ServiceNow, Inc. (NYSE: NOW) stock traded lower on Tuesday, December 23, 2025, after the enterprise software leader announced its largest acquisition to date: a $7.75 billion all‑cash agreement to buy cyber exposure management specialist Armis. The move is designed to deepen ServiceNow’s security and risk footprint—especially across operational technology (OT), IoT, and medical devices—at a moment when AI adoption is expanding corporate “attack surfaces” and making cyber governance a board-level priority. [1]
But Wall Street’s first reaction was cautious. ServiceNow shares were down roughly 3% in midday trading in broader market coverage, and the stock hovered around $152.5 (split-adjusted) at the time of the latest available quote—down about 2.7% on the day. [2]
Below is what investors are watching today: the deal terms, strategic rationale, why the market flinched, where analysts see the stock going from here, and the key catalysts into 2026.
Why ServiceNow stock is down today
The immediate driver is straightforward: deal size and deal timing.
ServiceNow is paying $7.75 billion in cash for Armis—its biggest purchase ever—and plans to finance it with a combination of cash on hand and debt, with closing expected in the second half of 2026 (pending regulatory approvals and other conditions). [3]
Large acquisitions often pressure a buyer’s shares on announcement day because investors start doing three things at once:
- Repricing for potential leverage (higher interest costs and reduced flexibility)
- Questioning integration risk (especially across product stacks and go-to-market teams)
- Debating whether management is buying growth rather than building it organically
That pattern is visible in today’s tape: Reuters reported ServiceNow shares fell about 3% as investors weighed the company’s recent acquisition “splurge,” even as ServiceNow positioned the deal as a security-forward response to AI-driven cyber risk. [4]
The headline: ServiceNow to acquire Armis for $7.75 billion
Deal terms and timing
ServiceNow said it has entered into a definitive agreement to acquire Armis for approximately $7.75 billion in cash (subject to customary adjustments) and expects to fund the purchase with cash on hand and debt. The transaction is expected to close in the second half of 2026. [5]
What Armis does
Armis focuses on cyber exposure management and cyber-physical security—a crucial angle as enterprises connect more devices to networks and run more AI workloads across distributed environments.
In ServiceNow’s announcement, Armis is described as providing deep, real-time, “agentless” visibility and classification across managed and unmanaged assets, including OT, IoT, medical, and industrial devices—areas that traditional tools often struggle to map continuously. [6]
Armis growth profile (what ServiceNow is buying)
ServiceNow’s release highlights Armis as having:
- Surpassed $340 million in annual recurring revenue (ARR)
- Year-over-year ARR growth exceeding 50%
- Roughly 950 employees
- Adoption across large enterprises, including a significant share of major U.S. corporates [7]
From a valuation perspective, using ServiceNow’s disclosed ARR figure, the purchase price implies roughly ~23x ARR (a simple $7.75B ÷ $340M calculation). That’s one reason the deal is getting “price paid” scrutiny in early commentary. [8]
The strategic pitch: security + workflow automation + “agentic AI governance”
ServiceNow is framing the deal as a way to build a unified, end‑to‑end security exposure and operations stack—one that can “see, decide, and act” across IT, OT, and medical device ecosystems by pairing Armis’ discovery/intelligence with ServiceNow workflows for prioritization and remediation. [9]
Two additional details matter for investors evaluating whether this is a “platform win” or an expensive bolt-on:
- ServiceNow says its Security and Risk business crossed $1 billion in annual contract value (ACV) in Q3 2025, positioning security as a material growth vector rather than a side module. [10]
- Management claims the Armis acquisition could more than triple ServiceNow’s market opportunity for security and risk solutions—an explicit attempt to justify the magnitude of the spend. [11]
Reuters also reported a key management signal aimed at calming fears of an open-ended buying spree: ServiceNow CFO Gina Mastantuono said the company’s security stack would be “very well positioned” after Armis and implied it wouldn’t need more security M&A. [12]
Why investors are uneasy: acquisition cadence and integration risk
Today’s deal lands in the middle of a busy M&A stretch for ServiceNow.
Reuters noted that ServiceNow has bought multiple companies in recent months, including security firm Veza, AI company Moveworks, and sales automation platform Logik.ai—and said ServiceNow closed its $2.85 billion Moveworks acquisition this month. [13]
ServiceNow and Moveworks separately confirmed the Moveworks transaction closed on Dec. 15, 2025, positioning it as a major step in building an “AI-native front door” for employee engagement that combines agentic AI, enterprise search, and workflow automation. [14]
That context helps explain why the Armis announcement hit a skeptical note: investors are still digesting the last integration when the next (bigger) one arrives.
This skepticism has also shown up in recent trading. Last week, when Armis-buyout rumors were circulating, ServiceNow shares fell sharply; Investopedia described the stock dropping more than 11% on Dec. 15, 2025 as investors reacted to the prospect of a pricey deal. [15]
The stock split factor: why ServiceNow’s share price looks “lower” in late December
Another reason headlines can feel confusing this week: ServiceNow just completed a five-for-one stock split.
