Skip to content

ESM vs. ITSM: Expanding Service Management Beyond IT

ESM 與 ITSM：將服務管理擴展至 IT 以外的領域

Enterprise Service Management (ESM) extends the proven principles of IT Service Management (ITSM) across an entire organization. As companies apply these service-oriented practices to departments beyond IT, the strategic value of service management grows, aligning technology, business processes, and company-wide goals.

However, ESM isn't a one-size-fits-all solution. The decision to focus on ITSM or expand to ESM depends on an organization's maturity, needs, and strategic priorities. This article clarifies the relationship between these two concepts, exploring their similarities, differences, and the conditions under which an ESM strategy makes the most sense.

What is IT Service Management (ITSM)?

IT Service Management (ITSM) is the strategic framework for how an organization designs, delivers, manages, and improves its technology services. Using dedicated tools and workflows, ITSM focuses on aligning IT services with the needs of the business and its customers. The primary goal is to enhance business performance, boost productivity, and increase user satisfaction by managing IT effectively.

ITSM provides structure to core IT functions, helping organizations achieve business objectives while optimizing budgets. The de facto framework for implementing ITSM is ITIL® (Information Technology Infrastructure Library), which outlines 34 practices, including key processes like:

  • Incident Management: Restoring normal service operation as quickly as possible.
  • Problem Management: Identifying and addressing the root causes of incidents.
  • Change Management: Controlling the lifecycle of all changes to minimize disruption.
  • Asset Management: Tracking and managing IT assets throughout their lifecycle.

Benefits of ITSM

When an IT department is central to business operations, a mature ITSM practice delivers significant advantages:

  • Effective IT Governance:Secure and efficient management of the entire IT environment.
  • Faster Resolution:Rapidly address and resolve incidents and underlying problems.
  • Transparent Changes:Implement system changes with clear traceability and minimal risk.
  • Clear Visibility:Gain a comprehensive overview of IT assets and their interdependencies.

A Practical Example: Saxony State Office for Schools and Education (LaSuB)

LaSuB struggled with a complex and inefficient IT support system. By implementing a centralized ITSM solution with OTRS, they streamlined request management. Now, tickets and notes are easily routed to the correct teams, enabling even small groups to operate efficiently and deliver superior service.

What is Enterprise Service Management (ESM)?

Enterprise Service Management (ESM) is the application of ITSM principles, practices, and technologies to other business departments. Teams in areas like Human Resources (HR), Legal, Facilities, Finance, and Marketing adopt a service management model to structure their work, creating a consistent and high-quality service experience across the organization.

In short, ESM uses the ITSM blueprint to improve organization, visibility, communication, and efficiency on an enterprise-wide scale.

Benefits of ESM

A well-implemented ESM strategy enhances organization-wide processes and drives strategic business goals. Key benefits include:

  • Improved Service Experience:Customers and employees receive consistent, high-quality service without long waits or miscommunication.
  • Increased Agent Satisfaction:Support agents in every department benefit from clear structures and transparent workflows, reducing stress.
  • Cost Savings:Efficient, automated processes reduce both direct operational costs and opportunity costs.
  • Continuous Improvement:A structured service portfolio allows for active management and long-term optimization.
  • Enhanced Productivity:Automation of routine tasks frees up employees to focus on complex, value-added work.

ESM in Action: Employee Onboarding

Onboarding is a critical process that directly impacts employee retention. Without ESM, it can be a chaotic experience. With ESM, an automated workflow coordinates every step: HR initiates the process, IT provisions hardware and accounts, Facilities prepares the workspace, and the hiring manager receives a notification to prepare a training plan. The new employee arrives on day one with everything they need, ensuring a smooth and positive start.

Other examples include:

  • Internal Self-Service Portals:Employees can find answers to common questions about HR policies or facility requests without filing a ticket.
  • Streamlined Approvals:Structured workflows for financial or legal approvals ensure requests are tracked, escalated, and resolved within defined timelines.

Comparing ITSM and ESM: Key Similarities and Differences

Since ESM is an extension of ITSM, the two concepts share a common foundation in "Service Management." The primary distinction lies in their scope: "IT" for Information Technology versus "E" for Enterprise.

