Governance & Risk Management
,
Vulnerability Assessment & Penetration Testing (VA/PT)
Deal Would Move ServiceNow’s Cybersecurity Ambitions From the Shadow to Spotlight
ServiceNow’s security business has long been a sleeping giant inside the workflow orchestration behemoth’s portfolio. And in recent months, the giant appears to have awoken.
See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective
Despite crossing the $1 billion annual contract value threshold last quarter, ServiceNow’s security and risk business has largely flown under the radar of investors and industry analysts alike. The Silicon Valley-based company’s security operations product suite was largely developed organically and is a small part of ServiceNow’s technology workflows business, which focuses on the entire IT department.
But the company’s security ambitions appear to be moving from the shadows to the spotlight.
ServiceNow made a splash on Dec. 2 by reportedly agreeing to spend $1 billion on rising identity security star Veza, which will help organizations understand and control who and what has access to critical data, applications and systems. Now, ServiceNow is eyeing something far bigger, Bloomberg said on Saturday: the $7 billion acquisition of San Francisco-based cyber exposure management vendor Armis.
The two sides are in advanced talks with a possible deal announcement in the coming days, though Bloomberg cautioned the discussions may still fall apart or another potential bidder might emerge. Neither ServiceNow nor Armis responded to Information Security Media Group’s request for comment.
“If you look at our risk business, the security business, AI control tower is pulling us into a lot of more conversations than we would otherwise have been because of our end-to-end capability around security, risk, compliance and giving you full life cycle control and cost management around AI,” ServiceNow President Amit Zavery told investors in October (see: How Generative AI Helps Clients Harden Their Attack Surface).
Why ServiceNow Is Drawn to Armis
Buying Armis would bring a lot of notoriety to ServiceNow’s overlooked cybersecurity business. The company, founded in 2015 by former Adallom executive Yevgeny Dibrov, employs roughly 1,200 people and has raised a whopping $1.17 billion, just last month closing a $435 million funding round at a $6.1 billion valuation led by Growth Equity at Goldman Sachs Alternatives (see: Armis Gets $435M Pre-IPO Funding to Grow Exposure Management).
Armis’s cyber exposure management platform includes modules for asset management and security, on-prem and SaaS OT and IoT security, medical device security, vulnerability prioritization and remediation. A number of these capabilities overlap with ServiceNow’s existing offerings in areas like asset management and operational technology management, meaning rationalization would need to occur.
“AI creates a lot of security issues for every company out there,” Zavery told investors in October. “When you’re starting to adopt so many different pieces of technology in AI, you need to be able to manage them, have visibility and control. And if any incident happens, you have to proactively support that and fix that very quickly across the organization.”
Enthusiasm among ServiceNow investors for buying Armis appears to be minimal, with the company’s stock price falling $93.62 – or 10.82% – to $771.60 per share, which is the lowest the company’s stock has traded since April 22. This would be the third-largest security acquisition of 2025, behind only the two largest cyber buys of all-time: Google’s $32 billion buy of Wiz and the $25 billion Palo-CyberArk deal.
Armis has come a long way in its decade of existence, surpassing $300 million in annual recurring revenue and growing at more than 50% year over year. But despite Armis declaring last month that it’s undertaking preparations for an initial public offering, the company’s topline revenue wouldn’t support such a move for at least a few years.
Why a Strategic Buyer Could Beat Going Public for Armis
The company’s $300 million in ARR pales in comparison to the $627.9 million of revenue Rubrik earned in the year prior to going public, while SailPoint earned $621.5 million in the nine months before its IPO filing and Netskope brought in $328.5 million in the six months before its IPO filing. Conventional wisdom dictates a cyber firm must have at least $500 million in sales to consider an IPO.
In addition, the public cyber companies fairing best since the 2022 market realignment either have plays in multiple security technology categories or focus on data security, which has seen the most direct windfall from the surge in AI spending. Despite Armis broadening its aperture from asset management to exposure management, its products reside within a single category rather than spanning multiple.
Moreover, Armis’s product expansion has put it in the crosshairs of more competitors. The company historically went up against smaller rivals like Axonius in the asset management space, but now has to take on both vulnerability management firms like Qualys, Rapid7 and Tenable as well as OT security firms like Claroty, Dragos and Nozomi Networks in the broader cyber exposure management market.
Getting bought by ServiceNow would allow Armis to become part of a broader technology story, but it would be accompanied by its own set of complications. With two separate asset management and OT offerings, the process of stitching together the strongest components from each tool would make for a more complex integration process, while sun-setting one company’s tool would boost customer churn.
In addition, ServiceNow has no track record of successfully incorporating a company of Armis’s size, with the company’s largest acquisition to date being its $2.85 billion purchase of AI firm Moveworks, which employed just 640 people at the time of purchase. Security changes faster than other areas of IT, and R&D often languishes once a cyber company becomes part of a broader technology platform.
But with security concerns increasingly front and center amid widespread enterprise adoption of agentic AI, ServiceNow appears set to assume the integration risks and attract the ire of its investors by staking a large claim in the cyber market.
“We crossed the $1 billion ACV threshold, and are very, very excited about what we can do in this area,” Zavery told investors in October. “We keep on investing to make sure that we take a lot more part in this market because there’s a lot of demand driving this kind of request to us.”