ServiceNow is reportedly in advanced talks to acquire Israeli-founded cybersecurity startup Armis for up to $7 billion, according to Bloomberg. If completed, this would be ServiceNow's largest acquisition ever—more than double the $2.85 billion it agreed to pay for Moveworks in March. A deal could be announced within days, though talks could still collapse or another bidder could emerge.
Armis, founded in 2016 by Yevgeny Dibrov (CEO) and Nadir Izrael (CTO)—both Israeli military cyber intelligence veterans—specializes in identifying and tracking security threats across connected devices. The company just raised $435 million at a $6.1 billion valuation last month and was actively preparing for an IPO in 2026-2027.
Bill McDermott has spent five years positioning ServiceNow as the "AI control tower" for enterprise operations. His thesis: in an agentic AI world, the technical community—CDIOs, CISOs, IT leaders—becomes the center of corporate gravity because they control the orchestration layer. Cybersecurity is the missing pillar.
Here's what most people miss: ServiceNow already touches security workflows through its Security Operations module, but it doesn't own the security data layer. Armis changes that. Device visibility across IT, OT, IoT, and cloud environments gives ServiceNow the attack surface intelligence it needs to become genuinely indispensable to enterprise security teams—not just a workflow tool they integrate with.
Armis just raised at $6.1 billion. ServiceNow offering up to $7 billion represents a modest premium—but with far more certainty than an IPO in a market that hasn't exactly welcomed security listings recently. For Insight Partners, which acquired Armis for $1.1 billion in 2020, this is a clean 6x+ exit without the uncertainty of public markets.
For ServiceNow, the competitive urgency is real. Google just closed a $32 billion deal for Wiz. The enterprise software giants are hoarding cybersecurity assets. McDermott can't afford to let Armis go public and potentially get scooped by someone else.
Armis hit $300 million ARR in August, up from $200 million the year before—50% growth. They're projecting $500 million within 18 months. At roughly 23x ARR (on current run rate), this isn't cheap, but it's not the 64x that Google paid for Wiz either. For a company that just raised at $6.1 billion and is demonstrably growing, $7 billion is defensible.
Armis co-founders came from Unit 81 and Unit 8200—the same wellspring that produced the Wiz founders and countless other successful cybersecurity companies. Dibrov was at the founding team of Adallom (sold to Microsoft for $320M) before starting Armis. The technical depth is legitimate.
Armis has executed well on acquisitions—CTCI, Silk Security, and OTORIO have all been integrated successfully. According to Dibrov, they turned Silk Security from $600K to $40M in annual sales post-acquisition. That execution capability matters for integration with ServiceNow.
Armis serves 40%+ of the Fortune 100 across healthcare, financial services, defense, and manufacturing—verticals where ServiceNow is already deeply embedded. The customer overlap creates genuine cross-sell opportunities, not just hopeful synergy slides.
Just last month, Dibrov told Calcalist: "We have crossed the $300 million mark, and investment and acquisition offers are constantly flowing to us. Our goal is to reach $1 billion in ARR within three years, and to go public by the end of 2026 or 2027."
When asked about a full sale, he said it "was never seriously considered" and that "we need people who share our mindset."
Something changed—quickly. Either ServiceNow made an offer too good to refuse, or Armis got cold feet about the IPO market. Either way, enterprise buyers should ask: is this a strategic partnership or an exit?
Before Moveworks ($2.85B), ServiceNow's acquisition history was almost entirely tuck-ins: Parlo, Loom Systems, Passage AI, Element AI. McDermott built his reputation at SAP on mega-deals, but ServiceNow's integration capabilities haven't been battle-tested at this scale.
The Moveworks deal hasn't even closed yet (expected second half of 2025). Announcing a deal 2.5x larger while the first one is still pending regulatory approval is... ambitious. It signals confidence, but also risk concentration.
At $7 billion on $300 million ARR, we're talking about 23x+ revenue multiple for a company that, despite strong growth, is in a crowded cybersecurity market competing against Claroty, Axonius, Tenable, and Rapid7. Armis's own CEO acknowledged they "compete across every cybersecurity category."
ServiceNow shareholders watched the stock decline ~21% this year while the company announced aggressive M&A plans. At some point, the "platform expansion" story needs to translate into accelerating growth, not just larger acquisition checks.
We're watching the great consolidation of enterprise software unfold in real-time. The pattern is unmistakable:
The thesis across all these deals: standalone point solutions can't survive in an agentic AI world. Enterprises want fewer vendors, more integration, and platforms that can serve as the "control tower" McDermott keeps talking about.
For AI founders and GTM leaders, this is a critical signal. The window for building standalone security or AI tools and taking them public is narrowing. The platforms are buying their way to completeness.
ServiceNow acquiring Armis makes strategic sense on paper. McDermott needs a security story to compete with the hyperscalers gobbling up cyber assets. Armis needs certainty in an unpredictable IPO market. The customer overlap is real, the technology is legitimate, and the timing creates urgency on both sides.
But this is a big bet. ServiceNow is attempting to digest two multi-billion dollar acquisitions simultaneously while competing against Microsoft, Salesforce, and Google in the AI platform war. Execution risk is high. Integration complexity is real.
My prediction: If this deal closes, watch for enterprise buyer hesitation in Q1-Q2 2025. CISOs will want to see ServiceNow's integration roadmap before committing to either platform. That hesitation creates opportunity for competitors—and pressure for ServiceNow to execute flawlessly.
The agentic AI control tower thesis is compelling. But building it through rapid M&A while digesting $10 billion in acquisitions? That's the real test of whether McDermott's ServiceNow can become the "defining enterprise software company of the 21st century" he promised—or just another platform trying to buy its way to relevance.
What's your read? Does security belong in the workflow platform, or should it stay independent? Drop a comment.
.svg)
