Guided demonstrations

Demo 1

ServiceNow IRM & Enterprise Governance Lab

Problem: Control failures are tracked in email and spreadsheets, so findings lack consistent scoring, ownership, due dates and approval evidence.

Experience: Relates to my GRC work involving NIST 800-53 control assessments, audit finding tracking, POA&M and ServiceNow IRM.

1. 1. Workspace → Record control test: pick AC-2, review the evidence, choose Fail (optionally tick cross-lab propagation)
2. 2. Automation tab → approve the pending remediation plan
3. 3. Workspace → Remediation table → Complete remediation with closure evidence
4. 4. Dashboard → confirm the control is Effective again; Reports → download the PDF

Demo 2

ServiceNow Administrator & Developer Lab

Problem: Platform changes made without RBAC, validation and change control introduce risk and rework.

Experience: Relates to ServiceNow IRM configuration and workflow concepts used in my GRC roles.

1. 1. Demo 1: Create table (default fields provided), then Insert record
2. 2. Demo 2: Create flow on the table with approval; insert a matching record → approve in Automation
3. 3. Demo 3: ACL check as ro.viewer create → DENY; as ana.analyst → ALLOW
4. 4. Demo 4: Create business rule; insert a record and see rules fired
5. 5. Demo 5: REST call GET/POST and inspect status & latency
6. 6. Demo 6: Create change → approve CAB → Test pass → Deploy → Rollback

Demo 3

Cybersecurity Risk & Controls Lab

Problem: High-severity vulnerabilities and weak controls are not consistently translated into risk records with owners and SLAs.

Experience: Relates to my vulnerability management, risk assessment and NIST CSF/800-53 mapping work.

1. 1. Add a vulnerability with CVSS 8.1+ on a critical asset → automation creates risk + remediation
2. 2. Assess a risk with low control effectiveness to trigger the residual-risk rule
3. 3. Treat a risk with Accept → approval workflow
4. 4. Review the heat map in Dashboard

Demo 4

IT Audit, SOX & Regulatory Compliance Lab

Problem: Evidence requests, test results and findings are disconnected, making readiness hard to measure.

Experience: Relates to my SOX ITGC, audit management and audit-finding tracking experience.

1. 1. Plan an engagement (choose a framework) → tests & evidence requests are generated
2. 2. Submit and review evidence
3. 3. Record a failed test with exceptions → finding + action plan
4. 4. Verify remediation; watch readiness score

Demo 5

Third-Party Risk Management Lab

Problem: Vendors are onboarded without risk-based tiering, so critical vendors get the same light review as low-risk ones.

Experience: Relates to my third-party risk management and vendor assessment experience.

1. 1. Onboard a vendor with regulated data + network integration
2. 2. Approve it in Automation
3. 3. Answer the questionnaire (some No answers create remediation)
4. 4. Raise a continuous-monitoring event

Demo 6

AI Governance, Model Risk & Responsible AI Lab

Problem: AI adoption without inventory, risk tiering and oversight creates privacy, fairness, security and accountability gaps.

Experience: Relates to my AI governance focus and independent AI product development (AI agents, model evaluation).

1. 1. Register a high-impact AI system
2. 2. Inspect the generated assessments and the agent recommendation
3. 3. Approve in Automation → monitoring enabled
4. 4. Complete checklist items; record an evaluation; report an AI incident

Demo 7

AI Agent Manager & Agent Operations Command Center

Problem: Agents without least privilege, approval gates, evaluation and cost visibility create operational, security and budget risk.

Experience: Relates to my independent AI product development (D3 Command): AI agents, model evaluation, latency and token cost.

1. 1. Demo A: Create an agent, then Test it
2. 2. Demo B: Run multi-agent GRC assessment → approve the Human reviewer gate → open the report
3. 3. Demo C: Security test with tool send_external_email → blocked + incident
4. 4. Demo D: Evaluate an agent on the 8-case dataset
5. 5. Demo E: Compare model configurations
6. 6. Demo F: Sensitive action → workflow pauses for approval

Demo 8

Enterprise Project, Program & Product Delivery Lab

Problem: Critical milestone slippage is noticed late and executive status reports lag reality.

Experience: Relates to my project coordination, business analysis and Agile delivery roles.

1. 1. Run Health check → the overdue UAT milestone escalates automatically
2. 2. Simulate a delay on another milestone
3. 3. Plan a sprint, move stories on the Kanban board, close the sprint with a retro
4. 4. Submit a change request and approve it

Demo 9

SAFe Release Train Engineer | Agile Release Train Command Center

Problem: Without visible capacity, dependencies and risks, PI plans overcommit teams and miss cross-team sequencing.

Experience: Relates to my Agile delivery, Scrum ceremonies and program coordination experience.

1. 1. 1-3 Start PI and review WSJF priorities
2. 2. 4-8 Assign features to teams/iterations; watch capacity & dependency alerts
3. 3. 9-11 Review the program board, resolve conflicts, ROAM risks
4. 4. 12-14 Create objectives, vote confidence for all 5 teams, finalize
5. 5. 15 Download PI report (Reports)
6. 6. 16-17 Complete features, then run Inspect & Adapt

Demo 10

Cybersecurity Incident Response & BCDR Lab

Problem: Response and continuity plans are disconnected, so recovery priorities are unclear during a crisis.

Experience: Relates to my incident response and BCDR governance exposure in GRC roles.

1. 1. Create a Ransomware incident affecting Payments Gateway with regulated data
2. 2. Review tasks, escalation and impacted processes
3. 3. Advance phases, update tasks, record recovery hours vs RTO
4. 4. Record RCA & lessons learned; run a BCDR exercise