“The acquisition of Armis marks a clear entry by ServiceNow into cybersecurity”

ServiceNow is in advanced talks to buy Israeli cybersecurity firm Armis for up to $7 billion, a strategic follow‑on to its Veza buy that integrates IoT/OT asset visibility and risk management into ServiceNow’s CMDB and automated response workflows. Merlin Ventures’ Shay Michel says the deal positions ServiceNow to expand meaningfully in the ~$300 billion U.S. federal market and underscores Merlin’s role in bringing Israeli cyber vendors into Washington — Merlin recently raised an $85 million cyber fund and its CGC program has helped partners generate more than $100 million in federal revenue. Michel warns of frothy mega‑Seed valuations that could force a market reset within two to three years, while identifying cybersecurity for AI as a major federal spending opportunity and advising founders to prioritize go‑to‑market execution and early revenue.

Analysis

ServiceNow is in advanced talks to acquire Israeli cybersecurity firm Armis for as much as $7 billion, a strategic follow-on to its Veza purchase that would fold Armis’s IoT/OT and unmanaged-asset visibility directly into ServiceNow’s CMDB and automated response workflows. The deal, described by Merlin Ventures’ Shay Michel, is positioned as an integration play to close gaps between IT asset management and cybersecurity rather than a pure revenue acquisition.

Merlin frames the transaction as a catalyst for federal expansion into the roughly $300 billion U.S. government market, supported by Merlin’s CGC channel that has enabled >$100 million in federal revenue and by its recent $85 million cyber fund; Merlin also highlights existing distribution relationships that generate "hundreds of millions" for vendors like Palo Alto Networks and CyberArk. Market signals show moderately positive sentiment and a medium market-impact score, with ServiceNow-specific sentiment at 0.6.

Michel warns of frothy Seed valuations (cited at 100–200x revenue) and expects a market recalibration within two to three years, while identifying cybersecurity for AI and FedRAMP-qualified offerings as prioritized federal spending areas. Key execution risks are integration of Armis into ServiceNow’s stack, federal procurement timelines and certification hurdles.

Key Decisions for Investors

• Consider modestly increasing exposure to ServiceNow (NOW) on the strategic cybersecurity entry but size positions to reflect integration execution risk and potential regulatory/federal procurement delays
• Monitor Palo Alto Networks (PANW) and CyberArk (CYBR) for channel and federal-contract implications from ServiceNow’s move, avoiding assumption of immediate market share shifts until contract wins or partner displacement evidence appears
• Private-market investors should be selective on mega-Seed cyber rounds, prioritizing founders with early go-to-market revenue and FedRAMP progress given Michel’s warning of a 2–3 year valuation recalibration
• Allocate research and potential capital toward companies that couple AI-security capabilities with FedRAMP readiness, as federal spending priorities and AI-risk mitigation are identified as near-term growth vectors