ServiceNow completed its approximately $7.75 billion cash acquisition of cybersecurity company Armis on April 20, 2026. ServiceNow announced the deal on December 23, 2025, originally describing an expected closing in the second half of 2026. That announcement-only framing is now outdated: Armis is part of ServiceNow, although its Centrix platform remains available as a standalone solution while deeper integration continues.
For investors, the transaction expands ServiceNow’s cybersecurity and risk opportunity but also brings integration costs, debt financing, margin pressure and execution risk. The central question is whether ServiceNow can turn Armis’ broad asset intelligence into a simpler, higher-value security workflow rather than another layer of enterprise software.
As an Amazon Associate I earn from qualifying purchases.
What happened in the ServiceNow-Armis deal?
ServiceNow agreed to acquire Armis for approximately $7.75 billion in cash, subject to customary adjustments. ServiceNow said it funded the transaction with a combination of cash on hand and debt.
The companies announced the agreement on December 23, 2025. The acquisition closed on April 20, 2026, according to ServiceNow’s closing announcement. Armis employees joined ServiceNow after closing.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
At announcement, ServiceNow said Armis had more than $340 million in annual recurring revenue, annual recurring revenue growth above 50% year over year and approximately 950 employees. Those are company-provided figures, not independently audited transaction metrics.
What Armis does
Armis is a cybersecurity company focused on cyber exposure management, asset intelligence and cyber-physical security. Its technology is designed to discover and assess connected assets across environments that can be difficult for conventional security tools to see, including:
- Information-technology systems and endpoints
- Operational technology and industrial equipment
- Internet-of-things devices
- Medical devices
- Cloud environments
- Code and other connected assets
- Physical AI and related systems
Armis should not be reduced to a conventional vulnerability scanner. Its strategic value is the combination of asset discovery, security context, exposure prioritization and protection. The company’s Centrix platform is intended to help organizations understand what assets exist, what risks affect them and which risks deserve attention first.
Free tools Windows power users keep installed
One-click scans. No signup required.
In practical terms, exposure management follows a chain:
- Discover the asset: Identify devices, systems, workloads, applications and other connected components.
- Identify the exposure: Find vulnerabilities, misconfigurations, unmanaged assets, suspicious activity or other weaknesses.
- Prioritize the risk: Consider business importance, operational impact, threat intelligence and safety constraints.
- Take action: Assign, remediate, isolate, monitor, patch or otherwise respond through an approved workflow.
ServiceNow’s rationale is that Armis can supply the “see and understand” part while ServiceNow supplies workflow automation, risk management and operational follow-through.
Why ServiceNow wanted Armis
ServiceNow already sells security operations, governance, risk, compliance, workflow and automation capabilities. Armis adds broader real-time visibility into physical and operational environments, extending ServiceNow’s reach beyond software-centric enterprise workflows.
The combination could allow a security team to connect an exposure to a specific asset, business owner, identity, risk record and remediation process. That matters when an organization has thousands of devices that may not appear reliably in a traditional IT asset inventory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The acquisition also supports ServiceNow’s stated push toward AI-native and autonomous cybersecurity. AI systems and automated workflows need accurate context. An agent cannot safely recommend or execute an action if the organization does not know which asset is affected, who controls it or how important it is.
Rank #2
- Comprehensive Hardware and Service Package: Purchase includes the FortiGate-90G appliance combined with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection (UTP).
- Unified Threat Protection (UTP) Bundle: Offers robust web security services that protect against web-borne threats, including sophisticated DNS-based threats.
- Advanced Filtering and Security Features: Features ATP, DNS filtering, URL filtering, video filtering, and anti-botnet and C2 communications services, securing your organization against a range of advanced threats.
- Extended Web Security: Effectively blocks malicious URLs and filters content to maintain high security standards and regulatory compliance.
- Ideal for Various Enterprise Environments: Suitable for businesses seeking to enhance their defense against increasingly complex security threats.
ServiceNow said the acquisition would more than triple its market opportunity for security and risk solutions. That is a company projection, not an independently verified market-size measurement.
How Armis fits with ServiceNow’s other security acquisitions
Armis is part of a broader ServiceNow strategy connecting assets, identities, risk and automated action.
