Attack surface management is about continuously identifying assets that can be exploited, understanding which exposures pose a risk to the business, and transforming that context into governed remediation.
4MATT — a ServiceNow Elite Partner in Brazil and winner of the 2024–2025 Technology Excellence Partner Award — connects asset intelligence and exposure to Armis Centrix™ to the operational context of ServiceNow AI Platform. With Armis + ServiceNow, The company expands its visibility across managed and unmanaged assets (IT, OT, IoT, cloud, and applications), relating this context to... CMDB and uses ServiceNow workflows to prioritize, assign, remediate, and audit risk from end to end.
The attack surface cannot be managed solely by scanners.
Traditional vulnerability assessment tools start from a known universe: network ranges, managed endpoints, registered workloads, or already mapped applications. The problem appears in the blind spots.
An IP camera in an agency, a building automation device, an industrial controller, an IoT device, a forgotten administrative interface, a newly published application, or an asset acquired in a merger can all be active and exposed before entering the corporate inventory.
Agentless, OT, and IoT devices that don't appear in conventional tools.
Incomplete or outdated CMDB, lacking ownership, criticality, and service context.
Vulnerabilities prioritized solely by CVSS, with no business impact or real exposure.
Alerts that didn't result in action: no owner, no task, no change, no evidence.
Three capabilities that modern management needs to combine.
Armis does not replace CMDB. CMDB does not replace the discovery and exposure intelligence of Armis. The value lies in the combination.
Cyber Asset Intelligence
What really exists and how is it behaving?
Armis Centrix™Business & Service Context
To which service, process, location, owner, and level of criticality does this asset belong?
ServiceNow CMDB / CSDMExposure & Remediation
Which risk should be addressed first, by whom, and with what evidence?
USEM / SecOps / workflowsArmis + ServiceNow: a single, governed stream
In 2026, following the acquisition of Armis, ServiceNow positioned the combination as a seamless layer of cyber asset intelligence connected to the business context, exposure, and automation of the ServiceNow AI Platform.
The Service Graph Connector for Armis powers the CMDB; integration with Security Incident transforms alerts into incidents; integration with Vulnerability Response associates vulnerabilities with devices—including OT, IoT, and unmanaged devices.
The six Armis Centrix™ modules and what they require from the CMDB.
For a horizontal attack surface architecture, six offerings are particularly relevant. Medical Device Security remains a vertical specialization for healthcare and IoMT.
| Armis Centrix™ Module | Main capacity | What do you need from CMDB / ServiceNow? | Joint result |
|---|---|---|---|
| Asset Management and Security | Continuous discovery, classification, inventory, behavior, risk, and enrichment of managed and unmanaged assets. | Rules for identification and reconciliation, CI classes, location, owner, support group, lifecycle, and relationship with services. | CMDB is more comprehensive and continuously compared with the real-world environment. |
| OT/IoT Security | Agentless visibility, profiling, communication, anomalies, vulnerabilities, and risk in OT, IoT, and cyber-physical systems. | OT/IoT classes, site/plant/agency, operational criticality, supported process, technical owner, relationships, and change windows. | Cyber-physical assets within the same corporate governance, risk, and workflow model. |
| VIPR-Pro — Prioritization and Remediation | Consolidation, deduplication, prioritization, and orchestration of findings from multiple tools. | CI matching, business criticality, affected service, ownership, assignment group, and remediation policies/SLAs. | Less backlog and prioritization by technical risk + business impact |
| Vulnerability Management Detection and Response | Continuous vulnerability detection and validation with selective queries and real-time context. | Reliable identifiers for CI, OS/platform, network, owner, criticality, and maintenance window. | Vulnerability is no longer just about CVE (Critical Velocity) and becomes a finding associated with a governed asset. |
| Application Security | Visibility and risk analysis of applications and software throughout the development lifecycle. | Business application, application service, owner, environment, digital product, business service, and dependencies. | Risk of code and application connected to the service that supports it and the team that fixes it. |
| Early Warning | Preemptive intelligence on vulnerabilities showing signs of exploitation or weaponization before the traditional cycle. | Software/CVE mapping → CI, criticality, exposure, dependencies, owner, and business priority. | Act before exploitation, prioritizing what is relevant to your assets and services. |
Key architectural point: do not transform the CMDB into a security data lake.
The CMDB should maintain a governed record of the asset and its business context—not every packet, network flow, event, or telemetry. Select the attributes that enhance identification, reconciliation, classification, relationship, and decision-making. Detailed telemetry remains on the specialized platform; ServiceNow receives the context needed to trigger processes.
Where the combination generates value faster
Discover assets outside of CMDB.
Armis identifies connected resources invisible to traditional tools; ServiceNow reconciles, points out gaps, and validates ownership, location, class, and criticality. Reduces blind spots.
