Skip to main content
App security

Category: IT & Support

Secure ServiceNow browsing

Secure ServiceNow browsing means protecting IT and security workflows from malicious links, unsafe attachments, and session compromise in browser-based ticketing.

Quick answer

Support tools bring outside links and files into daily work. Agents open them at high volume. Treat customer links and attachments as untrusted.

Last updated

2026-01-29

Main browser risks for ServiceNow

  • Malicious links embedded in tickets that route staff to phishing or malware sites.
  • Attachments uploaded by external users containing malware or deceptive documents.
  • Impersonation via ticket comments to request urgent access changes or credential resets.
  • Session hijacking that provides access to sensitive workflows and internal data.
  • Copy/paste leakage of internal incident details into untrusted tools or AI prompts.

Typical sensitive data in ServiceNow

  • IT tickets containing system details and user data.
  • Incident response notes and root cause analyses.
  • Attachments like logs, screenshots, and documents.
  • Links to internal dashboards, runbooks, and vendor portals.
  • User identity and access workflows.
  • Audit logs and admin configurations (depending on setup).

Recommended controls by role

Support

  • Open customer-provided links in isolation by default; treat them as untrusted.
  • Restrict downloading attachments from external users; scan and release through a controlled workflow.
  • Avoid pasting secrets into tickets; use secure sharing for credentials and tokens.

IT Admins

  • Use separate profiles for admin workflows vs general browsing to reduce session compromise risk.
  • Enforce extension allowlists and safe browsing policies for IT staff.
  • Isolate unknown domains opened from tickets, alerts, and vendor communications.

Security

  • Use isolation for investigating suspicious URLs and attachments referenced in incidents.
  • Deploy policies that reduce data leakage to AI tools from browser-based incident workflows.
  • Monitor for unusual export and access patterns, especially during active incidents.

Where Shield fits with ServiceNow

The controls above are general security practices, not Legba features. ServiceNow is not a Legba integration.

Legba's part is narrow. Shield opens a page in an isolated browser off your device. Use it for a link you do not trust.

Limits

Shield moves page execution off your device. Downloads and copied data still cross that boundary. It cannot stop you sharing passwords with unfamiliar sites. Treat downloads and sign-in prompts with care.

Add to Chrome

Free for 30 days. No card required.

ServiceNow security questions

Why are ITSM tools risky?
They collect links, files, and operational detail. Attackers exploit that by embedding malicious URLs and using social engineering through ticket comments.
Should IT staff isolate browsing more than other teams?
Often yes. IT and security teams handle sensitive data and click unknown links during investigations.
Does isolation help with malicious attachments?
It reduces endpoint exposure from risky browsing and supports safer workflows, but file scanning and controlled release are still required.
What’s a practical first step?
Isolate unknown links opened from tickets and restrict attachment downloads from external users.

References

  1. 01
    ServiceNow Trust CenterServiceNow
  2. 02
    Cloudflare: Browser IsolationCloudflare
  3. 03
    Chrome Enterprise: PoliciesGoogle

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.