Loading story…
ServiceNow has agreed to acquire cybersecurity firm Armis for $7.75 billion in cash, marking the largest deal in ServiceNow’s history. The acquisition aims to combine ServiceNow’s workflow and risk management products with Armis’ expertise in asset discovery and cyber-physical security, creating an integrated platform for real-time device visibility, risk prioritization, and automated remediation across IT, OT, IoT, and medical systems. This move is positioned as a response to the growing complexity of attack surfaces driven by increased connectivity and the adoption of AI, with the goal of delivering proactive protection and continuous security operations for enterprises.
Armis’ Centrix platform will be integrated into ServiceNow’s Vancouver release, forming an AI-powered security operations hub that unifies vulnerability management, threat detection, and compliance. The acquisition is expected to triple ServiceNow’s addressable market and enhance its offerings in critical sectors such as manufacturing and healthcare, where Armis already secures a significant portion of Fortune 100 companies. The deal, which is subject to regulatory approval and expected to close in the second half of 2026, also reflects broader market trends as ServiceNow’s stock experienced a temporary dip amid M&A scrutiny and high valuations.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Following early reports of the transaction, ServiceNow's stock fell by nearly 12%, reflecting investor scrutiny of the high-value cybersecurity acquisition.
ServiceNow said the Armis acquisition is expected to close in the second half of 2026, subject to regulatory approval. The company also indicated Armis would be integrated into its platform while continuing as a business unit during the transition.
On December 23, 2025, ServiceNow announced an agreement to buy Armis in cash for $7.75 billion, its largest acquisition to date. The deal is intended to expand ServiceNow's cybersecurity capabilities, especially in device visibility and cyber-physical security across IT, OT, IoT, and medical systems.
Before the acquisition announcement, Armis completed a $435 million funding round that valued the company at $6.1 billion, underscoring investor interest as it weighed future strategic options.
Armis was founded in 2015 and built a business around agentless asset visibility and security for unmanaged devices across IT, OT, IoT, and medical environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcethecyberthrone.in
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ServiceNow is reportedly in advanced negotiations to acquire Veza, an identity security startup, for over $1 billion. The potential acquisition aims to address a critical need for unified control over AI agents and the data they access within enterprise environments. Veza’s technology specializes in mapping permissions across various enterprise systems, providing visibility into which users, applications, and AI agents have access to specific data, thereby strengthening governance and security for non-human identities. This move follows ServiceNow’s earlier $2.85 billion acquisition of Moveworks, which added AI assistants and enterprise search capabilities to its platform. By integrating Veza, ServiceNow seeks to provide a robust identity security layer to govern the expanding use of AI agents across IT, HR, customer service, and security operations. The acquisition is expected to help enterprises ensure that AI agents’ permissions align with security policies, mitigating risks associated with autonomous machine actions in business processes.
Jun 29, 2026
Palo Alto Networks has acquired Console, an AI-native platform that lets organizations create agentic workflows through natural-language instructions. The company plans to integrate Console into its Cortex security-operations platform, enabling agents to investigate alerts, enrich and correlate events, prioritize cases, coordinate with enterprise data sources, isolate endpoints, and execute remediation across security and IT environments. Financial terms were not disclosed. The acquisition is intended to move Cortex beyond analyst-facing recommendations toward governed autonomous operations. Palo Alto Networks said such deployments require restricted system access, comprehensive activity logging, approvals for high-impact actions, and safeguards against inaccurate or unauthorized agent behavior. The announcement accompanied the company’s fiscal fourth-quarter 2026 results, which reported $3.41 billion in revenue and nearly $1 billion in net new next-generation security ARR; the timing and success of Console integration remain uncertain.
Sep 3, 2026
Palo Alto Networks initiated discussions to acquire CyberArk, marking the second-largest deal in cybersecurity history. The initial outreach from Palo Alto Networks CEO Nikesh Arora to CyberArk founder and chairman Udi Mokady occurred in May 2023, but CyberArk initially declined, preferring to remain independent. After a two-year pause, Arora renewed acquisition interest in June 2025, leading to an in-person meeting between the two companies' leadership on June 17, 2025. Both firms entered into a mutual nondisclosure agreement on June 25, 2025, to facilitate confidential negotiations. On July 1, 2025, Palo Alto Networks submitted a non-binding letter of interest, proposing an all-stock acquisition of CyberArk at $457.99 per share. The CyberArk board evaluated the offer, considering the strategic benefits of merging with Palo Alto Networks compared to other potential acquirers. The deal nearly collapsed at the last minute, but both companies accelerated their announcement timeline due to media leaks. The acquisition, valued at $25 billion, is set for a shareholder vote on November 13, 2025. The transaction is expected to reshape the cybersecurity landscape by combining Palo Alto Networks' strengths in network security and cloud security with CyberArk's expertise in privileged access management. The deal reflects ongoing consolidation in the cybersecurity sector, driven by the need for integrated security solutions amid evolving threats. Both companies have significant portfolios in artificial intelligence, machine learning, and network access control, which are anticipated to be leveraged post-acquisition. The acquisition process involved careful due diligence and strategic planning to ensure alignment of business objectives. The announcement has generated significant attention due to the size of the deal and the prominence of both companies in the cybersecurity industry. Shareholders and industry analysts are closely monitoring the outcome of the upcoming vote. The deal underscores the increasing value placed on identity and access management as a core component of enterprise security. If approved, the acquisition will position Palo Alto Networks as a dominant player in the cybersecurity market, with expanded capabilities across cloud, network, and identity security domains. The transaction is also expected to drive further innovation and integration of security technologies to address complex enterprise needs.
Jun 29, 2026