ServiceNow's AI Bet: Security Meets ITSM

ServiceNow, the dominant player in IT service management, is navigating a period of disruption that has unsettled investors and enterprise customers alike. The company that once defined the stable, subscription-based SaaS model now finds itself adapting to an era where AI agents and vibe-coding tools threaten to upend the very foundations of per-seat licensing. At the same time, ServiceNow is making a bold push into cybersecurity, highlighted by its $7.75 billion cash acquisition of Armis in December. These moves, unfolding against a backdrop of shifting market sentiment, raise fundamental questions about how enterprise software will be bought, sold, and secured in the coming years.

From Seat Licenses to Consumption

For years, ServiceNow's revenue engine hummed along on per-seat subscriptions, a model that tied growth to the number of employees using its platform. But the company's June Financial Analyst Day 2026 presentation confirmed a significant shift: only 50% of its Net New Annual Contract Value in 2025 came from seat-based subscriptions. The rest is increasingly generated by "consumed" services such as infrastructure, integrations and connectors, AI token consumption, and cybersecurity offerings.

This transition reflects a broader industry anxiety that AI agents and internal automation tools will reduce the need for human seats, undermining the subscription model that has enriched SaaS vendors for two decades. The phrase "SaaS apocalypse" gained traction in early 2026, and ServiceNow's share price dropped 30% by mid-2026, albeit from historic highs. While some enterprise IT leaders are indeed empowering business users to vibe code their own solutions, replacing established vendors with such tools remains edgy business processes. As a result, SaaS isn't dying any more than on-premises software did, but CIOs are reimagining software's future as AI agents advance.

The Convergence of AIOps and Security

AI is blurring the lines between previously distinct sectors like ITSM and cybersecurity, with AI itself becoming a unifying AIOps front end to diverse, specialized technologies beneath it. ServiceNow is well-positioned for this convergence, having added the Virtual Agent chatbot system to its Now platform as far back as 2018. Subsequent acquisitions—including search outfit Element AI, chatbot company Passage AI, and AIOps pioneer Loom Systems—reinforced this direction. In 2025, these efforts crystallized into the ServiceNow AI Platform, a rebranded Now platform augmented by unifying features such as the AI Control Tower.

In traditional ITSM, the platform helps teams build workflows without coding, simplifying complex processes. AI takes this further: it becomes possible not only to generate a workflow but to reason and act on it. This makes AI and ITSM a natural combination, each enhancing the usefulness of the other. But adding automation to workflows only gets you so far, which is where the Armis acquisition becomes intriguing.

Why Armis Was the Prize

Unlike previous ServiceNow acquisitions with a cybersecurity theme—Veza in 2025, Mission Secure in 2024—Armis's agentless platform is more than an information gathering system. It can orchestrate actions such as isolation and blocking across a wide range of devices, including workstations, routers, switches, firewalls, and the long tail of often forgotten medical scanners and IoT devices. The ability to build an accurate inventory explains why ServiceNow paid an eye-watering 23 times annual revenue for Armis, according to Brad LaPorte, a former Gartner analyst who now works with Lionfish Tech Advisors.

ServiceNow didn't buy Armis to sell it as a cybersecurity sideline, LaPorte says, because its $340 million annual revenue and growth rate are too small to justify that. The limitation of today's ITSM and configuration management database (CMDB) systems is that workflows assume the CMDB is accurate when it's often a work of fiction. "Everyone reconciles to it. Nobody believes it. Every attack surface tool on the market can tell you what it found. Not one of them can tell you who is going to fix it by Friday," LaPorte says.

So, buying Armis is less about adding cybersecurity than supercharging ServiceNow's traditional ITSM workflows, which have recently been given an AI makeover. At the same time, by making its platform appealing to hospitals, utilities, and manufacturing, ServiceNow can attract customers in completely new sectors.

Shifting Customer Relationships

According to LaPorte, ServiceNow customers should be alert to the ways this changes their relationship. Customers are likely to experience Armis being heavily marketed to them at contract renewal. In theory, this is good, assuming they can refuse. But they might find that the financial engineering and incentives behind this could be complex to untangle and don't always work in their favor over the contract period. Armis will also bring ServiceNow into competition with a new set of rivals, LaPorte notes, and bring into the fold a new buyer—the CISO—it has never previously had to win over. CISOs are skeptical by nature and sensitive to the occasional security weaknesses that have affected ServiceNow itself.

