Armis and Veza are the two acquisitions with which ServiceNow connected asset management, identity, and cybersecurity into a single architecture. Armis, completed on April 20, 2026 for approximately US$7.75 billion, adds intelligence on connected assets and cyber exposure. Veza, completed on March 2, 2026, adds visibility into identities, permissions, and access paths.
The practical effect is a change in scope. Discovering an asset becomes only the beginning: the organization needs to understand who can access it, what risk it represents, which services depend on it, and what action should be taken. It is this chain that brings ITAM, CMDB, ITOM, and cybersecurity closer together in a single discussion of data architecture and governance.
Why did ServiceNow acquire Armis and Veza?
ServiceNow completed its acquisition of Veza on March 2, 2026, and its acquisition of Armis on April 20, 2026. According to... official statement from ServiceNow, The Armis transaction was completed for approximately US$ 7.75 billion in cash, combining equity and debt financing.
| Transaction | Conclusion | Value reported | Technological focus |
|---|---|---|---|
| Veza | March 2, 2026 | Not disclosed in the official statement. | Identity security, Access Graph, effective permissions |
| Armis | April 20, 2026 | Approximately US$ 7.75 billion in cash | Cyber exposure management and cyber asset intelligence |
The two acquisitions address complementary dimensions of the same problem. Companies today operate with assets distributed across traditional infrastructure, cloud, applications, OT, IoT, connected devices, and AI environments. At the same time, the number of non-human identities grows with service accounts, workloads, machines, and AI agents, which expands the surface area that needs to be governed.
To protect this environment, it's not enough to know that an asset exists. A broader set of questions needs to be answered:
- What assets actually exist in the environment?
- Where are they located and how are they connected?
- What vulnerabilities and exposures are associated with them?
- Who or what has access?
- What permissions do these identities actually possess?
- What business applications and services are these assets part of?
- What is the real risk to the organization?
- Which workflow should be triggered to address this risk?
This is where Armis, Veza, and ServiceNow begin to form a common technological thesis: each layer responds to a part of the sequence, and value appears when the responses share the same context.
What does Armis add to ServiceNow?
Armis is a cyber exposure management and cyber asset intelligence platform. Its technology enhances the ability to discover, contextualize, prioritize, and protect connected assets in environments such as IT, OT, IoT, medical equipment, critical infrastructure, cloud, and code.
According to ServiceNow, Armis' technology tracks approximately 7 billion devices in real time and is used by nine of the ten largest Fortune 10 companies and more than 35% of the Fortune 100. The acquisition extends ServiceNow's reach to physical and operational layers that traditionally offer less visibility to conventional enterprise management tools.
This is particularly important in industrial environments, hospitals, financial institutions, utilities, and large enterprises with heterogeneous infrastructures. A connected device may not be correctly inventoried on a traditional basis, but still be part of the organization's attack surface.
Armis' contribution can be summarized in one question: What exists in the environment and what risks are these assets exposed to?
What does Veza add to ServiceNow?
Veza adds a second dimension: identity security. Its technology was developed to understand who or what has access to digital resources and, most importantly, what permissions can be effectively exercised. This includes human and non-human identities, such as users, privileged accounts, service accounts, workloads, machines, and AI agents.
A central component of this approach is the Access Graph of the Week, This model relates identities, resources, permissions, and access paths. Instead of analyzing only the existence of an account or an isolated entitlement, the model seeks to answer what a given identity can actually do with the resources to which it is connected.
Veza's contribution can therefore be summarized in another question: Who or what can access each resource and with what permissions?
Armis, Veza, and ServiceNow: how do their capabilities complement each other?
