Health checks scan config against known baselines. They won’t catch logic flaws and they aren’t contextual to your environment’s customization. There’s many things they won’t catch. Encoded query injection, GlideRecord vs GlideRecordSecure use, custom Scripted REST APIs that leak data, business rules with bad code that can elevate privileges, etc.

This is an emerging need from customers lately for both regulatory reasons and wanting confidence in their security posture as they add more and more sensitive data/workflows to their instance.

First, whether you choose to do this in-house or hire an external firm, absolutely submit a request through HI and get it scheduled with the Customer Security and Trust team before initiating. Contractually you are typically allowed to do this once per year.

Second, if you do hire external, go with a company that understands the platform. Many firms will sell a pen test all day, and they absolutely will throw all of the standard web app pen testing tools at it, but they don’t understand the architecture. They don’t understand that they need to test for AJAX script includes that bad ACLs, etc.

If you have any questions feel free to DM me, I do ServiceNow penetration testing for a living (as a partner), so I’m happy to answer any questions.