ServiceNow buys Armis to scale AI-driven cyber risk management
December 30, 2025
ServiceNow will acquire Armis for $7.75bn in cash to tighten security across IT, OT, medical, and other connected environments. The goal: unify real-time asset visibility with automated remediation so security teams can cut exposure at scale, not shuffle tickets between tools.
Why this matters to management
AI and connected devices have stretched risk across every corner of the enterprise. You can't protect what you can't see, and you can't scale what you can't automate. This deal brings Armis' agentless discovery together with ServiceNow's workflow engine and AI Platform to move from fragmented insights to measurable risk reduction.
ServiceNow already operates as an AI control tower for IT, security, and operations, with its Security and Risk business surpassing $1bn in ACV in Q3 2025. Adding Armis strengthens exposure management across unmanaged devices and cyber-physical systems-areas most teams struggle to monitor consistently.
What the combined stack could look like
- Continuous, agentless discovery of IT, OT, IoT, medical, and industrial assets-including unmanaged and "hard-to-see" devices.
- Unified CMDB context: asset inventory mapped into ServiceNow's configuration database for shared truth across security, IT, and operations.
- AI-native risk scoring and prioritization to route issues to the right owners automatically.
- Automated remediation and response workflows that reduce time to mitigation and limit manual handoffs.
- Governance that spans cloud, endpoints, OT, and AI systems to maintain trust as adoption scales.
- Metrics that matter: exposure reduction, mean time to remediate, and control coverage across estates.
Market context
End-user spending on information security is projected to rise 12.5% in 2026 to $240bn, driven by increased threat activity and the surge in AI usage. As AI expands attack surfaces, real-time visibility plus automated response isn't a nice-to-have-it's the operating model.
Armis brings momentum: $340m+ ARR, >50% YoY ARR growth, used by Global 2000 customers, more than 35% of the Fortune 100, and seven of the Fortune 10. It was also recognized as a Leader in the 2025 Gartner Magic Quadrant for CPS Protection Platforms. See related market category context on Gartner Peer Insights here.
What leaders said
Amit Zavery, ServiceNow president, COO, and CPO: "ServiceNow is building the security platform of tomorrow. In the agentic AI era, intelligent trust and governance that span any cloud, any asset, any AI system, and any device are non-negotiable if companies want to scale AI for the long-term. Together with Armis, we will deliver an industry-defining strategic cybersecurity shield for real-time, end-to-end proactive protection across all technology estates. Modern cyber risk doesn't stay neatly confined to a single silo, and with security built into the ServiceNow AI Platform, neither will we."
Yevgeny Dibrov, Armis co-founder and CEO: "AI is transforming the threat landscape faster than most organizations can adapt. Every connected asset has become a potential point of vulnerability. We built Armis to protect the most critical environments and give both public and private sector organizations the real-time intelligence they need to stay ahead - so they can see their entire environment clearly, understand risk in context, and take action before an incident occurs. Together with ServiceNow, customers will have a powerful new way to reduce their exposure and strengthen security at scale."
Larry Feinsmith, JPMorgan Chase head of Global Tech Strategy, Innovation & Partnerships: "In the era of AI and agents, the benefits and value will be enormous, but so is the complexity. The combination of ServiceNow and Armis provides a dynamic picture of an enterprise's connected technology assets and an AI and agentic powered blueprint to secure and enable trusted AI."
What to do next
- Build a complete asset map across IT, OT, medical, and IoT; include unmanaged devices. No exceptions.
- Connect discovery data to your CMDB and normalize ownership so issues don't stall between teams.
- Define a single risk scoring model with business context and enforce routing by asset owner.
- Automate high-confidence fixes (e.g., network quarantine, patch deployment, config changes) with human approval for edge cases.
- Set board-level metrics: exposure reduction per quarter, time to mitigate critical findings, and % automated remediations.
- Plan for OT and clinical workflows up front-test changes in controlled windows and document rollback paths.
- Run quarterly tabletop exercises involving security, IT, facilities, clinical/plant ops, and compliance.
- Review vendor consolidation opportunities to simplify tooling and lower mean time to action.
- Establish AI system inventories and guardrails: model provenance, data access, and incident escalation paths.
- Pilot 1-2 end-to-end workflows within 60 days to prove value before scaling.
Integration signals to watch
- ServiceNow's roadmap for native Armis data models, playbooks, and pricing bundles. See the latest in the ServiceNow newsroom here.
- Coverage depth for OT and medical devices, including support for niche protocols.
- Data residency, privacy controls, and cross-border telemetry handling.
- Incident response alignment across SOC, NOC, and site operations for faster containment.
- Channel and partner enablement for complex multi-site rollouts.
Level up your team
If you're planning 2026 initiatives around AI governance and security operations, upskilling your managers and operators will shorten time to impact. Explore role-based programs such as the AI Learning Path for CIOs at Complete AI Training.
Your membership also unlocks:
