ones are fixable or whatever the numbers are here. This really helps you and your team figure out I can solve something very soon. You can see there's nothing that's fixable, but partially fixable is other stuff that we had hoped. Again, this part of the dental is -- I didn't do this track, but you can see the intention behind it. This is the kind of information we want to have your development team have at their fingertips so they can do the right thing. The last thing I'd like to show is something about dependencies. If you recall on the IDE screen, I had a small list of -- I'll make this terminal small, I had a small list of direct dependencies that me and my team listed -- you can see there's probably about 30 in this list. If I navigate over into the UI, you'll see that I have over 700. So this is something that's really important for those teams because transitive dependencies are really critical for how we do this. What happens is I use open source software, but the providers of that open source software may use other packages as well and then you get this lovely tree. When we look at the details behind the vulnerables, you'll see that tree spelled out as this brings and this brings in another thing and so on. And that's available to your team for you to use. In closing, I'd like to demonstrate that -- we've done our best so far, and we will continue to try to empower your development teams to address software vulnerabilities as they encounter them and manage it in their own time. Now Akhila is going to show you how we give access to the application security folks in ServiceNow visibility into what's happening. Akhila at this time I'm going to transition over I'll stop my share and let you pick it up.

Thank you, Marco.Just a second, I'm just bringing -- already. That was very detailed walk-through of Snyk platform and how users can look at the vulnerabilities within Snyk platform and the additional features of that all of that. So the good news is now we have seen how Snyk scans the application vulnerability and reports it for you and we can go see all the data there. But -- and with this integration with the SCA integration with Snyk and ServiceNow, we can bring in most of that data back to ServiceNow platform and make it visible for you, and as I was sharing, along with that, we can make use of the application vulnerability features we have, like risk or risk rating assignment rules, combined with all of that, which helps you the security teams and the developers to prioritize, which vulnerabilities they want to be fixing first, not only that, the post and remediation steps can be automated based on the process that you follow, right? All that is feasible and possible on ServiceNow platform. And I'll just take a step back before I start deep diving into the data, I'm showing on my screen. So what are the benefits of using application vulnerability response module itself? You can find and prioritize the application vulnerabilities faster, and we can remediate the vulnerabilities and the visibility across the team. And we can automate the prioritization and risk management using the configurable risk or calculators and rules. And we can -- the response activity can be driven much, much, much faster and efficient with -- by development teams. And not but of the least, pinpoint development issues proactively. All this is possible just using the application of vulnerability features. Now -- now I'm going to show you the data you're seeing already. This is the data we have brought in from the integration. So the integration itself makes use of the OAuth authentication. And once you authenticate, there are import jobs in place when you run them, they put -- bringing the data into the platform. Of course, there's lot of promising that's happening, all of that is in place, and collating and making sure that there's no duplication. All of that is already in place. So once all that happens, the record gets created in application vulnerability item table, which is the application of vulnerable response. As you see the stores you're already seeing here as Snyk, so I'm going to deep dive into this data a little bit here now, and you see the risk of populated risk rating the state and the remediation target, if it's already was set. So let's take a look at 1 of the A-Bit. A-Bit is nothing, but a unique combination of vulnerability to endpoint. That's what and A-Bit is. But in application vulnerability, it's a vulnerability existing on a unique application release. So what is the benefit of this integration, right? The Snyk and ServiceNow integration. You will have an ability to bring the projects from Snyk, which you're seeing already here. I'll walk you through that also in a little bit into ServiceNow platform as application releases and [packages] and stand applications. And you'll have an ability to bring issue from Snyk into ServiceNow as vulnerabilities, application vulnerable items and packages, and you will have ability to link application release and scan applications using the well-known CI lookup pro that I've provided within the platform. And also additionally, based on how your operation operates, you can also add additional CI lookup pro if need be. And not -- and finally, everybody needs -- the organizations need the data visualization. So that's already in place, which is a very friendly dashboard, which the remediation teams can utilize really well. So as you see here, I'm going to highlight the application release and you see the package -- and as I said, A-Bit is a unique combination of a vulnerability, which is already a C here which the CV with that number on on a packet that was found in a Snyk platform. If you were to start a little bit on this record you would see something while a source link. Source Link is a drill-down link, which will take you back to the Snyk platform for this particular application vulnerability, if you were to -- were seeking additional context, so many times, what I've seen is the remediators in this case, its development team or the security team, if they were looking at this vulnerability if they need additional context, they have to log in back to Snyk platforms separately and then start looking for this particular application release and vulnerability. But here, we made it easy for you. Just this link will directly take you to the vulnerability found, where you can get additional count is that you're looking for. Along with that, it also shows you the vulnerability summary and the recommendation how as Marco was talking about Snyk desk provide recommendation on many of the vulnerabilities that are found already, how this can be remediated. So all of this data above and combined with the features of vulnerability response like calculating risk and risk codes, which will help developers prioritize vulnerabilities at a faster rate and the assignment rules you might be seeing here, so they are predefined assignment rule. It manages to assign to a specific assignment group based on the configuration that's already set in place, which is exposed to end user to do that. So along with all of that, you can also drive all these prioritization based on the CMDB that's already populated with the application release data. So in a nutshell, Snyk data in -- data along with ServiceNow application vulnerability response module helps developer and the security teams remediate the vulnerabilities at a much faster rate. With this Marco I'll stop sharing and get back to you.

