Armis Security

1.1 Corporate Identity, Platform Architecture, and Business Model

Armis Security operates as an enterprise cybersecurity provider specializing in cyber exposure management, asset intelligence, and cyber-physical systems (CPS) protection [CO001]. Founded in December 2015 by Yevgeny Dibrov (Chief Executive Officer) and Nadir Izrael (Chief Technology Officer) following their military service in the Israel Defense Forces' intelligence division Unit 81, the company maintains corporate operations in San Francisco, California, alongside research and development operations centered in Tel Aviv-Yafo, Israel [CO002]. Armis was incorporated to address a structural vulnerability in corporate networks: the proliferation of unmanaged, agentless connected devices spanning operational technology (OT), industrial control systems (ICS), Internet of Things (IoT), and Internet of Medical Things (IoMT) that cannot support traditional endpoint security agents [CO003]. The company monetizes through enterprise software subscriptions for its core platform, Armis Centrix, supplemented by specialized modules including asset vulnerability management, OT/ICS security, and prioritization intelligence [CO004]. Its architectural foundation combines out-of-band network traffic inspection with integrations across cloud providers, identity stores, and security operations platforms, anchoring device context against an engine tracking over 1 billion historical asset profiles [CO005]. As the company scaled, its strategic scope transitioned from passive network visibility to active cyber exposure management and automated remediation orchestration [CO004].

1.2 Leadership Structure, Strategic Expansion, and Operational Governance

Armis is led by co-founders Yevgeny Dibrov and Nadir Izrael, whose long-standing technical and commercial partnership forms the core governance axis of the enterprise [CO002]. Operating with an engineering and corporate workforce exceeding 750 to 900 employees globally, the organization has supplemented organic growth with targeted technology acquisitions, notably absorbing vulnerability prioritization vendor Silk and critical infrastructure specialist OTORIO [CO002, CO006]. The technical architecture relies on large-scale distributed data processing pipelines using cloud data services such as Amazon Web Services (AWS ECS, S3, SQS) and distributed frameworks to analyze high-volume telemetry collected from distributed enterprise networks [CO007]. Operational governance centers on maintaining rigorous compliance and incident preparedness across customer environments, aligning platform telemetry with industry frameworks such as CIS Control 17 and enterprise incident response controls [CO008]. However, the organization faces key-person dependence on its founding executive pair, and technical integration requirements across acquired product suites introduce operational friction as Armis aligns with ServiceNow's enterprise platform governance following the announced acquisition transaction [CO002, CO009].

1.3 Financing History, Valuation Trajectory, and Market Milestones

Armis followed an aggressive institutional capitalization trajectory prior to its acquisition by ServiceNow, raising a cumulative total of $1.17 billion across institutional equity rounds [CO002]. After reaching an interim private valuation of $3.4 billion in November 2021 and $4.3 billion in October 2024 via a $200 million private financing round, the company secured a $435 million pre-IPO financing round in November 2025 led by Goldman Sachs Alternatives with participation from CapitalG and Evolution Equity Partners, which priced the business at over $6.1 billion [CO006, CO010]. Top-line financial scale advanced rapidly, surpassing $200 million in annual recurring revenue by late 2024 with public targets targeting $500 million in ARR by 2026 [CO006]. The commercial footprint expanded across Fortune 500 enterprises, securing major logos including Colgate-Palmolive, United Airlines, and Mondelēz International, alongside formal recognition by Gartner as a Leader in CPS Protection Platforms for two consecutive years through 2026 [CO006, CO011]. In late 2025, enterprise workflow software vendor ServiceNow announced a definitive agreement to acquire Armis, establishing an exit valuation benchmark for the exposure management category [CO002, CO012].

