A federal agency operating across 12 department-level sub-units faced two related pressures: increasing sophistication of threat activity targeting the agency, and tightening FISMA / continuous-monitoring requirements that the legacy SOC could not satisfy without doubling staff.
The CIO’s mandate: modernize security operations on a FedRAMP-aligned platform, automate the top alert patterns, and produce continuous compliance evidence — without expanding headcount.
Mergen designed and deployed ServiceNow SecOps across the agency, federated by department but unified at the platform level. The first 90 days focused on the top 20 alert categories representing 73% of historical volume — each got a SOAR playbook for triage, enrichment, and where appropriate, automated remediation.
The key architectural choice: SecOps and ITSM share the same CMDB and identity graph. When a security incident relates to an asset, the incident enriches automatically with that asset’s service map, owner, and operational status. When ITSM detects an unusual change pattern, it can flag a security review without leaving the platform. This is impossible with point security tools.
Whether you're modernizing an existing platform, implementing new capabilities, or exploring AI-driven transformation, Mergen's certified experts will help define the right roadmap, scope, and delivery approach for your business.
Book a Discovery Call