ServiceNow, Inc. (NOW) Earnings Call Transcript & Summary

Hello, everyone, and thank you for joining me this morning for our security analytics webinar. My name is Jonathan Williams, and I am a Senior Product Marketing Manager with ServiceNow. I've been here about -- going on 7 years. And today, we're just going to talk about performance analytics, and how we can harness the power of that to help us with our business processes and specifically, with security. Today, we're going to go over our analytics capabilities and just a few slides there. And then once we're done, we're going to go into a demo where we're going to demonstrate some of those different capabilities within Performance Analytics and Reporting and as well show you some of our dashboards and some of the new things that are available to you. And then after that, we're going to jump into a question and answer, where we'll go ahead and field some of your questions, which I'm sure we'll have at the end. And hopefully -- yes, hopefully, we can answer some of your questions throughout the presentation. But please go ahead and note those as we go through, so we can get those answered at the end. All right. Let's go ahead and jump in. So first is our analytics capabilities and our overview of reporting within the Now platform. So we have a few different solutions that are available to us within the Now platform. So we have a few different solutions that are available to us within the -- now platform. And here you see 6 of those. There are some others, but these are really the big ones. These are the core key capabilities and solutions that are available within Performance Analytics. And specifically, we'll touch on the security part of those. So we have our performance analytics which is the big one. This is the one that most people think of when we talk about reporting within ServiceNow. And then there is our reporting. And we're going to make sure to differentiate those because we do get a lot of questions about those. And sometimes it can be difficult to understand really the nuances of those. And then we have our CMDB query builder and out metrics, which, again, I think, gets confused a lot with performance analytics and reporting. So hopefully, we can clarify some of that. And then we have our data discovery and our natural language questions. And then lastly, our user experience analytics -- all right. So first, we have our performance analytics. So Performance Analytics is an in-platform process optimization solution, right? So this is where we're going to report on our KPI's in our metrics. And the really big thing here is to answer key business questions. We want to know about our business processes, and these are going to help us identify those and track those and specifically answer questions that we have that may be normal reporting can't help us. And these can help us do things with like increased quality, time to response, our efficiency and our cost of service delivery, which are all huge when we're talking about optimizing our process in our business solutions and our business processes. So performance analytics, [queries your data be scheduled jobs] These can be daily, monthly. There's really no limit to how you can do this. But essentially, the system will check on identified indicators that you set, and it will check on those at a predefined schedule and then from there, it will collect that data and provide you the feedback. And this is great because you can see trends over time, which is one of the differentiators between this and reporting. So with that data, we can help forecast and things like that. So in Performance Analytics, we have the Analytics Hub and [KPI] details, and this is where you're going to be able to actually view your analytics. We have our spotlight. This is weighted scoring so that you can find issues in your process. And depending on how you use it, you can identify and create efficiency or improve efficiency using this. We have our KPI signals, which are automated analysis of your scores to, again, help find hidden issues. These are small issues typically that you wouldn't otherwise be able to see unless you are able to collect and view that minute detail. And then lastly, we have our targets, which helps us set goals and track progress towards them. So not only do we -- are we able to affect change on the fly, but we can set goals on where we want to be -- and with targets, we can see how close we are to reaching them if we're on our way to reaching them or maybe if our changes aren't really getting us to where we want to be. So next, we have our analytics hub. The Analytics Hub is the exploratory view of our indicators. So this is where we're going to be able to see specific indicators that we have created, and we're going to see all of the different data about that. And from here, we have a wide array of use what you'll see in the demo that allow us to really dive into each indicator. And from there, we can perform a detailed analysis on that. It lets you see trends in predictions as well as breakdowns that you might have created for this indicator. And all of it is here right in 1 space so that you can see it. And it gives you a nice easy way to view it as well, and it helps us view it in a more understandable way. And then last, we have our -- this is the classic version of our KPI details, which we'll actually get into here next I believe. So I'll just go ahead and skip to the KPI details. Again, this is very similar to what we just saw with the Analytics Hub. This is going to provide us with a lot of the same detail, again, an exploratory view of our indicators and more detailed analysis, just a different view, a different way of looking at it. But again, we're able to see those trends, predictions and breakdowns, and we can actually see the associated records for each of our indicators. So if we want to see how we're getting this data, we're able to jump into each of these indicators specifically. We can dive into the data, the actual records that are being provided to this indicator to create this data. So this enables you to delve into information behind your key performance indicators. And lastly, this is the experience replacement for analytics up, like Ed mentioned. So this will be -- you can still see both of them, but this is ultimately replacing or improving, I should say, on the Analytics