Cybersecurity Market Consolidation: Industry Shakeup

Overview

ServiceNow just agreed to pay $7.75 billion in cash for Armis, a cybersecurity startup that tracks vulnerabilities across hospital medical devices, factory equipment, and corporate networks. It's ServiceNow's largest acquisition ever—and its third billion-dollar security buy in 2025 alone. CEO Bill McDermott calls it building an "AI control tower" for cybersecurity, while Wall Street calls it a land grab.

The ServiceNow deal caps a frenzied 21 months of enterprise acquisitions. In that time, companies spent over $90 billion buying cybersecurity firms: Google paid $32 billion for Wiz, Palo Alto grabbed CyberArk for $25 billion, and Cisco swallowed Splunk for $28 billion. Companies with 83 security tools from 29 vendors are desperate to consolidate, and the winners will control the operating system layer for enterprise security.

Play on this story Voices Debate Predict

Key Indicators

$90B+

Spent on cybersecurity M&A in 21 months

Cisco-Splunk ($28B), Google-Wiz ($32B), Palo Alto-CyberArk ($25B), ServiceNow's 2025 spree ($11.6B)

Average security tools per enterprise

From 29 different vendors—driving 70% of organizations to pursue consolidation

Billion-dollar acquisitions by ServiceNow in 2025

Moveworks ($2.85B), Veza ($1B), Armis ($7.75B)—transforming from IT ticketing to security platform

50%+

Armis revenue growth rate

$340M annual recurring revenue, serving 35% of Fortune 100, grew from $200M ARR in 18 months

ServiceNow's security market expansion

CFO projects Armis deal will triple addressable market for security and risk solutions

Interactive

Exploring all sides of a story is often best achieved with Play.

Ever wondered what historical figures would say about today's headlines?

People Involved

Bill McDermott

Leading $11.6 billion acquisition spree in 2025, contract extended to 2030

Yevgeny Dibrov

Leading Armis through $7.75 billion ServiceNow acquisition, second major exit

Assaf Rappaport

Sold Wiz to Google for $32 billion after rejecting $23 billion offer in 2024

Marc Benioff

Competing with ServiceNow by entering IT service management market

Organizations Involved

ServiceNow, Inc.

Enterprise Software Platform

Acquiring Armis for $7.75B after $3.85B in prior 2025 security acquisitions

Enterprise workflow platform competing to become the operating system layer for business operations and security.

Armis

Cybersecurity Startup

Being acquired by ServiceNow for $7.75B, second-half 2026 close expected

Cyber exposure management platform providing visibility across IT, OT, IoT, and medical devices for critical infrastructure protection.

Wiz

Cloud Security Company

Acquired by Google for $32 billion in March 2025

Cloud security platform acquired by Google for record $32 billion.

Palo Alto Networks

Cybersecurity Platform

Acquiring CyberArk for $25 billion, expected close early 2026

Network security giant pursuing platformization through identity and access management acquisition.

Timeline

ServiceNow Announces $7.75B Armis Acquisition
Acquisition

All-cash deal for asset visibility platform, ServiceNow's largest acquisition ever. Expected close second-half 2026.
December 23rd, 2025
Germany Approves Palo Alto-CyberArk Merger
Regulatory Approval

German competition authority clears $25 billion acquisition after in-depth review finds no competition concerns, removing regulatory uncertainty in major European market.
December 19th, 2025
ServiceNow Completes Moveworks Acquisition
Acquisition Closed

ServiceNow closes $2.85 billion Moveworks acquisition, combining agentic AI workflows with Moveworks' enterprise search and Reasoning Engine across 5.5 million employee users.
December 15th, 2025
Palo Alto Files for Turkish Regulatory Approval
Regulatory Filing

Palo Alto Networks requests clearance from Turkish competition authority for CyberArk acquisition, adding to ongoing multi-jurisdiction regulatory review process.
December 10th, 2025
ServiceNow Acquires Veza for ~$1B
Acquisition