Shared Foundation

Both ITSM and ESM leverage the same core principles to deliver efficient, goal-oriented service:

  • Customer-Centricity:A strong focus on meeting the needs of the end-user (whether an external customer or an internal employee).
  • Efficient Workflows:Standardized processes that improve collaboration and save time.
  • Automation:Reducing manual errors and freeing up teams for more strategic tasks.
  • Self-Service:Portals that empower users to resolve simple issues 24/7.
  • Knowledge Management:Centralized knowledge bases with FAQs, guides, and solutions for faster support.
  • Common Tooling:Use of similar software to manage tickets, workflows, and services.

Key Differences

The core difference is the domain of application. ITSM manages technology services, while ESM expands this model to manage business services.

AspectIT Service Management (ITSM)Enterprise Service Management (ESM)
FocusIT-related services (e.g., system upgrades, access requests, application support).Business-oriented services across departments (e.g., employee onboarding, contract approvals, facilities requests).
ScopeConfined to the IT department and its services.Encompasses the entire organization (HR, Legal, Finance, etc.).
Strategic AlignmentAligns IT performance with business goals.Directly supports broader business goals like enterprise-wide cost savings and customer satisfaction.
MaturityA well-established discipline with standardized frameworks like ITIL®.An emerging practice that requires adapting ITIL principles to non-technical contexts.

In essence: ITSM perfects service delivery within IT. ESM scales those perfected practices across the enterprise.

ITSM or ESM: Which Approach is Right for You?

ITSM and ESM are not mutually exclusive; they represent a continuum of service management maturity. The real question is not if you should choose one over the other, but when you should expand from ITSM to ESM. An IT department with a mature ITSM practice is perfectly positioned to champion this evolution.

When to Focus on ITSM

A dedicated focus on ITSM is essential when:

  • The primary goal is to bring order and efficiency to a complex, interdependent IT environment.
  • Other business departments are not yet accustomed to process-oriented work and require foundational service management basics.

When to Adopt ESM

Expanding to ESM is the logical next step when:

  • Your ITSM practice is mature and consistently delivering value.
  • Inefficient cross-departmental processes (like onboarding or procurement) are creating bottlenecks and frustration.
  • Your organization is ready to standardize service delivery and leverage automation across all business functions.

The most effective approach is to build on your ITSM success. Evolve it step-by-step into a comprehensive ESM strategy, starting with a department like HR that handles a high volume of complex requests and can benefit immediately from structured service management.

Final Thoughts: Expand What Works

ITSM and ESM are different expressions of the same powerful principle: to deliver outstanding service efficiently and consistently. If ITSM is already succeeding in your IT department, you have a proven model for success that can benefit the entire organization.

While still less common than ITSM, ESM offers early adopters a significant competitive advantage. By creating a highly structured, results-driven service culture, ESM helps achieve critical business goals and fosters a more collaborative, efficient, and productive workplace.

關於 OTRS

OTRS (originally Open-Source Ticket Request System) is a service management suite. The suite contains an agent portal, admin dashboard and customer portal. In the agent portal, teams process tickets and requests from customers (internal or external). There are various ways in which this information, as well as customer and related data can be viewed. As the name implies, the admin dashboard allows system administrators to manage the system: Options are many, but include roles and groups, process automation, channel integration, and CMDB/database options. The third component, the customer portal, is much like a customizable webpage where information can be shared with customers and requests can be tracked on the customer side.

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

AWS WAF with Cloudbric Managed Rules in Four Simple Steps (Old & New Console Version)

How to Deploy Cloudbric Managed Rules for AWS WAF in 4 Steps

Protect your AWS applications in minutes. Cloudbric’s managed rules for AWS WAF condense enterprise-grade threat intelligence into a simple, one-click deployment. This guide shows you how to add battle-tested security logic to your applications without writing code or scheduling downtime.

Why Add Cloudbric to AWS WAF?

While AWS WAF provides a powerful framework, its effectiveness depends on the quality of the rules you apply. Cloudbric delivers curated, pre-tuned rule groups that allow you to:

  • Deploy Faster:Launch comprehensive security policies in under five minutes.
  • Stay Ahead of Threats:Benefit from daily rule updates that track emerging CVEs and attack patterns.
  • Reduce False Positives:Utilize machine learning-aided signatures that minimize noise and disruptions.
  • Pay as You Go:Subscribe per rule group for each web ACL with no long-term lock-in.