Hub. Next, we have our spotlight. So spotlight can identify and rank records of interest based on multiple weighted criteria. So essentially, what we're doing here is we're assigning different types of records, and then we're finding where each of those overlaps. And from here, we can actually see records that we might have overlooked. So by identifying and creating all these different criteria, which we can then wait, we can see the intersection of all of these different criteria, and you can actually add multiple criteria. There's really no limit to how many criteria you can. And each time you do that, you'll whittle down that number or that cross-section of records that you're trying to view, and this can help us dive really deeply into specific records, again, that maybe you might have overlooked. And so it allows us to view a subsection of records that often go missed or overlooked. And you can rank these records based on multiple dimensions, as I had mentioned before so we can add multiple criteria to this. Next, we have our KPI signals. KPI signals notify you when behavior of a process changes significantly and that -- how that change affects you. So again, this is going to be setting criteria that you want to know. Let's say, you have a number of open incidents, for instance. And we see a huge change in that. This is how we can get notified. We can notify ourselves of that. Now every process undergoes variation. Most of the variation is normal, such as common cause variation, let's say, over the weekend, you get more incidents. That's pretty normal, right? So those small differences won't really tip us off to anything important or significant. And what you need to know about, though, are the special cause variations. And this is when you see a huge change. So the example we have here is small differences each time you send your name. Everybody sends their name a specific way. And each time you do that, although they may seem very similar, there are minute differences in those, but not enough that the bank will hold your cheque or not cash a cheque because it still is within the realm of normal for what they see. Now if you were to sign that same cheque with your opposite hands, you're going to typically see a huge difference and the way the writing is and the way your name looks. And those are what we're looking for with signals. It's those big differences, all of a sudden, on Wednesday afternoon, when you typically see 50 incidents, now all of a sudden you see 1,000 incidents. That's where we're going to be looking into this. And this is where KPI signals really come in handy, and this is where we get the most benefit from them. And so they're going to let us know when that abnormal variation is actually occurring. Now performance analytics targets, somewhat similar. We talked about this a little bit earlier, I touched on it. So this is where we want to set our goals, right? So if we are, let's say, we have a mean time to close an incident of 3 days, analysts are just swamped and they get incidents in and they're just overloaded and bombarded. And right now, we're seeing an average close time of 3 days. Well, we can set that target to 2 days or whatever you want to see. This can go both ways as well. You can either lower those targets. You can see lower times as far as closing, or maybe you want to see a greater reaction time to think. So targets can be set on any criteria you want. And essentially, what we do is we set those targets, and then we try to work towards them. And through targets, we can actually see how we're trending towards that, whether we see analysts, all of a sudden, a 3-day meantime is slowly drifting towards 4 days. Well, then our target is going to let us know, you're actually going the wrong way. And so whatever changes you implemented, you actually might need to revise those and get back to the drawing table because whatever you're doing is actually having the opposite effect. And so targets help us to improve our processes and really help with the efficiency of our processes and our people. So we can set these and then track those and follow those to help us improve that efficiency across the board. And you can also set dates for these 2. You can set timetable. So make sure that you have realistic goals in mind and realistic numbers. And especially if you're doing performance reports or something throughout the quarter, you can set goals for yourself, and this can go down to the individual analyst level. So they could set an individual goal for themselves to try and work incidents more quickly as a goal for that year for that quarter. And then here, we can actually help them track that. So it doesn't have to just be at the business level. This can be down as far as the analyst level. At [XPM] reporting, and again, this is where we'll go into this because I really want to make sure that we differentiate reporting and performance analytics because I know this is oftentimes gets a little confusing for people. So reporting is when we're looking at specific records, we use reports to aggregate the data and drill down into specific records, right? So these queries are running real time. These are happening, and we're collecting the data as opposed to performance analytics where we can collect historical data. And the reports do still have interactive filters, just like performance analytics on our dashboards. And you can create those user-friendly interactive experiences within the dashboards just like you can for performance analytics. So it's really going to be the data that we're getting, and how we're viewing the data and collecting the data that are going to be the big differences. But again, I'll get into that as we go further. So render critical reporting, all-in platform and further customized with robust formatting, again, reporting enhancements, we can quickly perform calculations on specific fields while in our report designer, which is what you see on the right. So we can tailor reporting with multiple formatting options to highlight what's most important. Again, you can create these reports to see and view any type of record, any culmination of records that you want. They are obviously limited as far as compared to performance analytics. But really, what we're doing is we're viewing records different records across the platform or a combination of records to provide