What is Armis? The device discovery firm ServiceNow bought

On April 20, 2026, ServiceNow closed its acquisition of the security company Armis. The price was about $7.75 billion, and diginomica called it the largest acquisition in ServiceNow’s history. Why would a ticketing and workflow company pay that much for a security company? This article covers what Armis does and where it fits in ServiceNow’s security products.

When the deal was announced in December 2025, ServiceNow used an image joining the ServiceNow and Armis logos with a ”+”.

Armis finds every connected device#

Armis was founded in 2015. When the acquisition was announced, it had about 950 employees and annual recurring revenue (ARR) above $340 million, up more than 50% year over year (ServiceNow’s acquisition announcement). Its main product is Armis Centrix.

What it does best is find the devices connected to a company’s network and classify what each one is. For PCs and servers, you can install an asset management agent (resident software) to collect data. But some devices, such as factory control equipment and medical devices, are easy for traditional tools to miss. According to the May 2026 announcement, Armis monitors traffic without agents and without interrupting operations, and adds the device type, classification, firmware version, behavior and current risk to the asset record.

Its scope is broad: IT such as PCs and servers, plus control equipment in factories and plants (OT, Operational Technology), IoT, medical devices, physical AI, cloud and code.

According to the closing announcement, Armis tracks about 7 billion devices in real time. The announcement also says Gartner named it a Leader in the Magic Quadrant for cyber-physical systems (CPS) protection platforms for two years in a row.

After finding devices, deciding what to fix first#

The strategic rationale document ServiceNow published for investors describes the path from finding a device to fixing it in four stages.

1. See everything (Armis Visibility)
2. Understand how it connects (Enriched Graph)
3. Decide what matters most (Armis Exposure Management and Prioritization)
4. Act at scale and speed (ServiceNow AI agents and workflows)

The graph in the second stage holds devices, services, apps, identities and data flows as nodes and edges. If one OT device is exposed to the outside or one identity has the wrong scope of permissions, you can trace which business services and processes the impact spreads to. According to the document, this lets you order fixes by blast radius rather than by the severity of that one device.

Why ServiceNow bought it: finding tools and fixing tools were separate#

ServiceNow’s closing announcement sums up the problem with existing security tools this way: tools that manage risk can’t execute the fix, and tools that execute the fix can’t see the whole picture. In other words, the products that find vulnerabilities and the products that run the remediation work were separate.

ServiceNow already owned the fixing side. Its CMDB (configuration management database) records which devices support which business services and which teams are involved, and it already had workflows for vulnerability response and security incident response. The acquisition announcement describes Armis’s strength as agentless discovery and classification that covers OT, IoT, medical devices and industrial equipment that traditional tools tend to miss. ServiceNow’s idea is to combine that with the CMDB.

A Forrester analyst told The Register that Armis will bring a large volume of data into ServiceNow’s CMDB that it never had before, making its existing discovery capabilities stronger by “an order of magnitude.”

ServiceNow’s security and risk business passed $1 billion in annual contract value (ACV) in the third quarter of 2025. ServiceNow expects the Armis acquisition to more than triple the market opportunity for its security and risk products.

From announcement to close#

Date	Event
December 23, 2025	ServiceNow announced it would acquire Armis for about $7.75 billion in cash, expecting to close in the second half of 2026
March 2, 2026	Closed the acquisition of Veza, an identity (permissions) security company
April 20, 2026	Closed the Armis acquisition, earlier than expected and less than four months after the announcement
May 5, 2026	At its annual Knowledge 2026 event, announced Autonomous Security & Risk, which builds in Armis and Veza
August 4, 2026	Announced six product groups as Autonomous Security

The price is in cash, funded with cash on hand and borrowing. Yevgeny Dibrov, Armis’s co-founder and CEO, appears in the August announcement as ServiceNow’s SVP and GM for cybersecurity and risk.

How Armis and Veza fit together in ServiceNow security#

An ERP Today article lays out the roles of Armis and Veza like this: Armis shows what is in the environment, Veza shows who and what can access it, and ServiceNow feeds that information into security, risk, incident response and remediation workflows.

According to the closing announcement, Armis collects data on connected devices in real time, and Veza’s Access Graph maps the permissions held by human, machine and AI agent identities across systems. ServiceNow’s Context Engine ties the two to business services, processes, teams and policies, and on top of that, workflows automate risk prioritization and remediation. The announcement says every action is recorded in an audit trail.

The May announcement says Armis data flows directly into ServiceNow’s CMDB, turning a static asset inventory into a current picture of the actual attack surface. The same data also goes to security incident response workflows, so risk assessments made before a breach can be used as is for containment after one.

