ServiceNow acquires Armis to secure agentic AI attack surface

ServiceNow announced on December 23, 2025 that it will acquire cybersecurity vendor Armis for $7.75 billion to expand visibility and protection across the full attack surface, including IT, operational technology (OT), and medical devices, according to the company press release and reporting by TechCrunch and MarketWatch. ServiceNow positions the acquisition as part of a broader effort to harden enterprise environments as organizations adopt more AI-enabled tooling and face new AI-driven threats.

On the same day, Crittora published a press release introducing a cryptographic trust layer for agentic AI systems that provides attestation and provenance for agent actions and tool use. Security vendors and reporters frame these moves as complementary: device- and asset-level telemetry from Armis, combined with cryptographic provenance for autonomous agents, would help security operations centers (SOCs) prioritize and validate automated responses.

For practitioners, immediate implications include consolidation of device telemetry into centralized platforms, tighter integration between asset visibility and agent control planes, and new requirements for cryptographic signing and attestation of automated playbooks. SOC teams will need integration work, validation of agent provenance, and policy and risk reviews before they can safely expand autonomous remediation.

Why It Matters

• Centralized asset visibility across IT, OT, and medical devices reduces blind spots and helps SOCs verify where automated agents acted.
• Cryptographic attestation of agent actions establishes provenance, making automated triage and remediation auditable and safer.
• Plan integration and validation work now: consolidating telemetry and implementing signing/attestation frameworks will be prerequisites for safe agentic automation.
• Expect tighter vendor integrations and new compliance questions as acquisitions and cryptographic tooling align around automated defenses.