Setup at a Glance

Before you begin, ensure you have:

  • An AWS Account:With AWS WAF enabled and the necessary IAM permissions (e.g., wafv2:**).
  • A Target Resource:A CloudFront distribution, Application Load Balancer (ALB), API Gateway, or other supported AWS service you wish to protect.
  • A Cloudbric Subscription:If you're a new user, AWS will prompt you to subscribe via the AWS Marketplace directly within the setup process—no need to leave the console.

Deploying Cloudbric Rules: A Step-by-Step Guide

This walk-through uses the modern AWS WAF console workflow.

Step 1: Navigate to AWS WAF & Create a Web ACL

From the AWS Management Console, go to WAF & Shield. In the left navigation pane, click Web ACLs, then click Create web ACL. A Web Access Control List (Web ACL) is a set of rules that provides fine-grained control over the web traffic that reaches your application. WAF & Shield。在左側導覽窗格中，點擊 Web ACLs，然後點擊 Create web ACL。Web 存取控制清單（Web ACL）是一組規則，能對到達您應用程式的網路流量進行精細控制。

Step 2: Describe the Web ACL and Associate Resources

Name your Web ACL and provide an optional description.

Select the AWS resource(s) you want to protect (e.g., your CloudFront distribution or ALB). Click Next.

Step 3: Add Cloudbric's Managed Rules

This is where you integrate Cloudbric’s security intelligence.

  1. On the "Add rules and rule groups" screen, click the Add rules dropdown and select Add managed rule groups.
  2. Scroll down to the AWS Marketplace managed rule groups section.
  3. Expand the Cloudbric Corp. provider listing to see all available rule groups.
  4. Locate the rule group you need (e.g.,OWASP Top 10 Rule Set) and toggle the Add to web ACL switch.

First-Time Subscription: If you haven't subscribed before, a prompt will appear. Click "Subscribe in AWS Marketplace," accept the terms, and return to the WAF console. The toggle will now be active.

Once added, the rule group will appear in your list with its associated WCU (Web ACL Capacity Unit) cost. Repeat this for any other Cloudbric rule groups you wish to add. Click Next.

Step 4: Set Rule Priority, Review, and Create

Set rule priority if you have added multiple rules. By default, your new rule group will be evaluated last.

Review your configuration to ensure all settings are correct.

Click Create web ACL. The deployment typically takes about 60-90 seconds.

A success banner will confirm that your AWS resources are now protected by your new Web ACL featuring Cloudbric's managed rules.

Your Security Toolkit: The Cloudbric Rule Arsenal

Choose the right protection for your specific needs. Here’s a breakdown of the available rule groups, their purpose, and their capacity cost.

Rule Group What It Does for You When to Use It
API Protection Guards against the OWASP API Security Top 10 (injection, broken authentication, data exposure) with schema and rate-based checks. Any public or partner-facing REST/GraphQL API, especially for fintech, SaaS, or mobile back-ends.
Anonymous IP Protection Detects and blocks traffic from VPNs, proxies, Tor exits, and other anonymizing services to prevent fraud. Stop fraud rings, price scrapers, and location-based abuse without blocking legitimate users.
Bot Protection Uses behavioral and signature-based filters to block credential stuffing, carding, inventory hoarding, and SEO spam. E-commerce checkouts, ticketing sites, and login portals where bot traffic harms business.
Malicious IP Reputation Blocks traffic from a real-time feed of 700k+ IPs linked to malware, spam, DDoS, and C2 servers. A quick, low-cost win for any business to instantly reduce its attack surface.
OWASP Top 10 Provides broad protection against the most critical web application security risks like SQLi, XSS, and path traversal. The essential security blanket for every new website and application before it goes live.
Tor IP Detection Specifically flags and blocks traffic from Tor exit nodes to cut off high-risk, anonymous vectors. Banking, gaming, or any service where user identity and accountability are critical.

Pricing and WCU (Web ACL Capacity Units)

AWS WAF usage is calculated with WCUs. You can combine multiple rule groups in a single Web ACL, but note that the default WCU limit is 1,500 before additional charges apply.

