Incident response for ServiceNow teams

The incident room that never sleeps.

A team of AI bots works every incident inside your network. They find the cause, propose the fix, and a second AI from another vendor checks it before you see it. You approve with a passkey. The fix runs, proves itself, and lands in ServiceNow, with every step signed.

Self-hostedClaude, Codex and Grok botsHash-chained audit log
P1
INC0010052 · checkout-api 5xxRoom lead Overwatch · 4 bots · 1 approver
00:00
CHECKOUT ERROR RATE · SPLUNK42.0%
Practice drill 6 · Nov 8, 2026

Alert to closed ticket.

6:36min:sec

0:00
Room opens on the ServiceNow incident
4:24
Checked fix approved by a person
6:36
Incident, change and problem closed out
42% → 0%
checkout failures, before and after the fix
1st
try: the checker passed the proposal first time
49
ServiceNow audit rows written by the app, every one attributed

A practice incident on a ServiceNow developer instance. Customer numbers will come from the design-partner pilot.

Seats, not chatbots

Every bot has a job. Only people approve.

The room runs on seats. A bot's name and picture are yours to change; what a seat may do is fixed, and the log records who sat in it.

Watcher

Sees it first

Turns an alert into a room with the ticket, the service and who's on call.

Can't change anything.
First read

Finds the cause

Reads logs, recent changes and the CMDB, and cites every claim with a link back.

Read-only evidence tools.
Proposer

Writes the fix

The fix, the check that proves it worked, and the undo if it didn't.

Proposes. Never runs its own plan.
Checker

Argues with it

Runs on a different AI vendor than the proposer and judges the plan against the evidence.

The app warns when both come from one vendor.
Room lead

Keeps it moving

Tracks every fault until it's fixed or handed off, and writes the close-out.

Can't approve.
Approver · a person

Decides

Approves with a passkey in the app, or in ServiceNow for production changes. Hands the incident to a teammate in one tap.

No chat message, API key or webhook can approve.
Proof, not promises

Every step signed. Every link checked.

Each bot signs what it does with its own key, and each record carries the hash of the one before it. Change one line and the chain breaks where you changed it.

$ vigil log verify room-inc0010052.jsonl signatures ok every record signed by its seat's key chain ok each record links to the one before families proposer anthropic · checker openai
Inside your walls

Your network. Your keys. Nothing comes to us.

Each company runs its own copy, on its own server or in its own cloud account. We have no connection to it and no access to your systems.

YOUR NETWORK OR CLOUD ACCOUNT vigilbot server + signed log Bot containersown allowlist each ServiceNowread + write back Splunkread-only token Your sign-inpasskeys Your AI account Bedrock · Vertex Azure · direct Vigilbot, the company no connection

One server you own

Today

macOS today, Linux in testing, behind your own sign-in gateway. Each bot lives in its own container with its own network allowlist.

ServiceNow, both ways

Today

Reads tickets, CMDB and knowledge. Writes incident, change, problem and tasks back, every row attributed.

Your AI account

Pilot

Bots run on your company's approved route with spending limits. Personal subscriptions are off for companies.

Stripped before it leaves

Pilot

Your rules remove card numbers, emails and anything you name before an AI sees it. If the rules fail, nothing is sent.

Runs where you run

Built for the clouds your team already uses.

Your hardware, your VPC, or your cloud account. We are testing each one now, so you can pick what fits your team.

Your own hardware
  • TodayRuns on a macOS machine you own, behind your own sign-in.
  • TestingLinux servers you own, on your own network.
Cloudflare
  • TodayThis site and its waitlist run on Cloudflare Workers, D1 and Turnstile.
  • TodayRemote access to the app goes through Cloudflare Tunnel, with Cloudflare Access checking every request.
  • TestingBot computers on Cloudflare Containers.
  • PilotOur hosted shadow pilot and demo.
AWS
  • PilotBots use your company's approved AI route through Amazon Bedrock, with spending limits.
  • TestingInstall on EC2 in your own AWS account and VPC, including Graviton.
  • NextSigned log exports to Amazon S3.
Azure
  • PilotBots run on Azure OpenAI and Azure AI Foundry under your company's own subscription.
  • TestingInstall on Azure virtual machines in your own tenant.
  • NextSign-in with Microsoft Entra ID.

Today: running now. Pilot: part of the January 2027 design-partner pilot. Testing: a target we are validating now. Next: planned after the pilot.

Design-partner pilot · January 2027

One team. One kind of incident. Real numbers.

  • Length30 to 60 days, installed on your own server
  • ScopeOne recurring incident, one monitoring source, one action the bots may take
  • MeasuredAgainst how your team works today: time to diagnosis, fixes that held, bad advice the checker caught
  • FitAn operations team on ServiceNow with authority to approve one bounded action

Our hosted shadow pilot and demo run in the cloud, so design partners can try it before installing anything.