How AI and cybersecurity are reshaping ServiceNow

The once stable era of IT service management (ITSM) has entered a period of disruption and uncertainty. At least if you’re an investor or enterprise customer with an interest in ITSM giant ServiceNow, the signals over recent months have been hard to ignore.

Last year, the category leader delivered market-pleasing AI announcements, a record share price, and good quarterly revenue growth, as well as an interesting pivot toward cybersecurity with the December acquisition of partner Armis for $7.75 billion in cash.

But as the calendar turned to 2026, the phrase “Saas apocalypse” started to gain traction, and market sentiment about SaaS incumbents suddenly melted away, causing ServiceNow’s share price to drop 30% by mid-2026, albeit from historic highs.

What’s driving anxiety is the perception that AI agents and vibe-coding tools will soon took over many of the previously complex workflow, automation, and software tasks carried out traditionally by subscription platforms, including ServiceNow’s. Customers will stop buying SaaS subscriptions because they won’t need employees or “seats” to do this work. Instead, cheaper internal AI tools, or larger cloud platforms doing the same job, will simply automate the market away.

While some enterprise IT leaders are in fact empowering business users to vibe code their own solutions, the model for replacing vendors with vibe-coded apps remains edgy business. As a result, SaaS isn’t likely dying any more than on-premises software, though CIOs are still reimagining software’s future as AI agents advance.

So too is ServiceNow, including how it expects IT leaders to finance that future. The company’s June Financial Analyst Day 2026 presentation confirmed a shift away from subscriptions based on seats is already under way, with only 50% of the company’s Net New Annual Contract Value (SaaS jargon for new revenue) in 2025 coming from this source. Instead, growth is increasingly generated by “consumed” services such as infrastructure, integrations and connectors, AI token consumption, and cybersecurity.

AI convergence

AI is causing previously distinct sectors such as ITSM and cybersecurity to converge, with AI itself turning into a unifying AIOps front end to diverse, specialized technologies sitting below it. In this, ServiceNow looks well-placed, having added the Virtual Agent chatbot system to its Now platform as long ago as 2018, later reinforced by acquisitions, including search outfit Element AI, chatbot company Passage AI, and AIOps pioneer Loom Systems. In 2025, this evolution crystalized as the ServiceNow AI Platform, a rebranded Now platform augmented by unifying features such as the AI Control Tower.

In traditional ITSM, the platform helps teams build workflows without the need for coding in a way that simplifies complex processes. AI takes this a step further; now it becomes possible not only to generate a workflow but reason and act on it. In this, AI and ITSM look like a natural combination as each enhances the usefulness of the other.

But building a better AI front end or adding automation to workflows gets you only so far, which makes the company’s Armis acquisition, its largest ever, intriguing. Unlike previous ServiceNow acquisitions with a cybersecurity theme — Veza in 2025, Mission Secure in 2024 — Armis’s agentless platform is more than an information gathering system. It can also orchestrate actions such as isolation and blocking across a wide range of devices, including workstations, routers, switches, firewalls, and the long tail of often forgotten medical scanners and IoT devices.

Nevertheless, it is the ability to build an accurate inventory that explains why the acquisition happened at an eye-watering 23 times annual revenue, says Brad LaPorte, a former Gartner analyst who now works with Lionfish Tech Advisors. ServiceNow didn’t buy Armis to sell it as a cybersecurity sideline because its $340 million annual revenue and annual growth rate are too small to justify that.

“Nobody pays 23 times revenue for a product. They pay for a position. That single financial fact explains most of what customers are about to experience, good and bad,” says LaPorte. The limitation of today’s ITSM and configuration management database (CMDB) systems is that workflows assume the CMDB is accurate when it’s often a work of fiction.

“Everyone reconciles to it. Nobody believes it. Every attack surface tool on the market can tell you what it found. Not one of them can tell you who is going to fix it by Friday,” LaPorte says.

So, buying Armis is less about adding cybersecurity than supercharging the company’s traditional ITSM workflows, which have recently been given an AI makeover. At the same time, by making its platform appealing to hospitals, utilities, and manufacturing, ServiceNow can attract customers in completely new sectors.

According to LaPorte, ServiceNow customers should be alert to the ways this changes their relationship. Customers are likely to experience Armis being heavily marketed to them at contract renewal. In theory, this is good, assuming they can refuse. But they might find that the financial engineering and incentives behind this could be complex to untangle and don’t always work in their favor over the contract period.

Armis will also bring ServiceNow into competition with a new set of rivals, LaPorte notes, and bring into the fold a new buyer, the CISO, it has never previously had to win over. CISOs are skeptical by nature as well as sensitive to the occasional security weaknesses that have affected ServiceNow itself.

“Armis was Switzerland. It integrated with everybody, including every ITSM platform that competes with ServiceNow. That neutrality was part of the product,” LaPorte says. “That is gone now. This just moved everybody’s negotiating position.”

Consumption pricing

Several experts spoken to for this article agreed that the SaaS apocalypse idea is overblown in relation to ServiceNow. Its incumbency protects it from AI because reproducing ServiceNow’s capabilities using vibe-coded AI could prove more challenging than people assume. However, there is consensus that the convergence of AIOps and cybersecurity will be highly disruptive in the ITSM sector.

“ServiceNow is competing with Microsoft, which can bundle, and with the model vendors, who are climbing up into the application layer,” argues Lionfish Tech Advisors CEO Rob Smith, another ex-Gartner analyst. “ServiceNow’s defense is not that it has a better model, which it doesn’t. Its defense is that it knows the steps in your process, and that is expensive to re-create.”

Chris Selland, founder of research company Differential Factor, who lectures at Northeastern University on entrepreneurship and disruption (and has written on SaaS for CIO.com), agrees that ServiceNow’s Armis acquisition looks like an important piece of a puzzle.

“The Armis deal extends that map into everything that was never in the CMDB, such as IoT and medical devices. It’s a defense of their asset graph,” he says. And the company probably sees itself as having something to defend. “ServiceNow is in around 90% of the Fortune 500, so yes this is fundamentally a ‘sell more to the base’ strategy,” argues Selland.

“The threat was never that AI writes competing enterprise software; it’s seat compression and the collapse of per-seat pricing. That threatens the SaaS industry’s core revenue model,” Selland contends.

ServiceNow understands this, which is why it is moving toward a consumption-based model. The question is how this will change the balance of power with customers at a time when open-source and open-weight models are driving down AI pricing and competition is fierce, including from large cloud platforms.

With more players competing for business against specialists such as ServiceNow, this could give buyers a lot more leverage if they understand how to manage hidden cost traps.

“Consumption-based pricing is much better for both buyers and sellers than seat-based pricing, although it can lead to nasty surprises for buyers if they’re not careful about monitoring what their employees are doing,” Selland says.