Enterprise software giants are spending tens of billions to become the single platform controlling cybersecurity across IT, cloud, and critical infrastructure
Enterprise software giants are spending tens of billions to become the single platform controlling cybersecurity across IT, cloud, and critical infrastructure
ServiceNow just agreed to pay $7.75 billion in cash for Armis, a cybersecurity startup that tracks vulnerabilities across hospital medical devices, factory equipment, and corporate networks. It's ServiceNow's largest acquisition ever—and its third billion-dollar security buy in 2025 alone. CEO Bill McDermott calls it building an "AI control tower" for cybersecurity. Wall Street calls it a land grab.
ServiceNow just agreed to pay $7.75 billion in cash for Armis, a cybersecurity startup that tracks vulnerabilities across hospital medical devices, factory equipment, and corporate networks. It's ServiceNow's largest acquisition ever—and its third billion-dollar security buy in 2025 alone. CEO Bill McDermott calls it building an "AI control tower" for cybersecurity. Wall Street calls it a land grab.
The deal caps a frenzied 21 months where enterprise software companies and tech giants spent over $90 billion acquiring cybersecurity firms. Google bought Wiz for $32 billion. Palo Alto grabbed CyberArk for $25 billion. Cisco swallowed Splunk for $28 billion. The common thread: companies with 83 security tools from 29 vendors are desperate to consolidate, and the winners will control the operating system layer for enterprise security.
All-cash deal for asset visibility platform, ServiceNow's largest acquisition ever. Expected close second-half 2026.
Germany Approves Palo Alto-CyberArk Merger
Regulatory Approval
German competition authority clears $25 billion acquisition after in-depth review finds no competition concerns, removing regulatory uncertainty in major European market.
ServiceNow Completes Moveworks Acquisition
Acquisition Closed
ServiceNow closes $2.85 billion Moveworks acquisition, combining agentic AI workflows with Moveworks' enterprise search and Reasoning Engine across 5.5 million employee users.
Palo Alto Files for Turkish Regulatory Approval
Regulatory Filing
Palo Alto Networks requests clearance from Turkish competition authority for CyberArk acquisition, adding to ongoing multi-jurisdiction regulatory review process.
ServiceNow Acquires Veza for ~$1B
Acquisition
Identity security firm Veza adds privileged access capabilities to ServiceNow's security portfolio.
99.8% of CyberArk shareholders vote to approve $25 billion Palo Alto Networks acquisition at special meeting, clearing major hurdle for deal completion.
Armis Closes $435M Pre-IPO Round at $6.1B
Funding
Goldman Sachs and CapitalG lead round as Armis prepares for 2026 IPO with $340M ARR growing 50%+.
Palo Alto Confirms $25B CyberArk Deal
Acquisition
Second-largest cybersecurity acquisition, CyberArk shareholders get $45 cash plus 2.2 shares per share.
Palo Alto-CyberArk Talks Surface
Deal Rumors
Reports emerge of $20B+ acquisition discussions between Palo Alto Networks and identity security firm CyberArk.
Google Announces $32B Wiz Acquisition
Acquisition
Largest cybersecurity deal ever, Google's biggest purchase outright. DOJ clears merger after antitrust review.
ServiceNow Acquires Moveworks for $2.85B
Acquisition
ServiceNow's first billion-dollar+ security acquisition, adding AI assistant and agentic reasoning capabilities.
Armis Raises $200M at $4.2B Valuation
Funding
General Catalyst and Alkeon Capital lead Series D, surpassing $200M annual recurring revenue.
The consolidation accelerates as Google-Wiz, Microsoft-security portfolio, and ServiceNow-Armis become the three dominant security operating systems. Enterprises slash from 83 tools to under 15, concentrating spending with platform vendors who offer unified visibility from endpoint to cloud. Smaller security startups either get acquired or die—venture funding dries up for point solutions. CISOs who bet early on platforms realize 101% ROI and 72-day faster incident detection. Those who don't consolidate face talent shortages managing fragmented tools and fall further behind. Regulatory pressure grows around platform market power, but agencies struggle to define remedies. The $212 billion cybersecurity market becomes winner-take-most.