1.4 Exhibits

2.1 Market Boundary, Scope, and Structural Convergence

The market for enterprise cyber asset security has undergone structural redefinition, expanding from isolated network visibility tools into comprehensive Cyber Exposure Management (CEM) and Cyber-Physical Systems (CPS) protection platforms. Historically, enterprise vulnerability scanners and Endpoint Detection and Response (EDR) agents secured managed corporate IT environments comprising workstations and servers. However, industrial control systems, medical technology, and connected building infrastructure cannot accommodate intrusive software agents without risking catastrophic physical disruption or operational downtime. Armis estimates that approximately 90% of devices in industrial and critical infrastructure networks remain unmanaged, operating without standard host monitoring agents. The addressable domain encompasses connected devices across enterprise IT, operational technology (OT) including programmable logic controllers (PLCs) and human-machine interfaces (HMIs), medical Internet of Things (IoMT) diagnostic systems, and commercial Internet of Things (IoT). Spend within this category is captured by specialized asset intelligence platforms capable of passive, out-of-band network traffic inspection, wireless airspace analysis, and multi-source API telemetry ingestion. The scope explicitly excludes traditional endpoint agent licensing, standard vulnerability management scanning suites that rely on intrusive probing, and dedicated physical perimeter access control hardware. Status-quo substitutes have historically relied on manual spreadsheets, basic Network Access Control (NAC) authentication databases, passive network tap sniffers, and legacy configuration management databases (CMDBs). These legacy approaches fail because NAC solutions verify initial network admission without continuous behavioral inspection, while manual CMDBs rapidly decay into stale repositories. By establishing passive discovery and behavioral context across IT, OT, and IoT, the sector transforms asset visibility from an audit inventory checklist into an active threat-prevention and exposure-prioritization layer. [CM001, CM002, CM004, CM006, CM008, CM010]

2.2 Sizing Slices, Growth Vectors, and Sizing Discrepancies

Evaluating the total market opportunity requires analyzing concentric addressable boundaries rather than relying on a single top-down macroeconomic figure. At the broadest macroeconomic layer, worldwide end-user spending on information security is projected by Gartner to expand by 12.5% in 2026 to reach $240 billion, propelled by escalating threat volumes and enterprise-wide artificial intelligence adoption. Within this comprehensive budget, enterprise cybersecurity asset management and cyber-physical security form a critical high-growth subsector. Independent forecasts from industry trackers indicate that global IoT connections expanded from 10.3 billion in 2018 to nearly 25 billion by 2025, with smart manufacturing emerging as the fastest-accelerating operational segment. As enterprise networks absorb billions of connected endpoints, cyber exposure management shifts from an optional discretionary tool to mandatory foundational infrastructure. Market expansion is accelerated by three primary tailwinds: the total dissolution of historical IT/OT air gaps, escalating nation-state ransomware targeting physical infrastructure, and compliance requirements under frameworks like CIS Control 1 (inventory and control of enterprise assets) and CIS Control 2 (software asset management). Concurrently, commercial traction has generated significant corporate valuation inflection points. Armis achieved an annualized recurring revenue (ARR) run rate exceeding $200 million by late 2024, doubled ARR over an 18-month trajectory, and surpassed $340 million in ARR prior to its definitive acquisition agreement with ServiceNow for $7.75 billion in cash. ServiceNow indicated that incorporating Armis is projected to more than triple ServiceNow's total addressable market opportunity for security and risk solutions. Nevertheless, substantive sizing discrepancies persist across independent research providers: market trackers disagree significantly on standalone CPS market boundaries, frequently conflating software asset visibility licensing with broader network firewall appliances, IT service management suites, and outsourced managed security operations. [CM002, CM003, CM005, CM007, CM009, CM011, CM012]

2.3 Buyer Personas, Procurement Workflows, and Adoption Friction

Procurement dynamics for cyber exposure management involve complex cross-functional buying centers spanning Chief Information Security Officers (CISOs), Vice Presidents of Infrastructure, Plant Operations Directors, and Clinical Engineering Leads. In enterprise IT environments, budget ownership resides firmly with the CISO or Security Operations Center (SOC) director, where procurement is initiated to eliminate asset inventory blind spots and satisfy regulatory audit mandates. In contrast, operational technology (OT) and industrial manufacturing environments introduce operational friction: Plant Managers and Chief Operating Officers maintain primary authority over factory floor uptime and traditionally resist software deployments that touch operational networks due to fears of production line stoppages. Similarly, healthcare organizations divide authority between IT security teams and Biomedical Engineering departments responsible for patient-connected IoMT devices. Adoption trajectories typically proceed through three sequential phases: initial frictionless proof-of-concept deployments via passive network monitoring and API connectors, organization-wide asset inventory reconciliation against CMDB records, and final integration with automated security orchestration, automation, and response (SOAR) or ticketing workflows. Despite rapid sales acceleration, significant constraints impede deployment velocities. Enterprise security buyers face organizational friction between IT and OT teams regarding budget attribution, high switching costs associated with replacing entrenched network management appliances, and technical friction around ingesting multi-vendor telemetry across complex hybrid architectures. Furthermore, buyers must evaluate platform resilience against software supply chain attacks and firmware vulnerabilities, requiring vendors to maintain rigorous third-party trust certifications and transparent vulnerability disclosures across all appliance hardware. [CM001, CM004, CM006, CM008, CM010, CM013, CM014]

