ServiceNow alerted us to this news through an analyst note. According to the note and their press release via BusinessWire, ServiceNow has entered a definitive agreement to acquire Armis. This acquisition is explicitly framed to expand security across the "full attack surface," covering IT, OT, and medical devices for companies, governments, and critical infrastructure worldwide.
The Leadership: Israeli Cyber Intelligence Roots
Armis was founded in 2015 by Yevgeny Dibrov (CEO) and Nadir Izrael (CTO). Both founders utilize their background from the Israeli Defense Forces’ Unit 8200 to approach security not as a compliance task, but as a defense operation. Their leadership has steered Armis to become a platform trusted by 35% of the Fortune 100.
The Technology: Securing the "Unmanageable"
The BusinessWire report highlights the integration of Armis' "unique dataset" with the ServiceNow AI Control Tower. This is a critical differentiator.
Traditional agents cannot be installed on an infusion pump or a power grid controller. Armis solves this via agentless passive monitoring. By feeding this real-time data into ServiceNow, the combined entity creates a "unified, end-to-end security exposure and operations stack."
Operational Scale
- Market Position: ServiceNow’s Security and Risk business crossed the $1 billion ACV threshold in Q3 2025.
- Growth Impact: According to the announcement, this deal is expected to triple ServiceNow’s market opportunity in security.
- Scope: The platform explicitly targets medical devices and critical infrastructure, moving beyond standard corporate IT.
The Competitive Landscape: Incumbents vs. Disruptors
This acquisition disrupts the traditional segmentation of the security market:
| Category | Key Competitors | The Moat Analysis |
|---|---|---|
| OT/IoT Specialists | Claroty, Nozomi Networks | These firms identify risks in industrial settings but lack the enterprise-wide workflow to "fix" them. ServiceNow wins on the remediation layer. |
| IT Incumbents | Tenable, Qualys | Strong in standard IT vulnerability scanning but struggle with the "agentless" requirements of medical and critical infrastructure devices. |
Global Footprint
The inclusion of "governments and critical infrastructure" in the official announcement signals a focus on sovereign capabilities. Armis operates globally with R&D in Israel and HQ in California, aligning with ServiceNow's expansive reach across North America, EMEA, and APAC public sectors.
Verified Outcomes
The integration aims to shift organizations from a reactive stance (fixing breaches) to a proactive stance (managing exposure). By pairing Armis' visibility with ServiceNow's configuration management (CMDB), organizations can map assets to business services, ensuring that critical infrastructure is prioritized during a threat event.
Strategic Insight: The "Full Attack Surface"
Most CIOs have a handle on their laptops and servers. They lose sleep over the connected HVAC systems and MRI machines. This acquisition creates a single pane of glass for both. It is a massive consolidation play that positions ServiceNow as the central nervous system for cyber-physical security.
Strategic Question for CIOs:
Does your current security strategy account for the "Full Attack Surface," or are you only securing the devices you can easily see?
Sources:
- BusinessWire, "ServiceNow to acquire Armis," December 22, 2025.
- ServiceNow Investor Relations, Q3 2025 Financial Results.
- Info-Tech Research Group, Security Portfolio Analysis.
Disclaimer: This blog post reflects my personal views only. AI tools may have been used for brevity, structure, or research support. Please independently verify any information before relying on it. This content does not represent the views of my employer, Infotech.com.
Comments