AI Control Tower is also involved in managing AI agents. According to the August announcement, the six product groups connect to AI Control Tower. The May announcement says “every AI agent operating in the enterprise does so through an identity,” and explains that AI Control Tower adds AI agents to the inventory as soon as they appear, keeps assessing their risk and enforces least privilege.

The six product groups announced in August#

The August 2026 announcement splits Autonomous Security into six areas.

Area	Main products	What they do
Unified exposure management	Agentic Exposure Management, Vulnerability Resolution AI Specialist	Brings vulnerability findings from every source into one place and prioritizes them. The AI Specialist triages and remediates, and applies low-risk patches on its own
Continuous vulnerability detection	Application Security, DAST, EASM	Threat modeling of AI-generated code and model dependencies, testing of running apps and APIs, and mapping of the external attack surface as attackers see it
Cyber-physical security	Agentic AI for Cyber Physical Security	On OT and medical device networks, finds devices without agents, baselines normal behavior and models attack paths
Identity and access security	AI Agent Access Security, Non-Human Identity Remediation	Makes access control for AI agents consistent across infrastructure and model providers. Automatically rotates keys, deletes and revokes permissions for non-human identities
Agentic incident response	Tier 2 SOC AI Specialist	Plans and executes responses to complex incidents, and passes only high-risk decisions to human analysts
Cyber risk and compliance	Agentic AI for Continuous Control Monitoring, Cryptographic Asset Compliance	Continuously assesses segregation of duties, access rights and configuration state. Finds outdated cryptography and guides migration to quantum-resistant methods

SiliconANGLE writes that the cyber-physical parts come mainly from Armis and the identity parts from Veza.

Availability as of the announcement:

• Available now: Agentic Exposure Management, Autonomous Remediation Agents, Application Security, DAST, EASM, Agentic AI for Cyber Physical Security, AI Agent Access Security, Non-Human Identity Remediation
• Scheduled for December 2026: Tier 2 SOC AI Specialist, Vulnerability Resolution AI Specialist, Agentic AI for Continuous Control Monitoring, Cryptography Asset Compliance

From device discovery to the fix#

The investor document includes an example of a company with many sites and networks. Turned into steps, it looks like this.

1. Armis collects device and vulnerability data from across the IT and OT environment
2. The graph shows which business services the device connects to, and sets the order of fixes
3. AI agents open incidents, assign them to owners and add context
4. ServiceNow workflows propose or execute the fix, open the change process, and contain risky devices and services

The acquisition announcement describes findings automatically reaching the right team and triggering remediation at scale. ServiceNow also uses Autonomous Security & Risk in its own security operations team, and says AI agents handle incidents 7 times faster than its previous workflows.

If you already use Armis or ServiceNow#

Armis and ServiceNow were partners before the acquisition, and several integrations already existed. A representative one is the Service Graph Connector for Armis on the ServiceNow Store. It keeps the CMDB current with device data Armis finds (hardware, OS and so on) and reduces duplicate and stale records. The closing announcement also says this integration “accelerates” rather than “starts” the work.

For current Armis Centrix customers, the announcement says they will be supported by ServiceNow’s product, engineering and sales organizations, that the product already integrates with the ServiceNow AI Platform, and that it will remain available as a standalone product. Deeper integration will come over time.

Note that the Service Graph Connector for Armis is free on the Store, but using it requires an Armis license with API access and an ITOM Visibility or ITOM Discovery subscription on the Subscription Unit model. Configuration items the connector creates or updates in the CMDB increase Subscription Unit consumption if they are not already managed by ITOM Visibility or ITOM Discovery.

Armis Centrix itself was sold in Japan before the acquisition. According to Cloud Watch (Japanese), Cybernet Systems, a Japanese IT and engineering software company, signed a reseller agreement with Armis Japan, Armis’s Japanese subsidiary, in November 2023 and began selling the product.

What has not been disclosed#

I could not find official information on the following points in ServiceNow and Armis announcements, the ServiceNow Store or press coverage.

• Pricing: ServiceNow prices for Armis Centrix and for each Autonomous Security product are not public
• License structure: The announcements do not say how each Autonomous Security product relates to existing Security Operations licenses
• Availability in Japan: The announcements do not give a timeline for availability in Japan through ServiceNow or for Japanese language support
• Integration timeline: There is no timeline for the order in which Armis Centrix screens and data will be brought into ServiceNow

For organizations with many devices that can’t take agents, such as factories and hospitals, this puts the finding side and the fixing side in one company. On the other hand, four of the products announced in August are not yet available, and how far you can trust AI to carry work through to the fix will likely depend on seeing the actual products from December on.