Thank you. At this time, I don't think we have any more slides to show, but we'll be happy to show screens if people have questions. I think there are a couple of questions. Wendy, do you have any guidance tuition we should address first?

Yes. So let's start with no particular order. I'm just going through ones that we got in the chat that were excellent, I think, for the whole audience to hear First one being, how do I find the app? Is it free or not? Marco, I can take this, but I did post the link in the Q&A section, our app is live in the ServiceNow store today. It is free to download, you will need certain entitlements on either the ServiceNow and Snyk side in order to leverage. But the app is in the store today, just head over to the store, you can type Snyk right into the main navigation search bar and go ahead and download that.

Thank you, Wendy. I'll look at the first question. The Snyk UI provides almost all the details required for vulnerability remediation, what extra does ServiceNow offer? So 1 of the -- and Akhila, you can pick it up after I start. But 1 of the things we've learned in the numerous requests we've had of customers is the ServiceNow user population, application security, security-minded folks don't always have visibility onto the day-to-day life of a developer. There is friction. There's a desire of the security folks to say, Can I see -- can I understand, do I need to push a tool down on to -- there's all these questions around understanding how the developers are managing their issues. What we're doing is, we're encouraging developers to address vulnerability as much as I can and grant visibility into the ServiceNow population. Akhila, if you want to add anything, please go ahead. I wanted to keep it short on purpose.

No. No, I think you covered it Marco. Thank you for that.

The next -- we've got a few coming in. So let's hit all these questions and then. We'll see when they slowdown.

Yes. If I understood the uniqueness, won't there be collisions on package names and CVs across groups or orgs with multiple package names or the same value? So I think, Wendy, I'm going to need your help here. This question does come up. So if the same vulnerability comes up again in the same package, I believe I'm right to say you don't get duplication. But if you have 2 different packages, 2 different software applications that have the same dependency, those things do show up separately as 2 different times. Wendy?

That is correct. You nailed it.

Okay. Yes. How does this work with multiple groups? So there's a lot of language here and maybe the anonymous attendee can post a follow-up. So groups can mean a lot of things. ServiceNow has probably its own term, Snyk has its own team, your company may have its own term. And so maybe what I want to hear is a clarification because we -- if multiple groups I have 2 different development teams, or multiple groups means like 2 different groups in Snyk, -- please help me understand with a little bit of a clarification on that if -- so I can better answer what do you mean by how does this work with multiple groups, unless some of the people on the phone or to call have their own perspective. Why do we sign vulnerabilities to a group? Why not group them in a sign up in ServiceNow that we do for infrastructure vulnerabilities? Akhila, I'd like to lead with your answer first, and then I'll color commentary.

Group. Why not group them in a sign in service now like to do? So the assignment group is very similar Sanjiv, it's -- assignment groups rules are the broader income on the configuration side, it works very similar to both infra and application vulnerability. So there's not much of a change. So I'm kind of confused with your question, if you were to answer. Are they grouping rule functionality? Yes, they are grouping to functionalities Yes.