"Armis was Switzerland. It integrated with everybody, including every ITSM platform that competes with ServiceNow. That neutrality was part of the product," LaPorte says. "That is gone now. This just moved everybody's negotiating position."

Several experts spoken to for this article agreed that the SaaS apocalypse idea is overblown in relation to ServiceNow. Its incumbency protects it from AI because reproducing ServiceNow's capabilities using vibe-coded AI could prove more challenging than people assume. However, there is consensus that the convergence of AIOps and cybersecurity will be highly disruptive in the ITSM sector.

Competitive Landscape and Pricing Pressures

"ServiceNow is competing with Microsoft, which can bundle, and with the model vendors, who are climbing up into the application layer," argues Lionfish Tech Advisors CEO Rob Smith, another ex-Gartner analyst. "ServiceNow's defense is not that it has a better model, which it doesn't. Its defense is that it knows the steps in your process, and that is expensive to re-create."

Chris Selland, founder of research company Differential Factor, who lectures at Northeastern University on entrepreneurship and disruption, agrees that ServiceNow's Armis acquisition looks like an important piece of a puzzle. "The Armis deal extends that map into everything that was never in the CMDB, such as IoT and medical devices. It's a defense of their asset graph," he says. And the company probably sees itself as having something to defend. "ServiceNow is in around 90% of the Fortune 500, so yes this is fundamentally a 'sell more to the base' strategy," argues Selland. "The threat was never that AI writes competing enterprise software; it's seat compression and the collapse of per-seat pricing. That threatens the SaaS industry's core revenue model," Selland contends.

ServiceNow understands this, which is why it is moving toward a consumption-based model. The question is how this will change the balance of power with customers at a time when open-source and open-weight models are driving down AI pricing and competition is fierce, including from large cloud platforms. With more players competing for business against specialists such as ServiceNow, this could give buyers a lot more leverage if they understand how to manage hidden cost traps.

"Consumption-based pricing is much better for both buyers and sellers than seat-based pricing, although it can lead to nasty surprises for buyers if they're not careful about monitoring what their employees are doing," Selland says.

What It Means for Enterprise Buyers

For businesses already using ServiceNow, the shift to consumption pricing and the integration of Armis could bring both opportunities and headaches. On one hand, consumption models can align costs more closely with actual usage, potentially benefiting organizations that use the platform efficiently. On the other hand, without careful monitoring, costs can spiral unexpectedly—especially as AI token consumption and other metered services become part of the mix.

The Armis acquisition also means that CISOs will have a new vendor to evaluate, one that promises deeper visibility into asset inventories and automated response actions. But as LaPorte notes, the neutrality that made Armis attractive to a broad range of customers is now gone, which could complicate negotiations and competitive dynamics. Enterprises should prepare for more aggressive bundling and upselling at renewal time, and they may need to sharpen their procurement strategies to avoid unfavorable terms.

Moreover, the convergence of AIOps and cybersecurity means that IT and security teams will need to collaborate more closely than ever. Tools that once operated in silos are now being unified under platforms like ServiceNow's, which could streamline operations but also create new dependencies. Organizations should assess whether consolidating on a single platform aligns with their risk management and operational resilience goals.

The Road Ahead for ServiceNow

ServiceNow's evolution reflects broader trends in enterprise software: the move away from seat-based licensing, the infusion of AI into every layer of the stack, and the blurring of lines between IT operations and security. While the "SaaS apocalypse" narrative may be overblown, the company is clearly preparing for a future where consumption and outcomes matter more than user counts. Its bet on Armis is a significant part of that strategy, aiming to extend its asset graph into areas that traditional CMDBs have long neglected.

As AI agents become more capable, the value of platforms that can orchestrate complex workflows and secure diverse environments will only grow. ServiceNow's challenge is to convince customers that it can deliver that value without locking them into inflexible contracts or hidden costs. For now, the company remains a dominant force in ITSM, but the ground beneath it is shifting. How it navigates the convergence of AI, security, and consumption pricing will determine whether it thrives in the next era of enterprise software.