ServiceNow said shareholders approved the split on Dec. 5, 2025, with distribution after market close on or about Dec. 17 for shareholders of record as of Dec. 16. Trading on a split-adjusted basis was expected to begin on Dec. 18, 2025. [16]
That means today’s ~$152 price level is post‑split. In rough “pre‑split equivalent” terms, $152 × 5 implies something like ~$760 (though historical comparisons should always use split-adjusted data).
The split also forced analysts to mechanically adjust targets. For example, Stifel cut its price target to $230 from $1,150 while maintaining a Buy rating, explicitly describing the change as a math adjustment tied to the new share count rather than a change in underlying fundamentals. [17]
Analyst forecasts for ServiceNow stock: what Wall Street expects now
Despite today’s pullback, aggregated analyst outlooks remain broadly positive.
A widely followed consensus snapshot shows:
- Consensus rating: Strong Buy
- Average 12-month price target:$223.29
- Target range:$155 (low) to $260 (high) [18]
Recent examples of updated calls around the split and deal-news window include:
- BTIG reiterated a Buy and maintained a $200 target (reported Dec. 22, 2025). [19]
- Stifel maintained Buy and adjusted its target to $230 to reflect the 5-for-1 split (published Dec. 19, 2025). [20]
Notably, there have also been cautious voices in recent days around the rumored deal phase—underscoring the push-pull in sentiment between “platform expansion” and “M&A risk.” [21]
The bull case: strong fundamentals and AI-driven workflow demand
Bulls argue that the market’s acquisition-day anxiety is clashing with ServiceNow’s core operating performance.
In its third-quarter 2025 results (reported Oct. 29, 2025), ServiceNow posted:
- Subscription revenue:$3.299 billion, up 21.5% year over year
- Total revenue:$3.407 billion, up 22% year over year
- Current remaining performance obligations (cRPO):$11.35 billion, up 21% year over year [22]
Reuters also reported that, on that Q3 print, ServiceNow raised its full‑year subscription revenue forecast on AI demand—another data point supporting the view that demand remains durable even with large enterprises scrutinizing budgets. [23]
From this perspective, Armis isn’t a pivot—it’s an attempt to widen ServiceNow’s control-tower role by tying security exposure data directly into enterprise workflows and automation.
The bear case: “overpaying” concerns and questions about synergy
The most pointed critiques focus on valuation and fit.
Bearish commentary published today argues that ServiceNow may be paying a steep multiple for Armis and questions how much “cross-sell synergy” is realistically captured when moving beyond ServiceNow’s historic core in IT service management and workflow automation. [24]
Reuters also highlighted that Armis was valued at $6.1 billion in a November funding round and was preparing for an IPO—context that naturally invites “premium paid” comparisons now that a strategic buyer has stepped in. [25]
Using Reuters’ $6.1B figure, the $7.75B purchase price implies roughly a ~27% premium to that recent private valuation (again, a simple arithmetic comparison, not a full valuation model). [26]
What to watch next: catalysts and risk points into 2026
With the announcement out, the next “stock-moving” checkpoints likely include:
- Financing clarity and balance sheet messaging
The company expects a mix of cash and debt funding, which makes interest-rate assumptions and leverage tolerance part of the conversation. [27] - Regulatory timeline
Closing is targeted for the second half of 2026, leaving a long runway for approval and execution risk. [28] - Integration progress across multiple acquisitions
ServiceNow only recently completed Moveworks (Dec. 15, 2025). Investors will want evidence that ServiceNow can integrate product, sales motions, and customer outcomes without losing momentum. [29] - Organic growth versus “M&A growth”
Management has signaled a desire not to keep buying in security after Armis. Whether the market believes that—and whether organic growth sustains above-20% subscription growth rates—will matter. [30]
Bottom line for ServiceNow (NOW) stock on Dec. 23, 2025
ServiceNow stock is lower today because the market is reacting to the scale and timing of a transformative acquisition—not because ServiceNow’s core business suddenly looks broken.
The Armis deal has clear strategic logic in an AI-driven world where boards want one place to map assets, prioritize risk, and automate response. But investors are demanding proof that ServiceNow can absorb another major acquisition—financed partly with debt—while sustaining premium growth and margin narratives.
If management can show that Armis accelerates the security roadmap and expands platform attach without derailing execution, today’s pullback could fade into the background. If integration drags, costs rise, or organic growth slows, the “acquisitions spook Wall Street” storyline could persist.
This article is for informational purposes only and is not investment advice.
References
1. investor.servicenow.com, 2. www.reuters.com, 3. investor.servicenow.com, 4. www.reuters.com, 5. investor.servicenow.com, 6. investor.servicenow.com, 7. investor.servicenow.com, 8. investor.servicenow.com, 9. investor.servicenow.com, 10. investor.servicenow.com, 11. investor.servicenow.com, 12. www.reuters.com, 13. www.reuters.com, 14. www.moveworks.com, 15. www.investopedia.com, 16. investor.servicenow.com, 17. www.investing.com, 18. stockanalysis.com, 19. www.gurufocus.com, 20. www.investing.com, 21. www.barrons.com, 22. www.servicenow.com, 23. www.reuters.com, 24. seekingalpha.com, 25. www.reuters.com, 26. www.reuters.com, 27. investor.servicenow.com, 28. investor.servicenow.com, 29. www.moveworks.com, 30. www.reuters.com