2.4 Exhibits

3.1 Competitive Landscape and Scale

The available evidence places Armis across several overlapping competitive arenas rather than in one clean peer set. Its platform description spans IT, operational technology, IoT, and medical devices, so buyers can compare it with specialized cyber-physical security products, vulnerability-management suites, network-security platforms, enterprise workflow incumbents, internal integration projects, or the status quo of fragmented inventories. The assigned evidence names Cisco, Palo Alto Networks, Microsoft, Tanium, Fortinet, Google, and ServiceNow as integration counterparts, but it does not provide a reliable, current list of direct specialized peers or comparable win-rate data. Scale is clearer than peer ranking: ServiceNow reported more than $340 million of Armis ARR and approximately 950 employees in its acquisition announcement, while Startup Nation Central lists $1.17 billion raised across nine rounds. Those figures indicate commercial weight, not proof that Armis outperforms alternatives.[CP001, CP003, CP007, CP008, CP009]

3.2 Capability, Distribution, and Partner Power

Armis's most evidenced differentiation is architectural breadth combined with partner-enabled action. ServiceNow describes real-time, agentless discovery and classification of managed and unmanaged assets, while Armis says its passive approach requires no hardware installation, network changes, or intrusive probes. The Fortinet solution brief corroborates a complementary operating model: Armis contributes asset context and risk detection, and Fortinet infrastructure supplies segmentation and enforcement. This can lower deployment friction in fragile environments, but it also means that important remediation outcomes depend on incumbent control points. The integration catalog shows multi-homing across major ecosystems rather than exclusive distribution. That breadth can increase switching costs through accumulated inventory context and workflow configuration, yet the assigned sources do not quantify retention, implementation time, migration cost, or the share of customers using each integration.[CP002, CP003, CP004, CP012, CP015]

3.3 Pricing, Packaging, and Switching Economics

None of the assigned sources discloses an Armis list price, realized contract value, discount schedule, consumption unit, or directly comparable competitor quote. The defensible conclusion is therefore that pricing remains a diligence gap, not that Armis commands a particular premium. Packaging may also change as ServiceNow integrates the product: the acquisition announcement describes a future unified exposure-and-operations stack, but does not specify whether Armis remains separately sold, becomes a ServiceNow module, or is bundled with broader workflows. Internal build remains a substitute where buyers already own network telemetry, a CMDB, ticketing, and enforcement tools, although the evidence does not quantify the engineering burden. Buyers should test whether Armis reduces tool count or instead adds an intelligence layer whose value depends on maintaining several incumbent integrations.[CP003, CP004, CP005, CP015]

3.4 Moat Durability and Displacement Risk

ServiceNow's proposed ownership changes the basis of competition. The announced strategy connects Armis discovery and risk prioritization to ServiceNow remediation workflows, potentially giving Armis stronger enterprise distribution and a shorter path from finding an exposure to assigning corrective action. At the same time, ServiceNow itself disclosed risks from delayed technology integration, employee retention, legacy liabilities, management distraction, and unanticipated obligations. Armis-originated hiring evidence also points toward expansion into vulnerability assessment and VMDR, increasing overlap with established security suites rather than narrowing the field. The moat thesis therefore depends on whether cross-environment asset intelligence remains differentiated after integration and whether non-ServiceNow customers continue to view the platform as neutral. No independent benchmark in the assigned pool validates comparative detection accuracy, false-positive rates, or switching outcomes.[CP005, CP006, CP014, CP016]

3.5 Exhibits

4.1 Revenue Streams and Monetization Mechanics

Armis monetizes its cyber exposure management platform through multi-year annual recurring software subscriptions for its flagship Armis Centrix platform. Revenue is driven by subscription licensing scaled across connected device volumes, enterprise environments, and specialized functional modules including Asset Vulnerability Management (AVM), OT/IoT security, and Prioritization and Remediation (VIPR Pro). Armis bundles continuous threat intelligence feeds and device knowledgebase access—tracking billions of asset profiles—into platform licensing. While list pricing is not publicly published, secondary market and enterprise procurement benchmarks indicate multi-tier enterprise contracts spanning six- to seven-figure annual contract values (ACV) for Fortune 500 and Global 2000 deployments. Official technical integration surfaces confirm deep operational ties to enterprise workflow systems like ServiceNow, Google Chronicle, and Fortinet Security Fabric, which drive account expansion and multi-year renewals.[CI001, CI002, CI003, CI007]

