How we build
Defense software discipline, on the platform.
ServiceNow work is usually bought from platform shops. We build software for defense programs, and that practice comes with us - onto the platform, and into the enclave it has to run in.
- IL4 and IL5 environments
- We have delivered in IL4 and IL5 environments, including Microsoft 365 GCC High. The impact level decides what is actually buildable - which integrations exist at that level, what can cross a boundary, and what has to be built rather than connected - and that is cheaper to know at design time than at test.
- When the work is a binary, not a script
- Not all of it is JavaScript on the platform. A MID server runs inside your network, and work that reaches it means producing and supporting an actual binary on infrastructure you own. NSA and CISA now tell critical infrastructure operators to move code like that to memory-safe languages. We already deliver in Rust and other memory-safe, type-safe languages - a decision we made before your program rather than during it.
- A short dependency list, on purpose
- The platform's JavaScript ecosystem makes it easy to pull in one more library, one more store app, one more snippet off a forum. Each one runs inside your instance with your data behind it. We add dependencies deliberately, and we can say why every one of them is on the list.
- Supply chain risk, with an SBOM to show for it
- Third-party code is a C-SCRM problem before it is a convenience. Dependencies are pinned to versions and checked on the way in, and every delivery ships with a software bill of materials - what is in it, which version, where it came from - so a vulnerability disclosed next year is a question we answer in an afternoon rather than an investigation.
- Reviewed before it reaches your instance
- Every change is read by an engineer who did not write it. Update sets move code between instances; they do not review it.
- Pipelines that leave a record
- Builds, tests and security scans run on every change, and what shipped, when, and against which ticket is recorded. DevSecOps on the platform means the same evidence trail a defense program expects anywhere else.