ServiceNow Penetration Testing for ACLs, Service Portal and Custom Apps
ServiceNow enforces exactly the access rules you give it. The access control list matrix, Service Portal widgets and scoped application code your team built decide who sees what. We test that layer, the configuration and custom code that decides who can actually read, change or export a record, never the underlying ServiceNow platform itself. CREST-certified testers, fixed price from £3,920 for a 3-day single-instance scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Every table and field in a ServiceNow instance is gated by an access control list evaluated against role, condition and script. When that matrix drifts from what a role should actually see, the platform enforces the drift exactly as configured.
Why ServiceNow findings are configuration and code, not the platform
ServiceNow’s own documentation sets out exactly how access is meant to work: every table and field is protected by an access control list checked against the requesting user’s role, an optional condition and an optional script. The platform enforces the rule exactly as written. Whether the rule matches what your business actually intended is a separate question, and it is the one we test.
A typical instance also runs a Service Portal built from widgets, one or more scoped applications with their own business rules and Script Includes, and integrations calling in and out through REST. Each of those layers makes its own access decision, at whatever point in the build somebody wrote it, and none of them are covered by testing the base ACL matrix alone.
We test whether a guest or public user can reach a record or knowledge article that was meant to stay behind a login, whether a Script Include marked client callable accepts parameters nobody intended, and whether a role that is supposed to require elevation grants its access without it. It is the same access control question we test on Dynamics 365 and Salesforce instances, applied to the ACL matrix ServiceNow gives you to configure.
SCOPE
What we pen test on a ServiceNow instance
Table-Level Access Control Lists
Every table in your instance is gated by an access control list that checks the requesting user’s role, an optional condition and an optional script before allowing create, read, write or delete. We test whether the ACLs on your custom and modified tables actually match who should hold each operation, not just whether an ACL exists.
Field-Level Access Control Lists
Table access does not imply field access, since a field can carry its own ACL on top of the table’s rule. We test whether sensitive fields, such as personal data, financial values or contract terms, carry that separate rule, and whether a scripted or conditional field ACL is looser than the role-based rule around it.
Service Portal Widget Security
Each Service Portal widget separates an HTML template, a client-side script and a server script, and the server script decides what record data comes back to the browser before the template ever renders it. We test what a widget actually returns against what its page is meant to show.
Guest and Public User Access to Records
Guest is a real user account in ServiceNow, and any table, widget or portal page reachable without logging in inherits whatever access that account has been given. We test what an unauthenticated guest user can read, list or submit across your public-facing portal pages.
Guest and Public Access to Knowledge Articles
Knowledge bases exclude the guest user from read access by default, but that exclusion has to be enforced by every path that can serve an article, not only the standard knowledge portal page. We test whether a public widget, custom endpoint or alternate template can return article content the standard exclusion is meant to block.
Business Rules and Scoped Application Logic
Business rules and other scripted logic in your custom applications run with the same GlideRecord data access as any server-side script, which is not automatically limited to the records the acting user could otherwise see through the interface. We test whether an in-scope business rule or workflow re-checks the acting user’s own authorisation before it reads or writes a record outside their normal access.
Client-Callable Script Includes
A Script Include marked client callable can be invoked directly from the browser through GlideAjax, and any of its public functions, those not prefixed with an underscore, are reachable that way regardless of what the calling widget’s client script actually sends. We test callable Script Includes for parameters and functions that go further than the interface was built to expose.
REST and Scripted REST APIs
The platform’s Table API enforces the same ACLs as the user interface, but a Scripted REST API is written by your developers and does not automatically inherit table ACLs unless it explicitly uses secured record access. We test every custom scripted endpoint in scope for that gap.
Integrations and Inbound or Outbound Connections
Every integration user, OAuth application and inbound REST endpoint is a credential with its own scope, and a broad integration account can reach far more than the integration it was built for actually needs. We test integration credentials, inbound endpoints and outbound connections for scope wider than their job requires.
Roles and Elevated Roles
Some roles, security_admin among them, are marked elevated privilege and are meant to require an explicit elevation step before they take effect, even for a user who already holds the role in their profile. We test whether that elevation step is actually enforced, and whether a custom role quietly grants the same reach without it.
OUR PROCESS
ServiceNow Penetration Testing: From Scope to Attestation
Scope and Access
We agree which ServiceNow instance is in scope, typically a sub-production instance registered under ServiceNow’s own testing policy, plus the role accounts, guest access and any integration credentials we need.
ACL and Configuration Mapping
We map the access control list matrix for tables and fields in scope against your intended role structure, and catalogue the Service Portal widgets, scoped applications, Script Includes and Scripted REST APIs that sit on top of it.
Manual Testing
A CREST-certified tester manually exploits weaknesses across ACLs, guest and public access, client-callable Script Includes, REST endpoints and role elevation, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST ServiceNow pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent ServiceNow Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test ServiceNow For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From ServiceNow Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our ServiceNow instance?
We need at least one authenticated account for every distinct role tier in scope, including a standard user and any delegated admin role you use day to day. If your instance has a public-facing Service Portal or knowledge base we also test the guest and public path without any credentials at all. For a grey-box option, read access to the relevant ACL definitions, Script Includes and Scripted REST API scripts speeds up and deepens specific findings.
Will testing touch live data, and which instance do you test?
We test the instance you nominate, and ServiceNow’s own Customer Penetration Testing Policy restricts customer-initiated testing to a registered sub-production instance by default, not production. We agree any further exclusions, such as live integration traffic or outbound notifications, before testing starts, and we do not run destructive tests against real records without that agreement in writing.
How long does a ServiceNow penetration test take?
A single ServiceNow instance sits in our 3-day single-instance scope, with a report typically landing around 5 working days after kickoff. An instance with more scoped applications, a wider integration surface or several sub-production environments in scope moves into a larger scope with more testing days.
What is out of scope for a single-instance ServiceNow test?
Testing ServiceNow’s own platform, infrastructure or multi-tenant hosting is never in scope, and ServiceNow’s policy specifically prohibits network layer and denial-of-service testing against any instance. We test the ACLs, Service Portal, scoped applications, Script Includes, REST APIs and roles configured on your instance, and a separate system that only happens to integrate with it is scoped and quoted separately.
Does ServiceNow have a customer penetration-testing policy we need to follow?
Yes. ServiceNow’s Customer Penetration Testing Policy requires the account holder to request and receive approval before any penetration test against a ServiceNow instance, and by default that approval covers one test per calendar year against a registered sub-production instance. You hold the authorisation as the account owner, and we test to the scope, instance and dates ServiceNow has approved.
Do you need our source code or admin access?
No. Testing is black-box by default against the role accounts and access you provide. A grey-box option, where we review ACL definitions, Script Includes marked client callable and Scripted REST API scripts for the applications in scope, is available if you want faster or deeper coverage.
Do you test integrations that connect ServiceNow to other systems?
We test the ServiceNow side of an integration: the integration user’s scope, inbound REST endpoint authentication, and outbound connections configured on your instance. A separate application or platform on the other end of that integration, such as an identity provider or a finance system, is tested and quoted as its own engagement.
Are your testers CREST certified?
Yes. Every ServiceNow engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your ServiceNow instance
ServiceNow enforces exactly the access rules you give it. The access control list matrix, Service Portal widgets and scoped application code your team built decide who sees what. We test that layer, the configuration and custom code that decides who can actually read, change or export a record, never the underlying ServiceNow platform itself. CREST-certified testers, fixed price from £3,920 for a 3-day single-instance scope, quoted within 24 hours.
