Customers of ServiceNow's Lightstep Incident Response will pay for usage rather than users, as the vendor faces off with competitors in multiple categories.
The SaaS offering draws from ServiceNow's acquisition of observability vendor Lightstep last year, but Lightstep had not marketed an incident response tool. Pieces from ServiceNow's IT service management (ITSM) and IT operations management tools from its broader Now Platform are integrated into the new product to create incident management workflows, but the Lightstep product doesn't require buying the Now Platform to use. Unlike the larger platform, Lightstep self-service incident response SaaS also isn't priced according to the number of people who use it -- it's free for 30 days for up to two managed services, and costs $40 per month for each active managed service after that.
Pay-as-you-go SaaS pricing isn't new to the market, but it's relatively new for ServiceNow, as it faces the same pressure to appeal to modern DevOps teams as other established IT vendors, including Splunk.
Andy Thurai
"Most of the vendors are willing to go that route now because that's where the software industry is going," said Andy Thurai, vice president and principal analyst at Constellation Research. "[ServiceNow] has realized that the model has changed -- it's not tickets-based. It's event-based, incident-based now, and they're trying to build tool sets to cater to that."
Early adopters of Lightstep Incident Response include at least one company outside the traditional ServiceNow customer base. Assembly, an employee recognition software startup in Santa Monica, Calif., signed up to use the product during an early availability period in late 2021; Assembly isn't a Now Platform customer. The 50-employee company also considered the best-known incident response vendor, PagerDuty, which offered more features such as fine-grained alert routing, but Lightstep Incident Response beat it on price.
Muthu Gurumoorthy
"They covered the basics very well, from getting notified when an incident happens and where you need to respond, and you can have a team collaborate on it and do a post-mortem," said Muthu Gurumoorthy, CTO and co-founder at Assembly. "For a junior developer coming into the platform, it was much simpler [than PagerDuty] to understand."
Incident response battleground brews around auto-remediation
Lightstep Incident Response is still an early-stage product at this point, with further integrations into the Now Platform planned that will enable automated incident remediation, along with planned integrations into DevOps pipelines via Atlassian's Jira issue tracking software, among others.
Atlassian, in particular, has directly challenged ServiceNow over the last 18 months with its own forays into enterprise service management, historically a territory ServiceNow dominates. Atlassian has added its own configuration management database (CMDB) and attacked ServiceNow's ITSM based on its complexity and price. Atlassian's Opsgenie acquisition and Jira Service Management product already offer tie-ins to software development workflows, closing the feedback loop between production operations and developers increasingly responsible for troubleshooting their own applications.
It's too soon to tell whether ServiceNow's incident response strategy will pay off, but analysts said no vendor has yet sewn up the market for automated incident response that combines workflow tooling with observability data.
Version one has limited capabilities, but based on what I've seen, they have a good roadmap and a good direction.
Andy ThuraiPrincipal analyst, Constellation Research
"Version one has limited capabilities, but based on what I've seen, they have a good roadmap and a good direction," Thurai said. "The mentality of incident response used to be, 'wake someone up in the middle of the night to solve the problem,' but [there are opportunities around] service-ownership-based routing of incidents and auto-remediation of incidents. ... I don't think any of the competitors are there yet."
Competitive complications as IT disciplines converge
Splunk, which has had its own struggles with the shift from enterprise licensing to pay-as-you-go models, has integrated VictorOps, now called Splunk On-Call, with its Splunk Enterprise and Splunk Cloud products and added integrations with Jira, Microsoft Teams and Slack, but the product hasn't made waves.
"I don't hear a ton about it, even on Splunk calls," said Jim Mercer, an analyst at IDC. "When I think of this space, the first thing I think of is PagerDuty."
As multiple IT disciplines converge amid digital transformation and DevOps "you build it, you run it" practices, Lightstep Incident Response will also run up against observability tools such as AppDynamics, which also offers AIOps-driven automated remediation for incident response, New Relic, Datadog and Dynatrace, Mercer said.
Assembly uses Datadog, and Gurumoorthy said he hopes to see improved integration between that and Lightstep Incident Response, which currently requires manual effort to set up.
"We use Datadog extensively, and it would be hard to replace," he said. "But we might consider Lightstep [for observability] and ServiceNow if we see [integration] improvement."
While ServiceNow has kept Lightstep independent from the Now Platform, it may also bring fresh customers into it or expand existing customer usage, according to Mercer.
"If you're a ServiceNow customer, but you've got modern teams doing observability and so forth, and you want to tie it all together, this certainly presents you with an enticing option," he said.
Beth Pariseau, senior news writer at TechTarget, is an award-winning veteran of IT journalism. She can be reached at [email protected] or on Twitter @PariseauTT.
Dig Deeper on Systems automation and orchestration
Andy Thurai
Muthu Gurumoorthy