Identity security firm Veza adds privileged access capabilities to ServiceNow's security portfolio.
December 1st, 2025
CyberArk Shareholders Approve Palo Alto Acquisition
Shareholder Vote

99.8% of CyberArk shareholders vote to approve $25 billion Palo Alto Networks acquisition at special meeting, clearing major hurdle for deal completion.
November 13th, 2025
Armis Closes $435M Pre-IPO Round at $6.1B
Funding

Goldman Sachs and CapitalG lead round as Armis prepares for 2026 IPO with $340M ARR growing 50%+.
November 5th, 2025
Palo Alto Confirms $25B CyberArk Deal
Acquisition

Second-largest cybersecurity acquisition, CyberArk shareholders get $45 cash plus 2.2 shares per share.
September 1st, 2025
Palo Alto-CyberArk Talks Surface
Deal Rumors

Reports emerge of $20B+ acquisition discussions between Palo Alto Networks and identity security firm CyberArk.
July 29th, 2025
Google Announces $32B Wiz Acquisition
Acquisition

Largest cybersecurity deal ever, Google's biggest purchase outright. DOJ clears merger after antitrust review.
March 18th, 2025
ServiceNow Acquires Moveworks for $2.85B
Acquisition

ServiceNow's first billion-dollar+ security acquisition, adding AI assistant and agentic reasoning capabilities.
March 10th, 2025
Armis Raises $200M at $4.2B Valuation
Funding

General Catalyst and Alkeon Capital lead Series D, surpassing $200M annual recurring revenue.
October 1st, 2024
Mastercard Buys Recorded Future for $2.65B
Acquisition

Financial services firm acquires threat intelligence company, expanding non-security buyers into cybersecurity.
September 1st, 2024
Wiz Rejects Google's $23B Offer
Deal Rejected

Cloud security startup Wiz turns down Google acquisition citing antitrust concerns under Biden administration.
July 1st, 2024
Cisco Completes $28B Splunk Acquisition
Acquisition

Cisco closes massive purchase of security analytics platform Splunk, signaling start of consolidation wave.
March 18th, 2024

Scenarios

Predict which scenario wins. Contrarian picks score more — points lock in when the scenario resolves.

Predictions leaderboard

Platform Monopolies: Three Giants Control Enterprise Security by 2028

The consolidation accelerates as Google-Wiz, Microsoft-security portfolio, and ServiceNow-Armis become the three dominant security operating systems. Enterprises slash from 83 tools to under 15, concentrating spending with platform vendors who offer unified visibility from endpoint to cloud. Smaller security startups either get acquired or die—venture funding dries up for point solutions. CISOs who bet early on platforms realize 101% ROI and 72-day faster incident detection. Those who don't consolidate face talent shortages managing fragmented tools and fall further behind. Regulatory pressure grows around platform market power, but agencies struggle to define remedies. The $212 billion cybersecurity market becomes winner-take-most.

Discussed by: Gartner, Forrester, Cloud Wars analysts tracking platformization trends

Consensus —

Antitrust Crackdown Blocks Mega-Deals, Fragmentation Persists

Regulators reverse course after clearing Google-Wiz, blocking the Palo Alto-CyberArk and ServiceNow-Armis deals as anticompetitive roll-ups. The FTC argues that eliminating security specialists reduces innovation and locks enterprises into platform vendor ecosystems. Legal battles drag into 2027. Blocked deals chill M&A activity, forcing platforms to build capabilities organically—slower and more expensive. Armis and CyberArk pursue successful IPOs. Enterprises remain stuck managing dozens of vendors, but specialized tools advance faster without platform absorption. Security fragmentation persists, but best-of-breed solutions thrive.