4.2 Public Traction Versus Private Unit Economics

Armis demonstrated rapid commercial scale, surpassing $200 million in ARR in 2024 and exceeding $340 million in ARR prior to its late-2025 acquisition announcement, reflecting sustained year-over-year ARR growth of more than 50%. The company's go-to-market motion targets enterprise cybersecurity and critical infrastructure buyers, successfully securing over 35% of the Fortune 100 and 7 of the Fortune 10 along with enterprise logos such as Colgate-Palmolive, United Airlines, and Mondelēz International. However, crucial SaaS efficiency indicators—specifically Net Revenue Retention (NRR), Gross Revenue Retention (GRR), Customer Acquisition Cost (CAC) payback periods, and exact customer counts—remain undisclosed private metrics. Secondary pre-IPO platforms and private indices tracked employee counts growing from 750 to approximately 950 personnel, implying strong ARR per employee exceeding $350k, but statutory gross margin percentages and GAAP net operating losses were never independently audited or published.[CI004, CI005, CI006, CI011, CI012, CI013]

4.3 Capital Adequacy, Valuation Trajectory, and Diligence Blockers

Prior to its acquisition agreement, Armis raised approximately $1.17 billion across nine private financing rounds, including a $200 million round in late 2024 at a $4.3 billion valuation and a $435 million pre-IPO growth round in late 2025 led by Goldman Sachs Alternatives valuing the company at over $6.1 billion. In December 2025, ServiceNow entered into a definitive agreement to acquire Armis for approximately $7.75 billion in cash, representing an acquisition multiple of roughly 22.8x trailing ARR. Because the acquisition agreement provides complete liquidity for private equity and venture shareholders, traditional standalone venture cash runway and follow-on private fundraising risks are superseded by transaction close conditions and regulatory approvals. The primary diligence blockers are operational and integration-related: gross margin resilience, Cloud/AI telemetry infrastructure cost scalability, and key technical executive retention across the Palo Alto and Tel Aviv engineering hubs.[CI008, CI009, CI010, CI014, CI015]

4.4 Exhibits

5.1 Core Architecture and Data Ingestion Pipeline

Armis operates an agentless cyber exposure management architecture engineered to provide continuous, real-time asset visibility and behavioral monitoring across enterprise infrastructure, operational technology (OT), industrial control systems (ICS), the Internet of Medical Things (IoMT), and unmanaged IoT devices. Unlike traditional endpoint detection and response platforms that require invasive software agents or active network scanners that risk disrupting sensitive clinical instrumentation and legacy manufacturing equipment, Armis deploys a combination of physical hardware appliances and virtual collector instances connected directly to core network switches. These collectors passively ingest mirrored traffic via Switch Port Analyzer (SPAN) ports, analyzing raw packet streams without transmitting active probes into production environments. Collected metadata and extracted network events are transmitted to the cloud-hosted Armis Collective Asset Intelligence Engine, which correlates real-time device behaviors against an accumulated knowledge base tracking billions of connected assets. Operational telemetry is retained in the cloud platform for a rolling 90-day window to facilitate longitudinal behavior analysis and incident forensics, while discovered asset inventory records persist indefinitely to ensure uninterrupted posture governance. The backend SaaS architecture is built natively on Amazon Web Services (AWS) utilizing Kubernetes orchestration, Linux runtime environments, and Terraform infrastructure-as-code automation to support multi-site enterprise scale.[CE001, CE002, CE003, CE011, CE013]

5.2 Armis Centrix Platform Modules and Asset Intelligence

The flagship Armis Centrix Cyber Exposure Management Platform aggregates distributed device telemetry into modular security and operational capabilities tailored for enterprise risk teams. At the foundation of the platform lies the Armis AI-driven Asset Intelligence Engine, which ingests anomalous traffic signatures and configuration attributes from network collectors and matches them against known device fingerprints, vendor hardware profiles, and historical behavioral baselines. Users navigate the resulting enterprise asset inventory through the Armis Standard Query (ASQ) interface, a visual administrative console that allows security analysts to construct granular filters, isolate unmanaged device cohorts, and inspect communication pathways without requiring complex query syntax. To address the specialized operational and cybersecurity needs of heavy industrial infrastructure, Armis expanded its core exposure management suite through the strategic acquisition of OTORIO in March 2025. This addition bolstered Centrix with dedicated industrial control system risk modeling, operational process visibility, and automated vulnerability management designed specifically for manufacturing facilities, energy grids, and critical utility networks that operate under strict zero-downtime constraints.[CE001, CE003, CE006, CE012]