The strategic value of acquisitions becomes apparent when asset intelligence and identity intelligence are connected to the platform's operational context. Each layer answers a distinct question and depends on the others to produce a reliable decision.
| Layer | Main question | Role in architecture |
|---|---|---|
| Armis | What exists and what is its exposure? | Cyber asset intelligence, continuous discovery, and cyber exposure management. |
| Veza | Who or what has access? | Identity intelligence, permissions, access paths, and governance. |
| CMDB and CSDM | What is the context of this feature? | Relationships between configuration, applications, services, and business |
| ITAM | How is the asset governed throughout its lifecycle? | Ownership, lifecycle, contracts, software, hardware, and asset governance. |
| ITOM | How is the environment operating? | Discovery, observability, events, dependencies, and operational context. |
| Security & Risk | Which risk needs to be prioritized? | Exposure, vulnerability, risk, controls and response |
| ServiceNow AI Platform | What needs to happen now? | Context, workflow, automation, AI, governance, and traceability. |
This architecture helps explain why acquisitions are relevant beyond the traditional cybersecurity market. They broaden the strategic significance of asset and identity data within the platform.
From asset management to Cyber Asset Intelligence
Historically, the IT asset management It answers questions related to inventory, ownership, usage, cost, contracts, licensing, and lifecycle. A CMDB adds a different perspective: configuration, technical relationships, and dependencies between components and services.
Cyber Asset Intelligence adds another dimension. The focus expands to include the effectively connected technological surface, its exposure, and its significance for security. These disciplines are not equivalent and should not be treated as substitutes: each answers a different question about the same asset.
| Discipline | Main perspective |
|---|---|
| ITAM | Financial, contractual, and operational governance of the asset lifecycle. |
| CMDB | Configuration, relationships, and context of services. |
| ITOM | Discovery, operation, events and technological dependencies |
| Cyber Asset Intelligence | Visibility of the connected surface and context of cyber exposure. |
| Identity Security | Identities, permissions, and access paths |
| SecOps | Prioritization, investigation, response, and remediation of security. |
The gains emerge when these perspectives can share context. An asset ceases to be merely a technical or financial record and begins to be analyzed also for its criticality, relationships, exposure, and access.
Are ITAM and cybersecurity converging?
ITAM and cybersecurity remain distinct disciplines, but their mutual dependence is increasing. An organization cannot consistently protect what it cannot identify, contextualize, and assign responsibility to.
This convergence can be understood as a sequence of questions:
- ITAM: What assets do we own, use, contract, or need to govern?
- ITOM and CMDB: Where are these assets located, and what services and applications are they part of?
- Armis: Which assets are actually connected and what is their cyber exposure?
- Veza: Which human identities, machines, or AI agents can access these resources?
- Security & Risk: Which exposures pose the greatest risk to the business?
- ServiceNow AI Platform: What action should be taken to reduce this risk?
This vision shifts asset management from a predominantly administrative function to a source of context for decisions regarding operations, safety, risk, and AI.
Armis replaces ServiceNow Discovery, CMDB or ITAM?
No. Armis, Discovery, CMDB, and ITAM solve different and complementary problems, and treating them as alternatives to each other is an architectural error that often appears early in these discussions.
ServiceNow Discovery is used to discover infrastructure and feed operational information about Configuration Items. The CMDB organizes CIs and their relationships. ITAM governs financial, contractual, and lifecycle aspects of hardware and... software assets. Armis adds a cyber asset intelligence and exposure perspective across a broader connected surface.
In a mature architecture, the relevant discussion is not which of these capabilities should replace the others, but how to establish reconciliation, ownership, data quality, and governance among different sources of intelligence.
Without this governance, adding new discovery tools can increase duplication and inconsistency. With proper architecture, complementary sources can enrich the context used for operational and security decisions.
The role of CMDB and CSDM in this strategy
Discovering that a device has a critical exposure does not, in itself, answer what impact that exposure can have on the business. It is necessary to know if the device supports a critical application, which service depends on it, who is responsible for the service, which processes are impacted, and what controls should be applied.
It is at this layer that CMDB and CSDM gain importance. Reliable CMDB A structured service model helps transform a technical signal into an operational context.
