A federal agency operating across 12 department-level sub-units faced two related pressures: increasing sophistication of threat activity targeting the agency, and tightening FISMA / continuous-monitoring requirements that the legacy SOC could not satisfy without doubling staff.
The CIO’s mandate: modernize security operations on a FedRAMP-aligned platform, automate the top alert patterns, and produce continuous compliance evidence — without expanding headcount.
Mergen designed and deployed ServiceNow SecOps across the agency, federated by department but unified at the platform level. The first 90 days focused on the top 20 alert categories representing 73% of historical volume — each got a SOAR playbook for triage, enrichment, and where appropriate, automated remediation.
The key architectural choice: SecOps and ITSM share the same CMDB and identity graph. When a security incident relates to an asset, the incident enriches automatically with that asset’s service map, owner, and operational status. When ITSM detects an unusual change pattern, it can flag a security review without leaving the platform. This is impossible with point security tools.
Connect with a Mergen architect to scope an outcome-led engagement.
Connect with a certified architect and explore how Mergen can accelerate your transformation.
Receive a comprehensive platform health check and a prioritized roadmap.
See how organizations like yours achieved measurable results.
Ready to go? Tell us about your initiative and we'll scope an engagement in 48 hours.