ServiceNow (NYSE: NOW) completed its $7.75 billion acquisition of Armis on April 21, 2026, absorbing the cyber exposure management firm into its AI platform and extending threat visibility across operational technology (OT), Internet of Things (IoT), and critical infrastructure environments. The deal, first announced in December 2025, positions the combined entity to connect real-time asset discovery directly to automated incident remediation - an integration path historically fragmented across the enterprise security toolchain.
Background
The acquisition reflects sustained consolidation pressure in industrial and enterprise cybersecurity. Worldwide end-user spending on information security is projected to increase 12.5% in 2026 to $240 billion, according to figures cited by ServiceNow, with AI adoption and expanding attack surfaces identified as primary growth drivers. OT and IoT environments remain a structural weak point: traditional security tools were not designed to discover unmanaged or air-gapped assets on shop floors, in utilities, or across distributed industrial networks. Armis was named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms for the second consecutive year and was also recognized as a Leader in the Forrester Wave for IoT Security Solutions in Q3 2025, reflecting the platform's standing in the cyber-physical security segment.
The deal follows ServiceNow's earlier completion of the Veza acquisition in March 2026, which added AI-native identity intelligence to the ServiceNow AI Platform. The Armis close is ServiceNow's largest acquisition to date and its fourth cybersecurity purchase over the past year, building on the company's December 2025 close of the Moveworks agentic AI platform for $2.85 billion.
Details
According to the official ServiceNow press release, Armis provides continuous, agentless discovery and classification of managed and unmanaged assets - including OT, IoT, medical devices, and industrial components - tracking nearly seven billion devices in real time. That asset intelligence now feeds into ServiceNow's Context Engine, which maps assets and identities to the services, processes, and policies that depend on them, enabling AI-driven risk prioritization and autonomous remediation workflows.
Amit Zavery, ServiceNow's president, chief operating officer, and chief product officer, stated that "most security platforms stop at the alert" and that Armis provides "real-time, contextual awareness into the cyber risk of every connected asset, including the devices and systems that conventional tools were never built to see." The combined platform routes exposure signals through ServiceNow's AI Control Tower, aiming to convert threat detection into closed-loop remediation with a full audit trail. Armis co-founder and CEO Yevgeny Dibrov emphasized the platform's manufacturing and critical infrastructure focus, citing the assets "at the heart of manufacturing, healthcare, and critical infrastructure" that the deal is designed to protect.
On the commercial side, ServiceNow's security and risk business crossed $1 billion in annual contract value in Q3 2025, and the company recorded its largest quarter ever for OT in Q4 2025. Armis had surpassed $340 million in annual recurring revenue with year-over-year growth exceeding 50% at the time of the deal announcement. ServiceNow stated that Armis, combined with Veza, is expected to more than triple its total addressable market in security and risk solutions.
For industrial operators and security teams, one of the most operationally significant aspects of the integration is that the two companies already maintained multiple pre-existing integrations connecting Armis asset intelligence to ServiceNow workflow actions. The technical bridge represents an acceleration of existing architecture, not a ground-up build. Armis Centrix, the company's core cyber exposure management platform, remains available as a standalone solution while integration with the ServiceNow AI Platform deepens over time.
Outlook
ServiceNow stated it is establishing a global AI Center for Cyber Defense to accelerate next-generation security capabilities and support enterprise transitions from reactive security postures to autonomous, agentic defense. For manufacturing and utility operators evaluating the combined platform, the near-term integration path centers on linking Armis's OT/IoT asset discovery to ServiceNow's configuration management database (CMDB) and incident response workflows - a configuration that incumbents such as Claroty and Dragos will need to address competitively. The deal also raises governance questions for OT-heavy industries: as AI-driven prioritization assumes a greater role in containment decisions, organizations will need to define clear human-in-the-loop thresholds to preserve operational safety and satisfy emerging regulatory requirements around automated cyber response in critical infrastructure.