Okay. Snyk also collects dependency license information. Yes, that's right. Is that information pulled into the ServiceNow platform, I see Wendy Swank my counterpart is typing an answer. I'm waiting with bated breath Wendy, if you can type it in.

Yes. This current integration does not pull in the license data.

Okay. I see it disappeared too. Are there group, if I -- how do we assess where it is ? -- so I'm looking at Sanjeev's 11:31 a.m. Eastern question, are there grouping rule functionalities for application vulnerabilities, Akhila? Is that yours?

Which one?

This would be the 1 at 11:31 my time, so it's from Sanjiv.

That's -- I mean I asked Sanjiv question, he reposted twice. I didn't answer twice.

Okay. How real-time are the updated ServiceNow. So there is a scheduling component, right? The -- there's a -- I'm sorry, there is a batch operation. I don't know the timing. It can be triggered by human. What is the timing on this?

Just to add to that, the input jobs can be scheduled daily or based whatever a different frequency. But pretty much what I've seen is organizations schedule them daily. And of the daily import job they run, the data is refreshed from and it matches with the Snyk platform to ServiceNow now at that point.

Okay. Is the 1132 the announce attending the multiple Snyk groups comment. Is that a clarification from 1 of the previous questions was that a new type of question?

I also interpret that as multiple seed deployments possibly, but like differentiated environments where you might want to pull that information into ServiceNow to get -- right.

So when we say multiple differentiated Snyk deployments, are we talking about -- so what are we talking about? Help me understand, Aaron.

So say, company A has a Snyk deployment and then they acquire company B, now they have two.

Yes. So that's something -- that's the host of the day type of question is depending on how those 2 organizations get consolidated within Snyk, at a very simple level, Snyk has a start with 2 primary structures. A group can have many organizations. Two different companies are likely to have 2 different groups. If we combine them if the 2 companies get acquired or merger or whatever, how those companies want to maintain their assets is going to be something that affects it. If you have 2 separate groups, you're not going to combine into the same ServiceNow environment is maybe the better one. They'll be in separate locations.

How is the go ahead. Let's say I see a good one. We might want to hit on is Snyk provides almost all the details required for vulnerability of remediation. What extra does ServiceNow offer? Obviously, a question for Akhila or Aaron?

Yes, I can add to that. So just to take a step back, it's a great indication with our SCA results to bring in intact service now. But I'm just looking from an organization from a security perspective, they might be using multiple tools for multiple different application already scanning. So -- with this, you can have your SAST, TAST and SCA everything in 1 platform. That's 1 way to look at it, right? You can see all the data. I don't know if you recall, I was showing on my screen is that we do have a software which specifically shows which so the data is coming from. So based on that you can group your different scanning imports and then remediate them at once and have a global view of what's happening within your application vulnerability for the given organization. So along with that, from the remediation standpoint, -- you can always use the additional workforce built into the vulnerability platform itself that can be leveraged to move the remediation faster. Aaron, do you want to add anything here, additional that you can think of ?

I think the other answer is sort of more global. It's having that data in ServiceNow, having the audit capabilities of ServiceNow layered on to the Snyk tool without causing any kind of conflict or friction with Snyk users. So we're not taking them out of their environment to submit issues or do anything. It's all transparent. So that's essentially the biggest boost that we get is that these groups can work together without any visible conflict or friction between the 2 tools. They just continue the regular operations.

Are we at the question from Saurabh, what do I need to have in CMDB for CI rules? I think that's your question to work efficiently and not end up with unmatched CIs?

It's a great question, Saurabh. And that's an ongoing struggle for all the organizations, right? So coming back to CMDB, we need to have the robust CMDB to start with for the CLO approves to work. That said, that's the first step. How can we measure the health of the CMDB. I know Aaron can really -- added more here he would be working on this different CMDB connectors them himself. But that's an ongoing problem and the solution for -- it's an ongoing work, I would say, right? -- how do I keep the health check on for CMDB and that way, I can make use of the CLO -- better so that it would end up in the unmatched CI. The short answer is to have a good CMDB populated before you start. But as I said, realistically, we have seen that it's not a easy -- it's very easier said than done. So it's a bit of lot of work there to have a good CMDB.