ServiceNow completed its acquisition of Veza on March 2, 2026. Veza contributes identity intelligence and visibility into access by human, machine and AI-agent identities. Armis contributes visibility into connected assets and cyber exposure.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Together, the intended model is:
- Armis: What assets exist, how they are exposed and how they behave.
- Veza: Who or what can access those assets.
- ServiceNow: How risk is recorded, assigned, governed and acted upon.
- AI capabilities: How security decisions and workflows can be assisted or automated under defined controls.
On May 5, 2026, ServiceNow announced Autonomous Security & Risk, positioning Armis and Veza within its broader AI platform. The announcement describes a strategy to govern AI agents, identities and connected assets. It does not mean that fully autonomous remediation is universally available or appropriate for every customer.
What changed after the acquisition closed?
Armis is no longer an independent company. It became part of ServiceNow, and ServiceNow said Armis was integrated into the ServiceNow AI Platform.
However, the closing did not mean every product, data model or workflow was instantly unified. ServiceNow said Armis Centrix remained available as a standalone solution, with deeper integration expected over time. Existing Armis-ServiceNow integrations also meant the acquisition accelerated an established relationship rather than starting from zero.
That distinction matters for customers and investors. The strategic vision is broader than the currently confirmed product state. Some capabilities have been announced or integrated; others remain dependent on product execution, packaging, migration decisions and customer adoption.
Financial context: price, valuation and margin pressure
Armis had reportedly raised $435 million at an approximately $6.1 billion valuation in November 2025, according to CRN.
Rank #3
- Comprehensive Hardware and Service Package: Purchase includes the FortiGate-90G appliance combined with 3 year of FortiCare Premium and FortiGuard Unified Threat Protection (UTP).
- Unified Threat Protection (UTP) Bundle: Offers robust web security services that protect against web-borne threats, including sophisticated DNS-based threats.
- Advanced Filtering and Security Features: Features ATP, DNS filtering, URL filtering, video filtering, and anti-botnet and C2 communications services, securing your organization against a range of advanced threats.
- Extended Web Security: Effectively blocks malicious URLs and filters content to maintain high security standards and regulatory compliance.
- Ideal for Various Enterprise Environments: Suitable for businesses seeking to enhance their defense against increasingly complex security threats.
Comparing that private financing valuation with the approximately $7.75 billion transaction value produces an implied difference of about $1.65 billion:
| Measure | Amount |
|---|---|
| Reported prior private valuation | Approximately $6.1 billion |
| ServiceNow transaction value | Approximately $7.75 billion |
| Difference | Approximately $1.65 billion |
| Implied premium | Approximately 27% |
This is an implied comparison with a private-company financing valuation, not a formal public-company takeover premium. Private financing valuations and acquisition values can reflect different terms, preferences and market conditions.
ServiceNow later said the acquisition was expected to create approximately:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- 25 basis points of fiscal 2026 subscription gross-margin pressure
- 75 basis points of fiscal 2026 operating-margin pressure
- 200 basis points of fiscal 2026 free-cash-flow-margin pressure
- 125 basis points of operating-margin pressure in the second quarter of 2026
These were management’s expected headwinds, not a prediction of permanent long-term margin damage. Investors should separate the initial cost of absorbing Armis from the eventual question of whether Armis accelerates ServiceNow’s growth and expands its security economics.
What the acquisition means for customers
Existing Armis customers
Existing customers should not assume that they must immediately migrate to ServiceNow. The confirmed position after closing was that Armis Centrix remained available as a standalone solution.
Customers should obtain written answers on:
- Contract renewal and account-management arrangements
- Support levels and product-road-map commitments
- Whether current integrations with ITSM, SIEM, SOAR, CMDB and competing platforms will continue
- Which new integrations are available now versus planned
- Whether deeper functionality requires ServiceNow licensing
- Data residency, retention, access control and tenant-isolation policies
- Packaging, pricing and any future migration requirements
ServiceNow has not established through the supplied evidence that every future pricing or packaging decision is settled. Customers should rely on their contracts and current vendor documentation rather than assumptions based solely on the acquisition announcement.
