ServiceNow has agreed to buy cybersecurity firm Armis for $7.75 billion in cash, a deal that would expand the enterprise software company’s security offerings into device-focused exposure management across information technology and operational networks.
The companies said combining ServiceNow’s workflow and risk products with Armis’ asset discovery and cyber-physical security tools would create an end-to-end system intended to detect vulnerable devices, prioritize risks and route remediation through automated operational processes.
ServiceNow framed the acquisition around so-called AI-native and agentic capabilities, saying automation and prioritized response are necessary as networks expand and threats move faster than manual triage allows. Company executives described the deal as part of building broader trust, governance and security that span clouds, assets and AI systems.
Armis specializes in mapping and classifying devices across IT and OT environments, including industrial controls and medical devices, and performs “agentless” discovery that can identify devices without installing software on each endpoint. The capability is aimed at older or regulated systems that are difficult to inventory with traditional security tools.
Founded in 2015, Armis reported more than $340 million in annual recurring revenue and said it employs about 950 people. The company counts Global 2000 customers, including more than 35% of the Fortune 100, and said it serves government agencies and public-sector organizations.
ServiceNow said its security and risk business crossed $1 billion in annual contract value in the third quarter of 2025 and described the Armis deal as a way to more than triple its market opportunity in that area. The announcement comes as vendors pursue AI-related security acquisitions and as companies cited a forecast for worldwide information security spending to rise 12.5% in 2026 to $240 billion. If completed, the deal would strengthen ServiceNow’s position in cyber-physical security by linking Armis’ real-time device intelligence to ServiceNow’s configuration management database to make remediation more actionable; the companies did not provide a timeline for completion.