ServiceNow Completes $7.75 Billion Armis Deal
to Own Cyber-Physical Visibility

ServiceNow has closed its roughly $7.75 billion cash purchase of Armis, buying the cyber-physical sensing layer its security workflows previously had to rent.

On 20 April 2026, ServiceNow announced that it had completed the acquisition of Armis for approximately $7.75 billion in cash, funded with cash on hand and debt. Armis brings real-time cyber exposure management across OT, IoT, medical devices, physical AI, code and cloud. The close follows ServiceNow's earlier 2026 addition of identity specialist Veza.

The commercial question is no longer whether ServiceNow wants a larger security story. It is whether owning the asset-visibility layer turns Security and Risk into a first-class surface on the ServiceNow AI Platform, instead of a workflow system that still depends on someone else's telemetry.

The transaction

ServiceNow (NYSE: NOW) completed an all-cash acquisition of Armis at about $7.75 billion. Tidal Partners was lead financial adviser to ServiceNow, with J.P. Morgan Securities and Barclays also advising. Armis Centrix remains available both as a standalone product and as part of the ServiceNow AI Platform.

That structure matters. ServiceNow is not forcing an immediate rip-and-replace. It is buying a sensing franchise it can keep selling while it stitches OT and IoT visibility into IT workflows, vulnerability response and risk programmes that already run on ServiceNow.

What Armis adds

Armis specialises in seeing and prioritising risk across connected assets that traditional IT tools often miss: industrial controllers, medical devices, building systems, and the growing set of physical and embedded AI endpoints. ServiceNow's own narrative after close emphasises nearly 7 billion devices tracked in real time and a path toward more autonomous security operations.

For ServiceNow customers, the attraction is practical. Workflow without asset truth is theatre. Asset truth without workflow is a dashboard. The deal tries to own both sides of that loop.

Why ServiceNow paid for ownership

ServiceNow already had strength in IT service management, security operations workflows and, after Veza, identity context. What it still lacked was a durable, proprietary view of the cyber-physical estate. Renting that visibility through partnerships leaves the platform dependent on third-party sensing economics and product roadmaps.

Paying cash at this scale is a statement that exposure management is infrastructure for the next phase of ServiceNow's security business, not an optional integration. Trade coverage around the close also notes that Armis and Veza together are expected to expand ServiceNow's addressable market in security and risk well beyond the organic Security business that had already passed $1 billion in annual contract value.

Integration questions that matter

The open work is product sequencing. How quickly does Armis telemetry become a native input to ServiceNow vulnerability, incident and risk workflows? How cleanly can Centrix stay excellent for customers who do not want a full ServiceNow stack? And how does ServiceNow avoid turning a specialist sensing company into a generic module with slower innovation?

Those are execution questions, not strategy doubts. The strategy is already clear: identity (Veza) plus exposure (Armis) plus workflow (ServiceNow) is meant to be one security control tower story.

For corporate development teams watching security software, the practical lesson is straightforward. When a workflow platform depends on a sensing layer it does not own, a large cash acquisition can be cheaper than years of partnership friction. ServiceNow already knew how to route work. Armis knew how to see the estate. The close joins those jobs under one balance sheet.

The market should also separate completion from integration. The .75 billion cheque is done. The harder work is making Armis telemetry feel native inside ServiceNow programmes without dulling the product that justified the price.

Acquiry's read

Central view

This is a platform ownership deal. ServiceNow is buying the layer that tells security programmes what exists, so remediation and governance can run on facts ServiceNow controls.

Why the price makes commercial sense

Cyber-physical visibility is difficult to rebuild quickly and painful to leave permanently outside the platform. At roughly $7.75 billion, ServiceNow is paying for time, installed reach and a sensing franchise that sits upstream of many of the workflows it already sells.

What could go wrong

Integration can dilute Armis's product edge, or leave Centrix standing beside ServiceNow instead of inside the highest-value workflows. Either failure would waste the strategic logic even if the financial close was clean.

What it signals

Large enterprise platforms are consolidating the sensing and identity layers needed for agentic operations. Peers should read Armis less as a one-off security bolt-on and more as evidence that workflow companies will buy the data planes their automation depends on.