Existing ServiceNow customers
ServiceNow customers may gain stronger asset discovery, including visibility into unmanaged, operational and specialized devices. They may also be able to connect exposure findings more directly to risk registers, service ownership, change management and remediation workflows.
The potential advantage is greatest for large organizations already using ServiceNow as an operating system for IT and risk processes. The potential disadvantage is complexity: an acquisition only reduces tool sprawl if data models, dashboards, licensing and workflows are genuinely coherent.
Rank #4
- SonicWall TZ270 with 3 Year TPSS - SecureUpgradePlus (02-SSC-7311) - Entry-level Gen 7 firewall for small businesses, lean branch offices, and retail environments that need affordable enterprise-grade cybersecurity with gigabit performance and easy deployment.
- Threat Protection Service Suite (TPSS) provides essential network security with Gateway Anti-Virus, Intrusion Prevention, and Application Control. Delivers continuous real-time protection against malware, intrusions, and risky applications, ensuring SMBs maintain strong baseline cybersecurity with simplified, affordable management.
- Defends against ransomware, malware, intrusions, and encrypted threats using Reassembly-Free Deep Packet Inspection (RFDPI), Real-Time Deep Memory Inspection (RTDMI), and Capture ATP cloud sandboxing.
- Flexible connectivity with eight Gigabit Ethernet interfaces, USB ports, and Zero-Touch deployment to simplify remote rollout and reduce IT workload.
- The SonicWall Secure Upgrade Plus program allows organizations to replace a qualifying SonicWall or non-SonicWall firewall with a current Gen 7 model and a service subscription of choice, including Essential, Advanced, or Managed Protection Service Suites. Proof of ownership of a valid device is required to participate. This program ensures that businesses move to stronger next-generation protection while maintaining service continuity and access to SonicWall’s latest security innovations.
OT, healthcare and critical infrastructure customers
Automated remediation should not be interpreted as automatic patching everywhere. In operational technology, healthcare, manufacturing, utilities and critical infrastructure:
- Availability and safety may take priority over immediate patching.
- A device may be unsupported or controlled by a specialized vendor.
- Changes may require maintenance windows and formal approvals.
- Security actions may affect regulatory obligations or physical operations.
- Passive discovery may be preferable to intrusive scanning.
- Human review may be mandatory before isolation or remediation.
For these environments, the quality of approval controls and change-management integration may matter more than the headline promise of autonomous action.
What it means for partners
The transaction affects Armis resellers, managed security providers, systems integrators, ServiceNow implementation partners and specialists serving industrial, healthcare and critical-infrastructure customers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchServiceNow’s enterprise sales organization could expand Armis’ reach, but the acquisition can also create channel questions. Partners should verify whether they can sell Armis standalone, whether bundled offerings are available, how account ownership works and whether certifications, margins or deal-registration rules have changed.
CRN reported that Armis introduced a simplified Select Partner Program after the acquisition announcement. That is useful context, but partners should confirm current post-close terms directly with the vendor before relying on the earlier program description.
Strategic upside for ServiceNow investors
- Broader security coverage: Armis adds visibility across OT, IoT, medical devices and other cyber-physical assets.
- Higher-value workflows: ServiceNow can connect security intelligence to risk, ownership and remediation processes.
- Identity-plus-asset context: Veza and Armis may help correlate access rights with exposed assets.
- Enterprise distribution: ServiceNow may be able to sell Armis into a large installed base.
- AI governance: Better asset and identity context can make AI-agent governance more practical.
These are strategic rationales, not guaranteed financial outcomes. The acquisition creates the opportunity for cross-selling and platform expansion, but revenue synergies depend on customer demand, packaging and execution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Key risks and unresolved questions
Integration risk
ServiceNow must reconcile Armis’ asset intelligence with its own data models, CMDB, security products and workflow architecture. Poor integration could produce duplicate dashboards, conflicting asset records or additional administrative work.
Product overlap
Customers may struggle to understand which ServiceNow security products they need, what Armis adds and whether overlapping features are consolidated or sold separately.
