ServiceNow's machine learning escalation model shifts proactive customer engagement from 11% to 68% of all outreach

Background

Enterprise software customers can experience service degradations that, if unaddressed, escalate into formal account escalations—costly, relationship-damaging events. ServiceNow's support team sought to shift from reactive escalation response to early proactive outreach by detecting the early signatures of at-risk environments in performance event data.

What Was Implemented

• Binary XGBoost classification model trained on labeled alert/escalation data (thousands of instances, 28 days of trend data)
• 19 features including alert counts, duration medians, alert type variance, and trend calculations (linear regression, exponential decay)
• Integrated with ServiceNow's own Event Management and Predictive Intelligence products
• Automated workflow on the Now Platform; alert engineers receive nominated instances for review with a 3% false positive ceiling
• Both old (rule-based) and new (ML) models run in parallel to capture unique value from each
• Model retrained in 2024 to maximize recall while keeping false positives ≤10%

Results

Since go-live, the share of proactive customer engagements rose from 11% to 68% . ServiceNow engages hundreds of customers per year before a disruption requires formal escalation. The model maintains a 3% false positive rate , minimizing wasted engineering hours. A USPTO patent (US 11,017,268) was awarded for the system.

Lessons

• Trending features (linear regression, exponential decay) are essential for a truly *predictive* model; static snapshot features alone are insufficient
• Running old and new models in parallel captured additional unique value that neither model achieved alone
• Minimizing false positives (not maximizing recall) is the right optimization target when reviewer time is scarce
• Internal dogfooding (using your own product to build the solution) provides direct product validation and credibility