us with a real-time report of how things are doing. And then we can design dynamic reports with responses to questions [sort in the catalog]. So again, we can store those types of reports in there. And from there, we can use these reports to answer those questions. So simple on-the-fly calculations reporting, again, reports are very customizable. This report builder is amazing because we can select a group of records that we would typically want to see. And then from there, we can tailor this report so that we're getting all the data we want, and we're making sure that it looks like how we want before we go, and we actually start running these reports. So the report builder ensures us before we send our report query out into the wild that it's actually going to provide us with the data that we want. And then it's going to look like how we want. So allow us to report designers, and this is important, too, not just admin. So reports, again, do not just have to be created by the admin. These can be created by the analysts down at that level. So -- but they give us the ability to create derived fields based on other data tables. Again, we're looking at different fields, yes, different records in other tables, and we can create reports of those or multiple. Again, we can create a multiple. You can build a report you can define a new field for the report. Again, so going back to -- you don't have to be an admin for that. Now -- so like I said, we were going to differentiate performance analytics to reporting. So this graphic gives us a great example. But essentially, performance analytics and reporting are 2 distinct applications, right? They sound very similar. They do similar things in providing us detail about records and data within our instance, but they are 2 different applications. And they address different use cases, but -- and this is important, they are complementary to each other. Because, again, reporting is going to give us that real-time actionable data and performance analytics can do that. However, it's used to help us forecast and help us track trends. So Performance Analytics is able to generate accurate historical trends by capturing those continuous snapshots at a regular schedule. So essentially, what we're doing with Performance Analytics is we're taking data as far back as we want since you turn the instance on if that's where you want to see it. And we can see where we've been and where we are so that we can track where we're going, right, as you see in the graphic here, where it's reporting, it's just going to give us -- as soon as you run that report, it's going to give you the information that's in the system right down and there, and you can see where you're at. Whereas Performance Analytics gives us that whole 360 view, and we can see down the line where we're where we could be or where we're going. And again, this helps us in complement with the targets to see where we might want to be, and how we want to set our goals based on what Performance Analytics is telling us. So both of these can be used at the executive level. Both of these can be used at the analyst level. These give us great actual information, but they can also both be ran to give executives and higher-ups the information they need to make decisions based on funding, which is a really big one or perhaps buying new equipment or new tools or manning. So these are all very important when making those big decisions, especially around money for a company. So then we have our CMDB query builder. CMDB query builder allows us to easily build complex infrastructure and service queries and these can span multiple CMDB classes, non-CMDB tables and that involve many ACIs that are not connected to different relationships. So a big thing with this, you can handle large volumes of complex data, very large. And that's really important when you're talking about a CMDB, especially with the amount of equipment and devices and everything that we typically see. Query results can be used in standard reports and Performance Analytics, which is really nice, again, because we can use this data in both of those types of reports as far as, again, forecasting out or just getting that real-time actionable data with reports metrics. Metrics, they measure and evaluate the effect of IT service management processes. So a metric could measure the effectiveness of the incident resolution by process by calculating how long in each state. So we can actually break down how long each of these incidents are staying in a specific state, and that can give us even more information than if you were to just say track the open and the close of an incident. We can actually see along the way in each of those different states where maybe we're getting hung up maybe there's a specific point in our incidents that we're starting to see a lag time or more time -- dwell time, for instance, and we're seeing it sit in that specific state for longer. And that can help us again down to that minute level to see what's happening, what maybe there's a process that's occurring in that state that we need to improve or make more efficient. So unlike Performance Analytics, metrics capture intraday changes. So again, instead of each day, it can change -- it's tracking by the minute. It's tracking multiple times. So quickly get the answers you need. So this -- we talked about a little bit earlier than natural language query. We can actually ask questions using natural every language. This is very, very helpful. as far as trying to figure out what it is you're looking for, and what data you're trying to find because sometimes we don't always know how to build that query but this allows us to use our natural language to find that information. So we can get quick answers in the form of list values and charts, and we can easily filter and search data and further outcome the customization. So the NLQ is exposed through the platform. Again, there are -- we can do NLQ on all of our lists, so that's available there. And then the report designer also has NLQ built into it as well. And user experience analytics. So these monitoring user experience KPIs for your web and mobile applications, built with ServiceNow platform and web assets in service portal. So this is really like a customized personalized dashboard that we provide. And the visual metrics and interactions to better understand the user