Cloudbric Rule Group Typical WCU Monthly List Price*
API Protection 1,200 Pay-as-you-go via AWS Marketplace
Anonymous IP Protection 90 “
Bot Protection 150 “
Malicious IP Reputation 6 “
OWASP Top 10 1,400 “
Tor IP Detection 6 “

*Pricing is managed directly through your AWS bill.

Ready to Lock Down Your Edge?

Cloudbric brings enterprise-grade protection to your AWS WAF environment without the enterprise-level complexity. With a setup time of less than five minutes and threat intelligence that’s updated daily, you can secure your applications and get back to building.

About Penta Security

Penta Security takes a holistic approach to cover all the bases for information security. The company has worked and is constantly working to ensure the safety of its customers behind the scenes through the wide range of IT-security offerings. As a result, with its headquarters in Korea, the company has expanded globally as a market share leader in the Asia-Pacific region.

As one of the first to make headway into information security in Korea, Penta Security has developed a wide range of fundamental technologies. Linking science, engineering, and management together to expand our technological capacity, we then make our critical decisions from a technological standpoint.

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Research: Ransomware attacks spike by 49% in the first half of 2025

Research: Ransomware Attacks Spiked by 49% in the First Half of 2025

A startling 49% surge in ransomware attacks marked the first half of 2025, with cybercriminals increasingly targeting U.S. organizations and small to medium-sized businesses (SMBs). Our latest research reveals that between January and June 2025, ransomware groups exposed 4,198 cases on the dark web—a dramatic increase from the 2,809 cases recorded during the same period in 2024.

So, what forces are driving this alarming trend, who are the primary targets, and what can organizations do to defend themselves?

Why the Sudden Increase? The Forces Driving the Ransomware Boom

The profitability and effectiveness of ransomware have emboldened cybercriminals to intensify their efforts. Vakaris Noreika, a cybersecurity expert at NordStellar, identifies three key factors contributing to the growth:

"Factors contributing to the growth in ransomware attacks include the rise in ransomware-as-a-service (RaaS), expanded attack surfaces from remote or hybrid work models, and economic uncertainty that could encourage more people to turn to cybercrime."

Let's break down these drivers:

  • Ransomware-as-a-Service (RaaS):This business model lowers the barrier to entry for cybercrime. RaaS providers supply malicious software and infrastructure, allowing affiliates with little to no technical expertise to launch sophisticated attacks.
  • Expanded Attack Surfaces:The shift to remote and hybrid work has increased the number of endpoints, home networks, and personal devices connecting to corporate systems. This creates new vulnerabilities and strains security teams trying to maintain comprehensive protection.
  • Economic Uncertainty:Financial desperation often leads to a rise in illegal activities. Combined with the accessibility of RaaS, ransomware becomes an attractive option for illicit income, offering high potential rewards for relatively low effort.

In a typical modern attack, criminals don't just encrypt files; they exfiltrate sensitive data and threaten to publish it if the ransom isn't paid, adding a layer of public pressure. Even if a ransom is paid, there is no guarantee that attackers will provide a decryption key, and they may demand a second payment, leaving victims with severe financial, reputational, and legal damage.

The Prime Targets of Q2 2025

Our analysis of 1,758 ransomware incidents from April to June 2025 reveals clear patterns in targeting.

The U.S. is a prime target

The U.S. Remains in the Crosshairs Of the cases traced to a specific country, U.S. businesses were hit hardest, accounting for a staggering 49% of all attacks (596 incidents). Germany followed at a distant second with 84 cases, trailed by Canada (74) and the United Kingdom (40). The U.S. is a prime target due to its concentration of profitable businesses, which attackers believe are more likely to pay a ransom to avoid reputational damage and operational downtime.

The Manufacturing Industry Under Siege

製造業是受影響最嚴重的行業，共錄得 229 宗案件The manufacturing sector was the most affected industry, with 229 recorded cases. It was followed by construction (97 cases) and information technology (88 cases). Manufacturing companies are often vulnerable because they struggle to centralize security across geographically dispersed locations and frequently rely on outdated, unpatched operational technology systems.