5.3 Ecosystem Integrations and Automated Enforcement

Because Armis operates without native endpoint agents, automated threat containment and policy enforcement rely heavily on bi-directional integrations across the broader cybersecurity and enterprise IT ecosystem. The platform provides pre-built adapters and API connectors to leading infrastructure providers, including next-generation firewalls, SIEM platforms, and enterprise service management systems. Through its integration with Fortinet FortiGate appliances and FortiManager, Armis dynamically pushes risk context and updated security policies to network firewalls, allowing security teams to enforce quarantine controls, restrict access to sensitive subnets, or apply elevated intrusion detection policies to compromised endpoints in real time. For telemetry correlation and threat hunting, Armis integrates with Google Chronicle to parse and transform asset alerts, activity records, and vulnerability findings into standardized Unified Data Model (UDM) events. Furthermore, in May 2026, ServiceNow announced Autonomous Security and Risk, embedding Armis real-time device intelligence directly into the ServiceNow CMDB and incident response workflows to govern connected assets and AI agents at machine speed. For service provider partners, Armis expanded the APEX Manage Program with a dedicated multi-tenant workbench to streamline client lifecycle administration.[CE007, CE008, CE009, CE010]

5.4 Vertical Capabilities, OT Protocol Depth, and Technical Risks

Armis tailors its passive analysis capabilities to distinct industry verticals where endpoint software cannot be deployed, specifically healthcare clinical environments and operational technology networks. In hospital settings, Armis ingests Manufacturer Disclosure Statement for Medical Device Security (MDS2) files from medical equipment manufacturers and correlates active firmware configurations against published FDA device recall databases, enabling clinical engineering teams to identify vulnerable infusion pumps and diagnostic scanners without interrupting patient care. In manufacturing and industrial automation networks, the platform capitalizes on the prevalence of unencrypted legacy industrial protocols to inspect packet payloads directly, monitoring write commands dispatched to Programmable Logic Controllers (PLCs) to detect unauthorized configuration changes or lateral threat movement. However, deep on-premises OT inspection across proprietary industrial protocols and isolated air-gapped segments presents ongoing diligence questions. While passive SPAN monitoring surfaces anomalous communications, decoding vendor-proprietary PLC control code historically required specialized on-site industrial appliances, which precipitated the acquisition of OTORIO to bridge operational technology coverage gaps.[CE004, CE005, CE006, CE014]

5.5 Exhibits

6.1 Enterprise Customer Base Segmentation

Armis Security focuses on Global 2000 enterprises, national healthcare systems, critical infrastructure operators, and federal defense agencies that require unified, agentless asset intelligence across heterogeneous environments. Analysis of technographic data reveals a highly concentrated presence in large-scale organizations: over 27% of verified deployments operate within enterprises exceeding 10,000 employees, spanning manufacturing, healthcare, technology, and financial services. Key economic buyers include Chief Information Security Officers (CISOs), Chief Information Officers (CIOs), and VP-level Operational Technology (OT) security directors who must comply with stringent regulatory frameworks such as NIST CSF, NIS2, and HIPAA. While Armis holds a leading position in agentless device exposure management, its customer footprint remains anchored in North America (representing 68.2% of verified accounts), creating substantial geographical expansion potential alongside vulnerability to regional procurement cycles.[CU001, CU002, CU003]

6.2 Adoption Trajectory & Operational Economic Impact

Armis Centrix operates as an agentless exposure management and asset intelligence platform tracking over 3 billion connected devices globally. Rigorous economic impact assessment conducted by technology research firm Omdia indicates that enterprise deployments deliver an average annual return on investment (ROI) of 351%, driven by a 61% improvement in security team operational efficiency. Enterprise customers report identifying 3X more network assets than previously cataloged, with automated prioritization eliminating up to 98% of vulnerability alert backlogs. Furthermore, mean time to resolution (MTTR) for critical exposures drops by 90%, and patch cycle durations decline by 59%. These substantial quantifiable efficiency gains translate directly into hard cost savings, including 10% to 15% reductions in software licensing overhead through unused capacity reclamation and a 25% decrease in cyber insurance premiums resulting from verifiable control audits.[CU004, CU005, CU006, CU007, CU008]

