Gluware Extends Its Automation Platform Beyond the Network to Connected Medical Devices

Gluware launched an early-access IoMT Exposure Management platform that automates medical-device vulnerability matching, patch selection, approval workflows and audit documentation. The product addresses a significant healthcare cybersecurity burden: CVE submissions rose 263% from 2020 to 2025, connected medical devices average 6.2 known vulnerabilities, and healthcare data breaches averaged $7.42M per incident in IBM's 2025 report. The offering was developed with Ohio State University Wexner Medical Center and integrates Claroty xDome, Microsoft Update Catalog and ServiceNow.

Analysis

This is strategically more relevant to ServiceNow than Microsoft: the economic value sits in converting a fragmented clinical-engineering workflow into auditable change records, which supports NOW’s higher-value ITOM/IRM/healthcare workflow attach rather than merely incremental ticket volumes. If Gluware’s integration becomes repeatable, it could make ServiceNow the system of record for remediation governance in hospitals, increasing switching costs across IT, security, and biomedical engineering. The near-term revenue impact on either public ticker is immaterial, but it reinforces the durability of workflow-platform spending even when hospital capital budgets are constrained.

The competitive implication is negative at the margin for standalone asset-discovery and medical-device-security vendors—particularly Claroty, Armis, Ordr, and Forescout—if buyers increasingly demand closed-loop remediation rather than detection dashboards. However, Gluware depends on inventory, patch-catalog, and ITSM partners; this is more likely a partnership-led ecosystem expansion than immediate disintermediation. The key unknown is whether device manufacturers permit reliable automated patch execution across heterogeneous, safety-regulated equipment; compensating controls may remain the dominant outcome for unsupported devices, limiting automation penetration and realized ROI.

Over the next 1-3 months, watch for named early-access hospital wins, ServiceNow Store certification or co-selling, and disclosed reductions in remediation time. A 6-18 month catalyst would be healthcare-provider board and insurer pressure to demonstrate device-level cyber controls after a material breach, shifting spend from visibility tools to remediation orchestration. Consensus may overestimate a near-term cybersecurity-spending read-through: this is a private-company product launch with no disclosed pricing, contracted backlog, or independently verified customer outcome.

Key Decisions for Investors

• No standalone trade on the launch; maintain NOW as the cleaner liquid beneficiary only if healthcare workflow bookings, ITOM/IRM attach, or management commentary show measurable acceleration over the next 2-3 quarters.
• Use any broad software-risk-off pullback to build a 6-12 month long NOW position versus MSFT, sized modestly; the relative thesis is workflow/governance monetization, not patch-management revenue. Exit if NOW healthcare and risk-workflow growth decelerates materially or implementation cycles lengthen.
• Set an alert for disclosed Gluware deployments involving 3+ health systems or a formal NOW go-to-market partnership. Without those validation points, treat the announcement as ecosystem signal rather than an earnings catalyst.
• For private-market/security diligence, monitor Claroty, Armis, Ordr, and Forescout renewal language for remediation-orchestration demands. Evidence that customers consolidate discovery with automated execution would pressure standalone visibility multiples over 6-18 months.