ServiceNow has agreed to buy Armis, a cyber exposure management company, for $7.75 billion in cash. It's one of the biggest cybersecurity deals in recent memory and marks ServiceNow's most aggressive move yet into the security space.
The transaction, set to close in the second half of 2026, will merge ServiceNow's workflow automation with Armis' real-time asset discovery platform. The goal? Create a unified system that can spot vulnerabilities, decide what matters most, and act on threats across an organization's entire technology infrastructure.
For ServiceNow, the timing makes sense. Its Security and Risk business hit $1 billion in annual contract value during Q3 2025, proving it can compete with established security vendors. This acquisition should more than triple its addressable market in security solutions and accelerate its push toward AI-driven, autonomous cybersecurity.
Organizations today face security challenges that didn't exist five years ago. AI adoption is expanding faster than security teams can keep up. The attack surface now includes traditional IT systems, operational technology in factories, IoT devices, medical equipment, and cloud workloads. Each represents a potential entry point for attackers.
Armis specializes in managing risk across this fragmented landscape. Its platform discovers and classifies assets without requiring agents installed on every device—a significant advantage when dealing with operational technology, medical devices, and industrial systems that legacy tools often miss. The result is a continuously updated inventory of everything connected to an organization's network.
The company has built serious momentum. Armis crossed $340 million in annual recurring revenue and is growing at over 50% year-over-year. More than a third of Fortune 100 companies use its platform, along with seven of the Fortune 10. Government agencies and critical infrastructure operators worldwide also rely on Armis to protect their environments.
ServiceNow and Armis aren't strangers. They've been partners for years, with integrations already connecting Armis' asset intelligence to ServiceNow's workflow engine. This acquisition takes that relationship much further.
Here's what each brings to the table. Armis provides real-time visibility into what's connected across an organization—every device, every system, every potential vulnerability. ServiceNow adds the operational muscle to turn that intelligence into action. When you connect Armis' asset discovery with ServiceNow's configuration management database (which maps assets to business services and teams), you get a clearer picture of not just what's at risk, but who needs to fix it and how quickly.
This matters especially for industries with cyber-physical systems. Manufacturing plants, hospitals, and utilities operate equipment where a security breach doesn't just compromise data—it can halt production, endanger patients, or disrupt essential services. Real-time protection across IT and OT environments becomes critical when downtime has physical consequences.
Global spending on information security is expected to reach $240 billion in 2026, up 12.5% from the previous year. Rising threats and rapid AI adoption are the main drivers. Security has become the top concern for CEOs navigating digital transformation.
But the problem isn't a lack of security tools. Most large organizations already use dozens of them. The real challenge is fragmentation—too many alerts from too many systems with no clear way to prioritize what actually needs attention. Security teams drown in noise while critical vulnerabilities go unaddressed.
Armis recently earned recognition as a Leader in the 2025 Gartner Magic Quadrant for CPS Protection Platforms. The company also received an Inc. Best in Business award for Innovation. Founded in 2015 with roughly 950 employees, Armis has established itself as a trusted platform for exposure management across enterprise IT, OT, cloud, and IoT environments.
Amit Zavery, ServiceNow's president, COO, and chief product officer, connected the deal to AI adoption. "In the agentic AI era, intelligent trust and governance that span any cloud, any asset, any AI system, and any device are non-negotiable if companies want to scale AI for the long-term," he said.
Yevgeny Dibrov, Armis co-founder and CEO, pointed to the urgency of the threat landscape. "AI is transforming the threat landscape faster than most organizations can adapt. Every connected asset has become a potential point of vulnerability." Dibrov and his co-founders will join ServiceNow when the deal closes.
Larry Feinsmith from JPMorgan Chase offered a customer perspective: "The combination of ServiceNow and Armis provides a dynamic picture of an enterprise’s connected technology assets and an AI and agentic powered blueprint to secure and enable trusted AI."
ServiceNow will fund the purchase through cash on hand and debt. Standard regulatory approvals and closing conditions apply.
For existing Armis customers, the company promises continuity. Current deployments will stay supported, roadmap commitments honored, and the same team—engineers, researchers, customer success staff—remains in place. The message from leadership is clear: trust matters, and they're not changing how they work with customers just because they're joining a larger company.
This deal reflects broader trends in cybersecurity. Platform approaches are winning over point solutions as organizations try to reduce tool sprawl and improve security operations. Vendors that can offer integrated visibility and automated response capabilities have a strategic edge.
Whether ServiceNow and Armis deliver on their promises depends on execution. Can they integrate their technologies smoothly? Will their go-to-market strategies align? Most importantly, will customers see measurable improvements in how they manage cyber risk at scale?
