ServiceNow at Goldman Sachs conference: AI and security push deepens

ServiceNow said AI revenue increased nine-fold over nine months, CRM annual contract value exceeded $2 billion after revenue doubled year over year, and security operations surpassed $1 billion in annual revenue. The company said more than 50% of net new revenue is now non-seat-based, while its internal AI agents automated 90% of targeted service and tactical operations, eliminating roughly 2.5 million work hours and creating about $1 billion in value. Management positioned its Armis, Veza and Moveworks acquisitions as components of an integrated AI Control Tower, targeting enterprise workflow, identity, security and operating technology markets.

Analysis

The investable change is ServiceNow’s shift from seat-led ITSM to consumption/value-based monetization. If AI products become attached to existing workflow estates, net revenue retention can accelerate without equivalent saleshead growth, supporting both durable high-teens-plus growth and operating leverage. The market will need independently verifiable evidence—remaining-performance-obligation growth, cRPO, AI ACV conversion, and margin guidance—not management’s internal ROI estimates—to underwrite a sustained premium multiple.

The strategic risk is that NOW is broadening into security, identity and OT through acquisitions precisely as buyers are consolidating budgets. This can pressure pure-play vendors with weaker workflow integration—especially endpoint/asset visibility, identity-governance and IT help-desk challengers—but it also raises execution risk: integration delays, elevated stock/cash consideration, and channel conflict could turn a cross-sell narrative into margin dilution over the next 6-18 months. A meaningful security-platform win requires displacement evidence, not merely attaching ServiceNow workflow to incumbent tools.

Near term, bullish conference messaging is likely largely reflected in NOW’s valuation; the asymmetric catalyst is a formal mid-market help-desk launch with transparent pricing and early conversion metrics over the next 1-3 months. The contrarian concern is that customers may use model-routing and zero-copy claims to demand lower platform pricing, while autonomous case resolution reduces the number of employee touchpoints that historically expanded seat counts. The thesis is falsified by decelerating cRPO/subscription growth, flat-to-down net retention, or incremental operating-margin pressure from acquired-product integration.

Second-order beneficiaries include NVDA and hyperscalers if enterprise agent deployments shift from pilots to production, but NOW’s model-agnostic posture limits any direct vendor lock-in. SNOW gains only modestly: orchestration can increase governed data access, yet a zero-copy architecture may reduce data movement and compute intensity versus a full centralization workflow.

Key Decisions for Investors

• Maintain or initiate a measured long NOW only on post-conference consolidation or ahead of the next earnings print; target 12-month upside from AI attach-rate and cross-sell reacceleration, but size modestly given premium-multiple sensitivity. Exit/reduce if cRPO or subscription growth misses consensus by more than 200 bps or FY operating-margin guidance falls.
• Express the consolidation thesis as long NOW / short a basket of smaller IT workflow and security point-solution providers rather than a broad cyber short; hold 6-12 months and reassess after evidence of identity/OT/security attach rates. Do not establish until acquisition integration milestones and product packaging are disclosed.
• Set an event-driven alert for the mid-market AI help-desk launch: buy NOW only if pricing preserves enterprise-grade governance while implementation is materially lighter than core ITSM. Watch paid-beta conversion, partner-led deployment capacity, and CAC; absent those data, treat the launch as narrative rather than an earnings catalyst.
• Avoid using SNOW as a primary read-through long. Monitor whether ServiceNow customer implementations generate incremental Snowflake consumption versus data-fabric substitution; a favorable trade requires disclosed workload or consumption evidence, not connector announcements.