experience and create more intuitive journeys for users. So again, this is tracking all of those metrics for your users for, again, those mobile platform and web assets and the service portal. So this is again a dashboard created specifically to track that type of data and provide you with the information there again so that you can take actionable or so that you can take action on that data. And now lastly, we -- I just wanted to throw this in here. Most of our listeners have probably seen these, but these are our popular security dashboards that we provide in the product. And so we have our security incident response to dashboard and our SecOps efficiency dashboard specifically, this again is going to give us that information for improving our processes, our people. And this is where a lot of times we see with the SecOps efficiency dashboard, we see higher ups even being very interested in this because they can tell them really quickly how their operators, how their analysts are performing, and this is great for managers even because they can see how they can adjust their processes and maybe even make movements across teams to help with that efficiency, and this provides them a quick snapshot to see all of that. And then we have our Security Incident Explorer also with Security Incident Response. And for Vulnerability Response, we have our Vulnerability Management. This is a Performance Analytics dashboard. And then down below, you'll see the 2 smaller ones for approvals and remediation. And then we have our CISO dashboard, which is kind of a conglomeration of all of them, right? And it's going to provide us our CISO with a view and purview into all of our products or all of our security products. so they can see across the board how we're doing and information on that. And then we have our Threat Intelligence, which is our MITRE ATT&CK Navigator. This is actually a dashboard. This does actually feed into right below our MITRE ATT&CK dashboard. So with that, we're going to go ahead. And right now, we're going to jump into a demo, so please, again, if you have any questions, as you went through the slides or through this demo, make sure to write those down and just go ahead, and we'll start the demo. [Presentation]

What I wanted to jump into now, and I got to say this is one of my favorite hot buttons when I think about customer value and what it enables for them. It's really that ability to go ahead and sure off the top when it comes to our reporting performance analytics and reporting in general, what you can get from that? Yes, it tells you how fast you respond, what number of incidents, all those things and being able to actually then take that and drill down to the analysts and et cetera. Again, I'll leave Tim to dive in here as -- because there's a lot to cover. But one of the things that's so exciting is what it does -- one of our customers recently I was talking with the like you realized we actually use this and our analysis on our reports to be able to identify where we had to do training with some teams, things like that. So these are some of the outcomes that can come from having this really quality in-depth reporting at your fingertips. I mean it's again, it goes back to the data is there folks, the activity is there. Can you see it? Can you analyze it? Can you go ahead and produce reports that have value for you? And yes, you can. And Tim, I'll be quiet now.

Yes. It's -- this provides us the ability to create metrics and measure and track things at the tactical level and all the way up to the executive level of board of directors level and everywhere in between. So at the tactical level, we can look for those bottlenecks. We can understand, okay, what incidents are we spending the most time on? And why is that? Is it because we need to tune our tools a little bit better? How many false positives are we doing? Where are we seeing the most false positives come from and then being able to take that up to the executives and provide them with situational understanding of the activity we're dealing with. Within the ServiceNow stock, we had all of our dashboards displayed on the big boards on the wallboards, and I remember when we had auditors come in or if we had executives coming they would say, "Oh, wow, it's -- you actually have meaningful data." You don't have like CNN out there, you don't have the weather channel up there or some of the security professionals who used to come in, they would say, "Oh, you don't have few maps up," but you actually have metrics and meaningful data, and we're like, "Hey, we have meaningful data. We want to know what's going on." But then also what's so great about Performance Analytics is when stakeholders would come and ask us questions on a regular basis, like if our CISO would walk in or somebody from GRC would walk in our internal audit and ask us questions on a regular basis, we could create a dashboard for them, and we could use the access control within ServiceNow such that only they could access that dashboard, and we said, okay, here are all the things that you ask us about on a regular basis or here's the things we want you to know about. This is your dashboard. You can log into this from anywhere and get the information. You don't have to come bother us, you don't have to chase us down. You don't have to wait for us to get back to you, respond to your e-mail or whatever. Everything you want to know is right here in this dashboard that's driven by these reports and are refreshed or the real time, do you have that information at your fingertips. You don't have to come find us. After you look at this, then if you still have questions, you can come see us. And these dashboards, they were used to brief board of directors. They were used to breathe government, law enforcement, and it just -- it became another powerful tool in our arsenal to, again, gain that situational understanding, provide information to stakeholders, give them information that we think they needed to know even if they didn't ask for it, and other little things like it allowed us to get budget. We said, okay, we need budget to get this tool that we think we need and we're getting pushed back, so let's run some reports, let's create some dashboards to show metrics and statistics and show data justifying why we need that budget, and it was very powerful for us and created a lot of value.