Enriching the CMDB with risk
The asset no longer simply answers "what is the IP address?" but gains context regarding vulnerabilities, behavior, exposure, and risk. A more useful CMDB for security, operations, and resilience.
Prioritize based on business impact.
CVSS in isolation doesn't tell you if the failure is in an irrelevant asset or a critical service. Prioritization then takes into account exploitability + exposure + asset + service + business.
Controlling OT and IoT exposure
Assets that don't support agents or aggressive scanning benefit from non-intrusive discovery and monitoring with Armis, thanks to ServiceNow's process, change, accountability, and governance.
Convert alerts into responses.
A relevant event triggers a Security Incident, enriches the investigation with asset data, identifies the owner, verifies criticality, and activates controls. Less time between detection and response.
Anticipate with Early Warning
Early Warning powered by Armis enriches the USEM Central Vulnerability Database with signals of imminent exploitation — preemptive prioritization without waiting for the next scan cycle.
Mature management doesn't end with a dashboard.
It operates as a continuous process — the point of convergence between Armis Centrix™ and ServiceNow.
Discover
Assets, applications, equipment, vulnerabilities, and exposures.
Contextualize
Asset, service, owner, location, environment, and criticality.
Prioritize
Technical risk, exploitability, behavior, threat, and business impact.
Remedy
Tasks, incidents, changes, approvals, or containment actions.
Validate
Confirm whether the exposure has been eliminated or manage the residual risk.
Start with a high-value domain and measure the baseline.
Deployment doesn't need to start across the entire environment. Select a critical unit, OT environment, branch network, data center, IoT devices, or a set of priority services and objectively measure the gaps.
The CMDB diagnosis 4MATT is the natural starting point for structuring this baseline and connecting asset visibility to the context of CMDB and to the workflows of ITOM.
The baseline that reveals the gaps.
- Assets observed by Armis × known by CMDB
- Assets with ownership × without owner
- Assets with defined criticality
- Exhibitions without an assigned curator
- Time until remediation
Ready to measure your attack surface?
4MATT, a ServiceNow Elite Partner in Brazil, assesses maturity across four dimensions: asset visibility, CMDB quality, exposure prioritization, and workflow remediation capabilities.
Assess maturity →Questions about attack surface management with ServiceNow
What is attack surface management?
It is the ongoing process of identifying assets and resources that can be exploited, detecting exposures, contextualizing the risk, and mitigating those exposures before they are used by an attacker. The scope can include IT, OT, IoT, cloud, applications, unmanaged devices, and other connected assets.
What is the difference between attack surface, CAASM, and CTEM?
Attack surface describes the set of assets, interfaces, and pathways that can be exploited. CAASM focuses on aggregating and contextualizing cyber asset data. CTEM is a broader, ongoing program to identify, prioritize, validate, and mobilize exposure reduction. In practice, Armis provides cyber asset intelligence and exposure management that underpin a CTEM program, while ServiceNow operationalizes context, governance, and remediation.
Armis replaces ServiceNow CMDB?
No. Armis and CMDB have complementary functions. Armis identifies, classifies, and monitors assets and their cyber exposure context. ServiceNow CMDB maintains the governed corporate record of CI and its relationships with services, owners, locations, and processes.
How does Armis integrate with ServiceNow?
The ecosystem includes Service Graph Connector for Armis for asset data and CMDB, integration with Security Incident for alerts and incidents, and integration with Vulnerability Response for device-related vulnerabilities. ServiceNow also provides Early Warning for Security Exposure Management, powered by Armis, to enrich USEM with preemptive intelligence.
Does the CMDB need to be perfect before implementing Armis?
No. One of the use cases is precisely to identify differences between the observed environment and the existing inventory. Even so, the better the rules for identification and reconciliation, ownership, classes, criticality, and service relationships, the greater the ability to transform technical intelligence into automated prioritization and remediation.
How does Armis help in OT and IoT environments?
Armis uses agentless and non-intrusive techniques to discover and contextualize assets that often don't support traditional agents, combining passive monitoring, integrations, and selective active queries — without applying the same conventional endpoint scanning model to the OT environment.
Does Armis replace vulnerability scanners, EDR, NAC, or firewalls?
Not necessarily. Armis is designed to integrate with the existing stack: it consumes data from other tools, expands asset coverage, prioritizes risk, and triggers external controls. NAC, firewall, EDR, scanners, and other technologies retain specialized functions within the architecture.
What is the main benefit of combining Armis + ServiceNow?
Closing the loop between visibility and action. Armis enhances the ability to see and contextualize risk; ServiceNow relates this risk to the business and transforms the decision into workflow, assignment, change, incident, remediation, and auditable evidence.
External references: Armis + ServiceNow and ServiceNow Unified Security Exposure Management (USEM).