Cyber Asset Intelligence increases visibility across the technological surface. CMDB and CSDM help transform that visibility into a service and business context.
Therefore, the evolution of data-driven security does not diminish the importance of CMDB. On the contrary, it increases the need for quality, ownership, reconciliation, and governance of the data used by automation and AI.
What changes with AI agents and non-human identities?
The expansion of agentic AI adds a new category of risk. AI agents can perform actions, access systems, query data, use APIs, and interact with other agents. This transforms identity and authorization into central elements of AI governance.
ServiceNow is positioning the combination of Armis and Veza for this scenario as well. Armis extends intelligence across connected assets, while Veza extends permission analytics to human and non-human identities, including AI agents.
On May 5, 2026, during Knowledge 2026, ServiceNow announced the Autonomous Security & Risk, integrating the capabilities of Armis and Veza with the goal of governing AI agents, identities, and connected assets. In the same presentation, the company described Veza's Access Graph as a continuous map of the environment's access relationships and Armis' data as a direct enrichment of the CMDB records.
This brings cybersecurity closer to another strategic discussion: AI Asset Management. As AI agents, models, workloads, and components begin to perform business functions, organizations need to identify these resources, define ownership, control access, assess risk, and maintain traceability over their actions.
The model shifts from detecting to seeing, deciding, and acting.
The strategy presented by ServiceNow for Armis and Veza emphasizes an architecture capable of connecting visibility, decision-making, and action across the technological environment.
This change is relevant because one of the recurring problems in enterprise security is fragmentation. One tool identifies an asset, another detects vulnerabilities, another manages identity, another contains information about services, and a fifth executes tickets or remediation workflows. When this information remains isolated, teams need to correlate signals manually before making any decisions.
ServiceNow's thesis is to use the platform as a context and execution layer: Armis and Veza increase the available intelligence, while workflows, Security & Risk, AI Control Tower, and other platform capabilities can use this context to prioritize and execute actions.
Why are these acquisitions strategic for ServiceNow?
The move also represents significant economic expansion. According to ServiceNow, Armis and Veza are expected to more than triple the company's addressable market for Security & Risk solutions.
But the strategic impact is broader than market expansion. The acquisitions bring together three domains historically handled by distinct teams and tools: operations, asset management, and cybersecurity. ServiceNow will now build a narrative in which assets, identities, vulnerabilities, services, risks, and workflows can be correlated within the same platform architecture.
This doesn't mean eliminating all specialized security tools. Large companies will continue to operate heterogeneous ecosystems. The potential value of the platform lies in aggregating context and coordinating actions across these domains.
What should CIOs and CISOs look out for?
For CIOs and CISOs, evolution requires a discussion that goes beyond the choice of tools. The quality of the results will depend on the data architecture and the governance implemented around these capabilities.
- Asset coverage: Understand which asset classes are visible and which are not.
- Identity coverage: Include human and non-human identities in the governance model.
- CMDB health: To ensure quality, completeness, and reliable relationships.
- CSDM: Connecting technical components to applications and services relevant to the business.
- Reconciliation: Define authoritative sources and rules to avoid duplicate or conflicting records.
- Ownership: Establish who is responsible for assets, services, identities, vulnerabilities, and risks.
- Risk context: Prioritize exhibitions considering technical criticality and business impact.
- Automation governance: Determine which actions can be automated and which require human approval.
- AI governance: Control AI agents, access, permissions, and automated actions.
What does this strategy mean for companies that already use ServiceNow?
For organizations that already use the ServiceNow platform, The first decision shouldn't simply be to add new technologies. The starting point is to assess the maturity of the existing infrastructure.
Companies with fragmented ITAM, low-quality CMDB, lack of CSDM, undefined ownership, or disconnected vulnerability processes may have difficulty capturing the value of an additional layer of intelligence.
A structured evolution can follow four paths:
- Consolidate the base: Review ITAM, Discovery, CMDB, CSDM, and data quality.