6.3 Named Customer Proof & Production Deployments

Armis demonstrates validated enterprise adoption across Fortune 500 conglomerates, multinational industrial manufacturers, healthcare providers, and high-volume logistics networks. Public customer deployments include United Airlines, Colgate-Palmolive, Mondelēz International, DocuSign, Allegro MicroSystems, and Takeda Pharmaceuticals. In industrial and manufacturing settings, customers leverage Armis Centrix alongside deep operational technology integrations—such as Fortinet FortiGate firewalls and Cisco infrastructure—to detect behavioral anomalies without interrupting live production lines. In healthcare and public sector environments, organizations such as the Los Angeles County Department of Health Services deploy Armis to inventory IoMT medical devices and enforce real-time zero-trust segmentation. Production case studies highlight rapid time-to-value, with organizations uncovering multi-year audit backlogs and achieving comprehensive network visibility within weeks of sensor deployment.[CU009, CU010, CU011, CU012]

6.4 Platform Integration, Expansion & Concentration Dynamics

The strategic trajectory of Armis underwent a structural transformation with its $7.75 billion acquisition by ServiceNow, closed in April 2026. Rather than functioning as a standalone point solution, Armis Centrix has been designated as the foundational asset intelligence engine powering ServiceNow's newly launched Autonomous Security & Risk suite. This integration directly connects Armis's real-time telemetry across IT, OT, IoT, and AI agent identities into the ServiceNow CMDB and Security Incident Response workflows. ServiceNow's security and risk business reached $1 billion in annual contract value (ACV) prior to the transaction, providing an expansive cross-sell channel across thousands of joint global enterprises. However, critical subscription durability metrics—specifically Net Revenue Retention (NRR) and Gross Revenue Retention (GRR)—have never been publicly disclosed by Armis or ServiceNow. This lack of transparency conceals underlying churn dynamics and creates integration friction risks if legacy customers resist forced bundling into the broader ServiceNow platform.[CU013, CU014, CU015, CU016]

6.5 Exhibits

7.1 Regulatory and legal exposure is broad but only partially evidenced

Armis markets coverage across operational technology, medical devices, government, financial services, and critical infrastructure, where a missed asset or delayed alert can carry operational, privacy, and safety consequences beyond ordinary enterprise software. Its legal hub identifies platform terms, a support SLA, a data processing addendum, a subprocessor list, an information security disclosure, a vulnerability disclosure policy, a bug bounty program, and security advisories. That is evidence of a formal compliance surface, not proof of the underlying control design, certification scope, contractual remedies, or absence of enforcement. The assigned pool contains no regulator or court record and no underlying policy text, so legal exposure must be treated as partially mapped rather than cleared.[CR001, CR002, CR006, CR007, CR015]

7.2 Data fidelity and service continuity are the central operating risks

The product's value proposition depends on continuously reconciling telemetry across heterogeneous environments. One company-issued financial-services case study describes data flowing from about twelve sources and previously conflicting inventories; Armis's integration catalog separately describes transfers of alerts, activities, device records, vulnerabilities, and user information into or from third-party systems. This breadth improves coverage but creates failure modes in API compatibility, permissions, normalization, stale records, duplicate identities, and customer-side configuration. The same evidence does not quantify false positives, false negatives, latency, uptime, recovery objectives, or model validation. Those missing measures prevent a conclusion that the mitigation is mature enough for safety-sensitive or mission-critical deployments.[CR003, CR004, CR005, CR013, CR014]

7.3 ServiceNow ownership concentrates both upside and execution risk

Armis's current homepage states that ServiceNow completed the acquisition, while Startup Nation Central records the prior company as acquired and reports a $7.75 billion exit. Existing Armis materials already describe multiple ServiceNow data and incident-workflow integrations. The combination can shorten distribution and workflow integration, but it also concentrates roadmap, packaging, migration, identity, and go-to-market decisions in the parent. The pool contains no integration milestones, retention commitments, product sunset policy, customer migration schedule, or quantified partner concentration. Investors should therefore monitor continuity of the Centrix roadmap and third-party adapters rather than treating strategic fit as evidence that execution risk has disappeared.[CR004, CR005, CR008, CR009, CR016]

