ServiceNow Q1: It Takes Time To Re-Rate Great

ServiceNow remains a high-conviction Buy, supported by 22% Q1 2026 subscription revenue growth, strong deal flow, and 97% renewal rates. The article argues that margin pressure from the Armis acquisition is temporary and that integration should enhance AI-native security leadership and cross-sell opportunities. Management/analyst view points to a re-rating in H2 2026 as fundamentals remain strong.

Analysis

The market is likely still underpricing the second-order effect of the Armis deal: this is not just a revenue add-on, it shifts NOW from workflow software into a more defensible security-control layer where AI can be embedded into higher-value decision points. If integration works, the re-rate is driven less by near-term margin recovery and more by a higher multiple on a broader platform narrative, which matters because security buyers tend to expand wallet share faster than pure ITSM customers.

The main winners are adjacent cybersecurity incumbents that compete on point solutions; NOW’s distribution and enterprise footprint can compress their win rates over the next 4-6 quarters, especially in accounts already standardized on the platform. The less obvious loser is any vendor relying on AI as a feature rather than a workflow-native product — once customers see security use cases tied into service management and remediation, standalone copilots look less differentiated.

The key risk is timing: the bull case is a H2 2026 re-rating, so the stock can still de-rate for several months if integration drag, sales disruption, or margin optics trigger multiple compression before the synergy story shows up in reported numbers. The largest failure mode is that the acquisition consumes management bandwidth and delays AI monetization elsewhere, turning a strategic win into a temporarily lower-quality earnings profile.

Consensus may be missing that the setup is asymmetric because expectations for software multiples are still anchored to growth durability, not to platform expansion into cybersecurity. If the market starts marking NOW as a cross-sell/security compounder rather than an IT workflow vendor, the upside can come in a step function rather than linearly. That said, the move is not risk-free: if bookings decelerate even modestly, the stock could stay range-bound until the integration benefits become visible in renewal cohorts and net retention.

Key Decisions for Investors

• Stay long NOW into the next 2-3 quarters, but size as a lagged catalyst trade rather than a near-term earnings momentum name; the setup favors multiple expansion in H2 2026, not immediate margin-driven upside.
• Buy NOW call spreads 6-12 months out to express the re-rating thesis with defined downside; the payoff is attractive if the market begins to price a higher-quality platform story before synergies fully hit P&L.
• Pair long NOW vs short a basket of standalone security software names over 3-6 months; the thesis is that NOW’s embedded distribution and cross-sell can pressure win rates for point-solution competitors.
• Use any post-earnings selloff on margin noise to add, but avoid chasing after sharp upside gaps; the best entry is likely on integration-related weakness, when the market overreacts to temporary EBITDA compression.