- Expand visibility: Identify gaps in IT, OT, IoT, cloud, and other connected environments.
- Relating identity and risk: To understand who or what has access to critical resources.
- Automate with governance: Utilize context for prioritization, workflows, remediation, and AI without losing control and traceability.
How 4MATT views the convergence between asset management and cybersecurity.
For 4MATT, a ServiceNow Elite Partner in Brazil with over 180 certified specialists, these acquisitions reinforce an evolution already observed in transformation programs: asset management should not be treated in isolation from CMDB, operations, security, and governance.
The quality of automation depends on the quality of the context. Before applying AI or autonomous remediation, organizations need to know what assets exist, how they are related, who is responsible for them, who can access them, and what impact they have on business services.
This perspective connects competencies from ITAM, ITOM, CMDB, CSDM, Security Operations, and platform governance. It also expands the concept of Asset Management to new types of assets and identities associated with the adoption of AI.
The goal should not simply be to increase the volume of data collected. Maturity lies in transforming asset, configuration, identity, and security data into a trusted context for decisions and automation.
Frequently asked questions about ServiceNow, Armis, and Veza.
When did ServiceNow complete its acquisition of Armis?
The acquisition was completed on April 20, 2026. ServiceNow reported a cash value of approximately US$7.75 billion, combining its own cash and debt financing.
When did ServiceNow acquire Veza?
The acquisition of Veza was completed on March 2, 2026, expanding ServiceNow's capabilities in identity security. The transaction value was not disclosed in the official announcement.
What is the difference between Armis and Veza?
Armis focuses on cyber asset intelligence and cyber exposure management for connected assets. Veza focuses on identity intelligence, permissions, and access paths for human and non-human identities, including AI agents.
Armis replaces ServiceNow Discovery?
No. The technologies have different objectives. Discovery provides discovery and operational data for CMDB, while Armis adds asset intelligence geared towards cyber exposure and risk.
Will Armis replace CMDB?
No. The CMDB maintains the configuration and relationship model necessary to contextualize applications and services. Armis adds a cyber asset intelligence perspective that complements this context and, according to ServiceNow, enriches the CMDB's own records.
What does the acquisition of Armis change for ITAM?
It reinforces the connection between asset governance and security. ITAM remains responsible for the lifecycle and financial and contractual dimensions, while exposure data can add risk context to asset decision-making.
What is Cyber Asset Intelligence?
It is the ability to continuously identify and contextualize the assets that make up the technological surface and relate them to relevant information for assessing cyber exposure and risk.
How does Veza interact with AI agents?
Veza's strategy includes visibility and governance of non-human identities. This allows AI agents to be treated as identities that require controlled permissions aligned with the principle of least privilege.
What is ServiceNow's Autonomous Security & Risk?
This is the offering announced by ServiceNow on May 5, 2026, during Knowledge 2026, which integrates asset intelligence, identities, risk, AI, and automation, including capabilities from Armis and Veza to govern connected assets, identities, and AI agents.
Asset management becomes part of the security architecture.
The acquisitions of Armis and Veza show that ServiceNow is expanding how it connects operations and security. The question is no longer just which assets an organization owns, but rather which assets actually exist, who can access them, what risks they are exposed to, what services depend on them, and what actions should be taken.
Armis adds cyber asset intelligence. Veza adds identity intelligence. CMDB and CSDM provide operational context. ITAM adds lifecycle governance. Security & Risk adds risk context. The ServiceNow AI Platform connects this information to workflows, automation, and AI.
This convergence does not eliminate the need for specialized tools or distinct disciplines. However, it increases the importance of an architecture capable of transforming multiple data sources into a reliable context.
For organizations advancing in automation and AI, this may be the most relevant point of the strategy: the more autonomous the operation becomes, the greater the need for trust in the data on assets, identities, services, and risks that guide its decisions.