7.4 Financial opacity shifts the decision toward monitored diligence

Independent secondary sources document a November 2025 $435 million financing at a valuation above $6.1 billion and an earlier 2024 valuation of $4.3 billion, but funding raised is not cash available and valuation is not operating performance. The pool does not provide gross margin, accounting profit or loss, cash flow, burn, runway, retention, customer concentration, or post-close segment economics. The investment implication is not a precise downside estimate; it is a set of proof thresholds. Thesis-break signals include material deterioration in detection quality or service availability, forced customer migrations without equivalent controls, loss of critical adapters, undisclosed regulatory action, or failure to produce auditable retention and unit-economics data during diligence.[CR010, CR011, CR012, CR015, CR016]

7.5 Exhibits

8.1 Investment Thesis, Stance, and Recommendation Framework

The core investment thesis for Armis Security rests on its proven category leadership in cyber exposure management and agentless device intelligence. Across enterprise IT, operational technology (OT), medical equipment (IoMT), and industrial control systems, unmanaged endpoints represent an expanding attack surface that legacy endpoint detection and response (EDR) agents cannot directly protect. By deploying passive network monitoring and an asset knowledgebase tracking over 3 billion device profiles, Armis achieved critical scale with over 35% of the Fortune 100 as enterprise customers, growing annual recurring revenue to over $340 million at a 50%+ year-over-year rate. Conversely, the anti-thesis centers on extreme valuation multiples, unverified gross margin economics, and significant integration friction. With ServiceNow agreeing to acquire Armis for $7.75 billion in cash, the standalone venture upside is capped and converted into enterprise execution risk within ServiceNow's broader IT service and security workflow portfolio. We assign an overall recommendation of track with medium confidence, a medium risk rating, and a fair valuation stance, reflecting that the transaction price accurately captures strategic workflow synergies while leaving unresolved private financial questions regarding net retention and gross margin resilience.[CV001, CV002, CV003, CV004, CV011, CV012]

8.2 Capital Formation, Historical Rounds, and Acquisition Discipline

Armis demonstrated an unusual financing trajectory marked by two separate controlling or strategic acquisition milestones alongside growth equity syndicates. Following its founding in late 2015 by Yevgeny Dibrov and Nadir Izrael, the company raised $116 million across early rounds before Insight Partners acquired the business in January 2020 at a $1.1 billion valuation, with CapitalG contributing $100 million. Rather than folding into a private equity holding vehicle, Armis retained independent management and continued raising institutional growth equity, completing a $300 million round led by One Equity Partners at $3.4 billion in 2021 and a $200 million Series D led by Alkeon Capital and General Catalyst at $4.2 billion in October 2024. In November 2025, Armis secured a $435 million pre-IPO financing led by Goldman Sachs Alternatives valuing the company at over $6.1 billion, before ServiceNow entered into a definitive $7.75 billion cash acquisition agreement in December 2025. Lifetime equity and private financing reached $1.17 billion across nine rounds, demonstrating strong institutional sponsorship while capping venture liquidation preference overhang through an all-cash exit.[CV005, CV006, CV007, CV008, CV009, CV010]

8.3 Scenario Underwriting, Valuation Comps, and Thesis-Break Triggers

Evaluating Armis under comparable cybersecurity multiples highlights the substantial strategic premium embedded in ServiceNow's acquisition price. High-growth public peers in identity and exposure management such as CrowdStrike and Palo Alto Networks have historically traded at forward revenue multiples between 14x and 22x, while specialized OT/IoT competitors like Claroty and Nozomi Networks have raised capital at private valuations of $1 billion to $2.5 billion. ServiceNow's $7.75 billion purchase price values Armis at approximately 22.8x trailing ARR, a multiple that exceeds standard industrial security benchmarks and reflects anticipated workflow cross-selling across ServiceNow's global enterprise customer base. Underwriting scenarios range from a bull case where Centrix accelerates ServiceNow's Security Operations (SecOps) revenue past $1 billion ARR, to a bear case where key engineering talent departs from Tel Aviv and OTORIO on-premises customers resist cloud migration. For continuing institutional diligence, primary verification priorities include tracking post-close key executive retention agreements, auditing joint adapter telemetry performance with Fortinet and Google Chronicle, and monitoring regulatory closing filings.[CV003, CV004, CV013, CV014, CV015, CV016]

8.4 Exhibits