Best Value
- SonicWall TZ270 with 1 Year EPSS - TotalSecure (02-SSC-6841) - Entry-level Gen 7 firewall for small businesses, lean branch offices, and retail environments that need affordable enterprise-grade cybersecurity with gigabit performance and easy deployment.
- Essential Protection Service Suite (EPSS) delivers comprehensive firewall security with Gateway Anti-Virus, Intrusion Prevention, Application Control, Content Filtering, and 24×7 Support with firmware updates. Provides full-spectrum defense against known and emerging threats while simplifying renewals and licensing for small and mid-sized businesses.
- Defends against ransomware, malware, intrusions, and encrypted threats using Reassembly-Free Deep Packet Inspection (RFDPI), Real-Time Deep Memory Inspection (RTDMI), and Capture ATP cloud sandboxing.
- Flexible connectivity with eight Gigabit Ethernet interfaces, USB ports, and Zero-Touch deployment to simplify remote rollout and reduce IT workload.
- The SonicWall TotalSecure Trade Up program enables customers with an eligible SonicWall or third-party firewall to upgrade to a new Gen 7 appliance bundled with a protection service suite such as Essential or Advanced. This all-in-one option simplifies purchasing by combining next-generation hardware with active security services, helping organizations modernize defenses and maintain continuous protection in a single package.
Vendor concentration
Some customers may welcome one strategic platform. Others may prefer independent vendors so that asset intelligence, IT service management, security operations and workflow are not concentrated under one provider.
Employee retention and culture
Armis’ technical and product expertise is central to the deal’s value. ServiceNow itself identified employee-retention issues, business disruption, integration delays and legacy liabilities as potential risks in its forward-looking statements.
Pricing and portability
The long-term commercial model remains important. Customers should ask whether standalone Centrix remains fully viable, whether ServiceNow licensing is required for advanced workflows and how data can be exported if the customer changes platforms.
Recommended Free Tools
How to evaluate the combined offering
Enterprise buyers considering ServiceNow and Armis should ask for a proof of concept covering their actual environment. The demonstration should include:
- Discovery of unknown, unmanaged, OT, IoT and medical-device assets
- Passive and active discovery methods
- Asset-attribution confidence and data freshness
- Risk scoring tied to business and operational context
- Integration with CMDB, SIEM, SOAR, ITSM, EDR, IAM and vulnerability tools
- Approval gates for remediation and isolation
- Support for safety-sensitive and regulated environments
- Data residency, retention, encryption and tenant isolation
- API access, reporting and data export
- Implementation time, partner availability and ongoing services cost
- Standalone operation versus dependence on ServiceNow licensing
ServiceNow-Armis is most compelling for large enterprises seeking a unified security and workflow operating model. It may be excessive for a smaller organization that only needs focused vulnerability management or a lightweight exposure-management product.
Competitive implications
The combined offering will compete for budgets that may otherwise go to exposure-management, attack-surface-management, vulnerability-management, cloud-security, identity-security, SIEM/SOAR and OT-security platforms.
Alternatives serve different starting points. Tenable One is commonly evaluated by organizations focused on exposure and vulnerability management. Microsoft’s security portfolio may be attractive to companies already standardized on Microsoft identity, endpoint and cloud products. CrowdStrike Falcon Exposure Management may fit organizations centered on the CrowdStrike security ecosystem.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe right comparison is not simply which product has the longest feature list. Buyers should compare asset coverage, OT and medical-device visibility, identity context, workflow integration, data portability, implementation burden and total cost.
Investor takeaway
ServiceNow’s Armis acquisition gives the company a stronger foundation for connecting cyber exposure with workflow, risk management, identity intelligence and AI governance. It also expands ServiceNow into asset categories that traditional enterprise IT tools may not fully represent.
The deal is now closed, but the investment case is still execution-dependent. Investors should watch Armis-related revenue growth, customer adoption, cross-selling, retention of key employees, product integration, packaging clarity and the pace at which initial margin pressure improves.
The most important test is whether the combined platform helps customers reduce security complexity and act on risk faster. If it does, the $7.75 billion purchase could support a broader security business. If integration creates overlapping products, higher costs or slower decisions, the acquisition may add complexity without delivering the promised operating leverage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
