ServiceNow Completes $7.75 Billion Armis Deal to Own Cyber-Physical Visibility

ServiceNow (NYSE: NOW) paid approximately $7.75 billion in cash, funded through a combination of cash on hand and debt. Tidal Partners was ServiceNow's lead financial adviser, with J.P. Morgan Securities and Barclays also advising. When the deal was announced in December 2025, ServiceNow guided to completion in the second half of 2026. It closed in April, well ahead of that timetable.

The product structure matters as much as the price. Armis Centrix stays available as a standalone product and is already integrated with the ServiceNow AI Platform, with deeper integration expected over time. ServiceNow isn't forcing Armis customers to move onto its stack. It is keeping a specialist franchise it can sell on its own while pulling the data into its own workflows.

Armis does cyber asset discovery and exposure management. It watches network traffic without installing software on devices, so it can find and profile things that can't run a security agent: a programmable logic controller on a production line, an infusion pump in a hospital ward, a badge reader, an HVAC controller, a robot. It then scores the risk on each asset and helps teams decide what to fix first.

According to ServiceNow, Armis covers:

• IT and cloud: laptops, servers and cloud workloads, alongside code-level exposure.
• OT and critical infrastructure: industrial control systems in manufacturing, energy and utilities.
• IoT and building systems: cameras, printers, badge readers and smart building equipment.
• Medical devices: monitors, pumps and imaging systems in hospital networks.
• Physical AI: robots and autonomous systems that are now connecting to enterprise networks.

Its customer list explains the price. Armis is used by nine of the Fortune 10 and more than 35% of the Fortune 100, as well as government agencies. ServiceNow notes that many of those organisations are already its customers, and the two companies already had several integrations between Armis data and ServiceNow workflows. In ServiceNow's words, this is "integration acceleration, not initiation".

ServiceNow's pitch is that security tools have long been split in two. The tools that see risk can't fix it, and the tools that fix it can't see the whole estate. Each gap between detection and response is time an attacker can use.

Before the deal, ServiceNow's security workflows depended on asset data from partners, including Armis. That works until a partner changes its roadmap, its pricing or its owner. Buying Armis removes the dependency and lets ServiceNow feed device data straight into what it calls its Context Engine, which maps assets and identities to the services, teams and policies that rely on them.

That matters more as AI agents start fixing problems themselves. An agent that patches, isolates or reconfigures a device needs an accurate, current picture of what that device is and what depends on it. Wrong asset data in a manual workflow wastes an analyst's time. Wrong asset data driving an autonomous agent can take a production line offline.

Armis is the second half of a two-part build. In March 2026 ServiceNow completed its acquisition of Veza, whose Access Graph maps every permission held by human, machine and AI-agent identities. ServiceNow cites research showing machine identities now outnumber human ones by more than 80 to one, and that stolen credentials remain the dominant way attackers get in.

ServiceNow says Armis and Veza together are expected to more than triple its addressable market for security and risk. That business crossed $1 billion in annual contract value in Q3 2025, and ServiceNow says it closed its largest-ever quarter for OT in Q4 2025. ServiceNow is also setting up an AI Center for Cyber Defense to build what it calls autonomous, agentic cyber defence.

Armis had passed $340 million in annual recurring revenue when the deal was announced, growing more than 50% a year. At $7.75 billion, ServiceNow paid about 22.8 times that ARR. If Armis kept growing at 50%, the multiple on next year's ARR falls to about 15 times. On reach, the price works out to roughly $1.11 per device tracked.

A multiple in the low twenties is high, but not unusual for a category leader growing at 50% in a market large buyers think is strategic. The bigger number is what Armis does for ServiceNow's existing base. If device data makes ServiceNow's vulnerability, incident and risk products stickier and lets them sell into OT budgets they couldn't reach before, the return comes from the whole security business, not from Armis's own revenue alone.

ServiceNow's own forward-looking statements name the usual risks: delays integrating the technology, keeping Armis's staff and customers, and unexpected liabilities. Three matter most here.

• Product speed. Armis is a Gartner and Forrester leader because it moves fast on new device types. Inside a much larger company, it has to keep that pace while also building for ServiceNow's platform.
• Neutrality. Armis customers who don't run ServiceNow, or who use competing workflow tools, will watch closely to see whether Centrix stays a full standalone product or becomes a feature that works best inside ServiceNow.
• Partner ecosystem. Armis has data integrations with security vendors that compete with parts of ServiceNow. Fortinet has already welcomed the deal as a three-way partnership. Others may be less comfortable sending data to a platform that now owns the asset layer.

The cheque is written. The deal now has to show results in product: Armis data inside ServiceNow workflows as standard, without slowing down the product that justified the price.

The central view

ServiceNow bought the data plane its security business stands on. Workflow companies win when they own the system of record. In security, the most basic record is the list of what exists, and ServiceNow no longer rents it.

Why the price makes sense

Device visibility for OT, IoT and medical systems takes years of network data and device research to build. At about 23 times ARR, ServiceNow paid for time, an installed base inside most of the Fortune 100 and a sensing layer that sits upstream of products it already sells to the same customers.

What could go wrong

If integration slows Armis's research or makes Centrix look like a ServiceNow-only add-on, customers and partners could drift to independent vendors. The strategy would still be right, but the price would be harder to defend.

What it signals for buyers and sellers

Large platforms are buying the data layers their AI agents depend on: identity, assets and context. For founders in security, observability and data infrastructure, owning a hard-to-copy signal across a large enterprise base is now a strategic asset, not just a growth story. Acquiry runs buy-side and sell-side mandates in cybersecurity and enterprise software, and in any sector or market beyond it.