ServiceNow pays $7.75B for Armis: identity arrives inside the workflow layer, and rivals’ “per-seat” logic gets stress-tested

ServiceNow entered a definitive agreement to acquire Armis for about $7.75 billion in cash, with the transaction expected to close in the second half of 2026. ServiceNow then completed the acquisition on April 20, 2026, positioning Armis as a core capability to close the gap between cyber visibility and cyber risk response.

The strategic load-bearing detail is not the price tag—it’s the data layer. ServiceNow’s acquisition announcement describes Armis as providing continuous discovery and cyber-asset mapping, including “nearly 7 billion devices” tracked in real time.

To sell security automation at agent speed, enterprises need two things in the same place: (1) a trustworthy picture of what exists (asset and exposure intelligence) and (2) the policy layer that decides what an automated action is allowed to do.

Armis supplies the first half—continuous cyber asset discovery at scale—while ServiceNow’s Now Platform supplies the workflow execution context. The result is a tighter loop where security agents can trigger workflow steps with less translation overhead between “what the system sees” and “what the system is allowed to do.”

ServiceNow’s FY2025 scale gives context for the magnitude of the step-up. In its FY ended Dec 31, 2025, ServiceNow reported $13.278B of total revenue. That matters because a deal this large forces the company to show that incremental security and automation value can be translated into durable software monetization—ideally without diluting margins.

However, the core “identity inside the workflow” mechanism is still partially unquantified from the primary documents opened here: ServiceNow’s disclosures around the Armis acquisition emphasize cyber exposure management and asset discovery, not a specific, disclosed identity seat-pricing formula.

If cyber agents are increasingly executed through the workflow layer, buyers can prefer a vendor that controls both the “what exists” layer (asset discovery) and the “what is allowed” layer (policy/permissions).

That creates two opposing pressures for identity and security point-solutions: they can either deepen integration (raising costs) or defend pricing (which becomes harder when workflow outcomes are sold as an end-to-end bundle).

In the next quarter or two, the market will look for evidence that Armis data is being operationalized inside ServiceNow workflows—especially where “asset discovery” turns into prioritized security actions.

Over a 1–3 year horizon, the structural shift to watch is whether identity enforcement migrates from standalone permissioning into workflow-native authorization for agent actions. If ServiceNow can demonstrate that buyers will consolidate toward a workflow-native security stack, identity vendors that rely on modular deployments may need to restructure pricing and bundling strategy.