Regulators reverse course after clearing Google-Wiz, blocking the Palo Alto-CyberArk and ServiceNow-Armis deals as anticompetitive roll-ups. The FTC argues that eliminating security specialists reduces innovation and locks enterprises into platform vendor ecosystems. Legal battles drag into 2027. Blocked deals chill M&A activity, forcing platforms to build capabilities organically—slower and more expensive. Armis and CyberArk pursue successful IPOs. Enterprises remain stuck managing dozens of vendors, but specialized tools advance faster without platform absorption. Security fragmentation persists, but best-of-breed solutions thrive.
3
AI Security Redefines Platforms: Agentic Defense Becomes the Game
Discussed by: Security researchers, AI analysts, enterprise CIOs experimenting with autonomous agents
The platform wars pivot from vendor consolidation to AI agent capabilities. Enterprises discover that unified dashboards matter less than autonomous AI agents that detect, investigate, and remediate threats without human intervention. ServiceNow's "AI control tower" vision plays out—Armis asset visibility feeds AI agents that automatically patch vulnerabilities, isolate compromised devices, and orchestrate incident response across IT and OT environments. Competitors rush to match agentic security capabilities. The differentiator isn't breadth of security tools but quality of AI reasoning and speed of autonomous action. Companies that win on agent intelligence capture the market regardless of how many acquisitions they made.
Discussed by: Technology industry observers citing historical mega-acquisition failures
ServiceNow struggles to integrate Armis's OT and IoT asset visibility with its IT service management platform. Cultural clashes emerge—Armis's startup engineers resist ServiceNow's enterprise processes. Key Armis talent leaves despite $500 million retention packages. Customers complain that Armis functionality deteriorates post-acquisition while ServiceNow bundles force them to buy unwanted products. Security-focused buyers defect to Palo Alto Networks and pure-play vendors. Wall Street punishes ServiceNow's stock as the Armis deal fails to deliver promised synergies. McDermott faces board pressure. The acquisition becomes a cautionary tale about platform overreach, and consolidation enthusiasm cools across the industry.
Historical Context
Cisco's Acquisition Binge (1993-2000)
1993-2000
What Happened
Cisco executed over 70 acquisitions during the dot-com boom to build a comprehensive networking platform, spending billions to add capabilities rather than building organically. The strategy made Cisco the most valuable company in the world by March 2000 at $555 billion market cap. Then the dot-com crash hit, integration challenges surfaced, and Cisco's value plummeted 86% in two years.
Outcome
Short Term
Cisco dominated networking equipment but faced massive write-downs and integration nightmares post-crash.
Long Term
Cisco remained a networking leader but never regained its growth trajectory or platform dominance aspirations.
Why It's Relevant Today
ServiceNow's $11.6B acquisition spree in 2025 mirrors Cisco's platform-building strategy—betting that breadth beats depth and that integration challenges are manageable. History suggests otherwise.
Salesforce Platform Consolidation (2011-2016)
2011-2016
What Happened
Salesforce acquired ExactTarget ($2.5B), Demandware ($2.8B), and dozens of smaller companies to transform from CRM into a complete marketing and commerce cloud platform. The strategy worked—Salesforce grew from $2B to $8B in revenue by expanding beyond its core product into adjacent enterprise workflows.
Outcome
Short Term
Acquisitions successfully expanded Salesforce's addressable market and deepened customer relationships.
Long Term
Salesforce became a $30B+ revenue platform, validating platform consolidation for enterprise software.
Why It's Relevant Today
ServiceNow is following Salesforce's playbook, expanding from IT service management into security and business workflows. The question: can ServiceNow execute integrations as effectively as Salesforce did?
Symantec acquired VeriSign ($1.28B), Clearwell ($390M), and dozens of security companies to build a unified platform protecting endpoints, networks, and data. The strategy collapsed under integration complexity and product bloat. Customers complained about buggy software and poor support. Symantec's market share eroded as nimble startups delivered better point solutions.
Outcome
Short Term
Revenue grew through acquisitions but profitability and customer satisfaction declined sharply.
Long Term
Symantec split into two companies in 2019, selling enterprise security to Broadcom for $10.7B at a fraction of peak value.
Why It's Relevant Today
A cautionary tale for ServiceNow and Palo Alto: buying security companies is easy, integrating them into a coherent platform that customers actually want is brutally hard.