SMBs: The Most Vulnerable Target

Small to medium-sized businesses were the primary victims. Organizations with 51–200 employees and revenues between $5 million and $25 million experienced the most attacks.

"The victim profile mirrors data from Q1 2025, with SMBs and manufacturing companies remaining the prime targets," notes Noreika. "This is a significant cause for concern because bad actors continue successfully exploiting preventable security vulnerabilities."

Like manufacturing firms, SMBs often have limited budgets for cybersecurity and may rely on third-party IT providers, leaving them exposed.

Who Is Responsible for the Attacks?

The ransomware landscape is dominated by a few highly active groups operating on a RaaS model.

  • Qilin：This Russia-linked group was the most prolific, responsible for 214 incidents in Q2 2025.
  • Safepay：A newer group first detected in late 2024, Safepay rapidly escalated its operations to claim the second spot with 201 incidents.
  • Akira：This established ransomware group was a close third, with 200 incidents.

Building a Ransomware-Resistant Business

As ransomware attacks persist, a proactive defense strategy is essential.

"Aside from raising cybersecurity awareness, companies should build a comprehensive cybersecurity strategy to detect threats before they escalate," advises Noreika. "This includes implementing endpoint protection, monitoring the dark web for potential data leaks, and keeping a close eye on the company's attack surface for unpatched security vulnerabilities."

Key defensive measures include:

  • Empower Your Employees:Your staff is the first line of defense. Implement continuous cybersecurity training focused on identifying phishing scams, using strong password management, and enabling multi-factor authentication.
  • Implement a Layered Technology Defense:Deploy endpoint protection, continuously monitor your external attack surface for vulnerabilities, and scan the dark web for compromised credentials or leaked data related to your organization.
  • Plan for Recovery:To minimize the impact of a potential attack, Noreika recommends that businesses "stay two steps ahead, implement recovery plans, and always back up critical data." Regular, tested backups are the most effective way to recover from an attack without paying a ransom.

About the Methodology

We continuously monitor over 200 dark web blogs operated by ransomware groups to collect data on victim organizations. Once a company is identified, we use publicly accessible business data sources to gather firmographic information, such as industry, size, and location. The total number of attacks is accurate, though figures in categorized breakdowns may be slightly higher due to a smaller sample size where full firmographic data was available.

關於 NordStellar

NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Penta Security 慶祝 28 年網絡安全領導地位，擘劃全球 AI 驅動的未來願景

今年七月，正值全球的資訊安全月，Penta Security 自豪地慶祝公司在創新、領導地位及堅定致力於創造更安全數碼世界方面所走過的 28 年。自 1997 年以來，本公司一直是南韓網絡安全市場的先驅，如今，我們已準備好邁向下一段壯麗的新篇章。

在週年紀念致詞中，行政總裁 Tae Gyun Kim 強調，整個產業正處於一個關鍵的轉捩點。他表示：「在我們的超連結社會中，安全不再是一項輔助性技術。它已成為創新的基礎和企業生存的核心。這項轉變是我們最大的機遇。」 

基於在韓國深耕的市場領導地位，Penta Security 正在加速全球擴張，策略性地聚焦於其在日本和越南的辦事處。公司同時也在增強其核心能力，以在 AI 時代保持領先，延續 28 年來定義我們的先驅精神。

慶祝活動也向此成功背後的真正驅動力 —— 我們的員工 —— 致敬。今年，共有 29 名團隊成員因其五年和十年的奉獻服務而榮獲長期服務獎。他們的熱情與承諾是我們公司成就的基石。

在 28 週年慶典上再次凝聚的團結與熱情驅動下，Penta Security 已比以往任何時候都更有準備，繼續其作為全球網絡安全領域中值得信賴的領導者之旅。

About Penta Security

Penta Security takes a holistic approach to cover all the bases for information security. The company has worked and is constantly working to ensure the safety of its customers behind the scenes through the wide range of IT-security offerings. As a result, with its headquarters in Korea, the company has expanded globally as a market share leader in the Asia-Pacific region.

As one of the first to make headway into information security in Korea, Penta Security has developed a wide range of fundamental technologies. Linking science, engineering, and management together to expand our technological capacity, we then make our critical decisions from a technological standpoint.

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×