Instance data is the records, settings, and configuration stored inside a ServiceNow deployment. It includes business records such as tickets and approvals, as well as platform state such as workflows, access rules, scripts, integrations, and other operational metadata. Because this data defines how the platform behaves, it is often as sensitive as the information it manages.
In cyber security, instance data matters because attackers who can read or change it may alter business processes, redirect approvals, hide activity, or plant persistence in automation and configuration. Defenders watch for unauthorized record changes, unexpected admin-level edits, unusual API activity, and database anomalies. Backups, strict role-based access, change logging, and integrity checks help protect instance data and make tampering easier to detect.