Discussed by: Antitrust scholars, FTC observers noting 2024 serial acquisition scrutiny

Consensus —

AI Security Redefines Platforms: Agentic Defense Becomes the Game

The platform wars pivot from vendor consolidation to AI agent capabilities. Enterprises discover that unified dashboards matter less than autonomous AI agents that detect, investigate, and remediate threats without human intervention. ServiceNow's "AI control tower" vision plays out—Armis asset visibility feeds AI agents that automatically patch vulnerabilities, isolate compromised devices, and orchestrate incident response across IT and OT environments. Competitors rush to match agentic security capabilities. The differentiator isn't breadth of security tools but quality of AI reasoning and speed of autonomous action. Companies that win on agent intelligence capture the market regardless of how many acquisitions they made.

Discussed by: Security researchers, AI analysts, enterprise CIOs experimenting with autonomous agents

Consensus —

Armis Integration Disaster: ServiceNow Overpaid, Enterprise Customers Revolt

ServiceNow struggles to integrate Armis's OT and IoT asset visibility with its IT service management platform. Cultural clashes emerge—Armis's startup engineers resist ServiceNow's enterprise processes. Key Armis talent leaves despite $500 million retention packages. Customers complain that Armis functionality deteriorates post-acquisition while ServiceNow bundles force them to buy unwanted products. Security-focused buyers defect to Palo Alto Networks and pure-play vendors. Wall Street punishes ServiceNow's stock as the Armis deal fails to deliver promised synergies. McDermott faces board pressure. The acquisition becomes a cautionary tale about platform overreach, and consolidation enthusiasm cools across the industry.

Discussed by: Technology industry observers citing historical mega-acquisition failures

Consensus —

Historical Context

Cisco's Acquisition Binge (1993-2000)

1993-2000

What Happened

Cisco executed over 70 acquisitions during the dot-com boom to build a comprehensive networking platform, spending billions to add capabilities rather than building organically. The strategy made Cisco the most valuable company in the world by March 2000 at $555 billion market cap. Then the dot-com crash hit, integration challenges surfaced, and Cisco's value plummeted 86% in two years.

Outcome

Short Term

Cisco dominated networking equipment but faced massive write-downs and integration nightmares post-crash.

Long Term

Cisco remained a networking leader but never regained its growth trajectory or platform dominance aspirations.

Why It's Relevant Today

ServiceNow's $11.6B acquisition spree in 2025 mirrors Cisco's platform-building strategy—betting that breadth beats depth and that integration challenges are manageable. History suggests otherwise.

Salesforce Platform Consolidation (2011-2016)

2011-2016

What Happened

Salesforce acquired ExactTarget ($2.5B), Demandware ($2.8B), and dozens of smaller companies to transform from CRM into a complete marketing and commerce cloud platform. The strategy worked—Salesforce grew from $2B to $8B in revenue by expanding beyond its core product into adjacent enterprise workflows.

Outcome

Short Term

Acquisitions successfully expanded Salesforce's addressable market and deepened customer relationships.

Long Term

Salesforce became a $30B+ revenue platform, validating platform consolidation for enterprise software.

Why It's Relevant Today

ServiceNow is following Salesforce's playbook, expanding from IT service management into security and business workflows. The question: can ServiceNow execute integrations as effectively as Salesforce did?

Symantec's Failed Security Consolidation (2010-2019)

2010-2019

What Happened

Symantec acquired VeriSign ($1.28B), Clearwell ($390M), and dozens of security companies to build a unified platform protecting endpoints, networks, and data. The strategy collapsed under integration complexity and product bloat. Customers complained about buggy software and poor support. Symantec's market share eroded as nimble startups delivered better point solutions.

Outcome

Short Term

Revenue grew through acquisitions but profitability and customer satisfaction declined sharply.

Long Term

Symantec split into two companies in 2019, selling enterprise security to Broadcom for $10.7B at a fraction of peak value.

Why It's Relevant Today

A cautionary tale for ServiceNow and Palo Alto: buying security companies is easy, integrating them into a coherent platform that customers actually want is brutally hard.