That's exactly right. So that's the great thing. I moved over to the executive slide, Tim, so I can see as you were talking through that. And the reality is you're dead on. So we've got, as we look at it from the perspective of okay, get all those insights into the planning part as the stock manager and as your Director and as your VP and that you're your CISO level to know exactly how everyone is doing and make those types of evaluations and plan and budget. And to your point, if you need to go ahead and realize that, okay, what are my proof points for budgeting for this new additional software or even to have that tie in to a certain team, et cetera, you can actually utilize these analytics to do just that. And then -- and we've actually had some of our customers commented that this has become a tool to help them with some of their budgeting bottom line.

All right. So before we wrap up, I want to go ahead and take some time to do a quick Q&A for anybody that had any questions about our slides or even our demo. So please, at this time, if you have any questions, just go ahead and write those in. And it looks like we actually do have a couple of questions here. So I'll go ahead and start answering those. And please, if you have any questions, just feel free to write those in at this time. So our first question is, can you share a share or export a dashboard. So you can actually, you can share dashboards between instances, and you can export dashboard. So if you feel like you have cracked the code for a dashboard or you just have the most brilliant idea for a dashboard or visualization that you want to share maybe with the rest of your team or another analyst, you can absolutely do that. And there is more information about that within our [Dockside], so you can go there. And if you can't find it there, what you should be able to we can also provide more information on that. But yes, you absolutely can. So that's a great question. Let's see. Our next question is, can you limit who can and cannot see specific dashboards? Yes, you can. So this really isn't done at the analyst level, but we can just like any other record or field event within the platform, we can absolutely decide who can and cannot through controls and access. So if there is a dashboard let's say, specifically for managers where they're tracking the progress of each analyst specifically, which we can do. It's very similar to the SecOps efficiency, but you could break it down by analysts, and let's say you don't want everybody to see that. They could set the access to that so that only themselves and other managers or maybe admins or executive level can see that. So that is absolutely a capability that we provide and for obvious reasons, right, because while a lot of this data or I should say all this data is within the platform, sometimes how we look at it, we may want to keep private, especially if it deals with information around performance with specific people or analysts or processes for that matter. And then Looks like we have one last question. Are you able to share customized dashboards or reports? Yes. So this is similar to the export. So yes, we can share those within the platform as well. So we don't necessarily have to export those to other instances. We can share those with other analysts. And again, this goes back to providing that information to executive level or decision-makers. We definitely want that capability because the chances of those higher ups being able to have the time or availability to log into our system and see that is unlikely. So here, we can actually push that information to them and share those dashboards. So they can see that right in their own personal instance without having to get into those instances, especially when you see security instances that are typically locked down pretty tight. So that's very important. So great question. I don't think we have any other questions at this time. But please, if you have any questions after this, feel free to reach out. We'll give you some information on how you can do that. And again, we'll provide you with some resources on how we can how you can answer or get those questions and how we can answer those. And the Dockside is a great resource, but also if you need to, you can reach out to your account exec or your sales contact for any questions. So with that, we're going to go ahead and wrap up here. So please be sure to register for free sign up for the knowledge digital experience. You can do that by just following this [Indiscernible] at the bottom, will provide a lot of really, really good information here and there are a ton of on-demand session, so please take the time if you can to look into that, we can answer a lot of questions there, and it's just some really great content that we provide, and again, it's all for free, so do take advantage. With that, we have our on-demand webinars as well. So if you want to follow this link, you can see again a ton of different resources and webinars that we provide all on demand so that you can view those and watch them on in and get the information you need and follow us. So with that, I'm going to go ahead and wrap up. I really appreciate everyone joining us today. I hope you found it informative. And yes, thank you very much.