The hard part of medical device cybersecurity is not discovering that a hospital has more connected assets than anyone expected. Most large health systems have already learned that lesson the uncomfortable way: an inventory project finds unmanaged imaging workstations, infusion pumps, patient monitors, building systems, carts, lab equipment, and vendor-managed devices sitting outside the clean boundaries of the EHR and endpoint program. The harder question is what happens next, especially when 53% of medical devices carry known unpatched vulnerabilities and the average hospital has more than 17 connected devices per bed.[1]
That is the practical frame for ServiceNow’s acquisition of Armis. The deal matters less because it gives ServiceNow a larger cybersecurity story and more because it takes aim at a familiar break in hospital operations: security can see risk faster than biomedical engineering, clinical operations, IT networking, compliance, and device owners can safely act on it.
ServiceNow completed the Armis acquisition on April 20, 2026, after announcing the $7.75 billion transaction in December 2025.[1] In healthcare, the significant claim is not simply that a workflow company bought an asset intelligence company. It is that real-time, agentless visibility into medical and connected devices could be joined to the same workflow machinery hospitals already use for incident response, change control, risk management, CMDB records, audit evidence, and remediation tickets.
The Gap Is After Visibility
Medical devices do not behave like ordinary laptops. Many cannot take standard endpoint agents. Some run old operating systems because the certified device stack has not changed. Some are managed by vendors. Some sit in clinical spaces where the security consequence of an outage is not a delayed spreadsheet but a disrupted procedure, a moved patient, or a biomedical engineer pulled into an urgent exception review.
That reality turns asset visibility into an operational promise. A dashboard that finds an unpatched pump is useful. A dashboard that leaves the security operations center to email biomedical engineering, wait for device ownership confirmation, negotiate a maintenance window, ask networking for segmentation, and then manually assemble audit evidence is only half a control.
This is why the ServiceNow-Armis combination lands differently in healthcare than in a generic enterprise IoT environment. The strongest version of the argument is a workflow argument: discovery, clinical risk context, enterprise asset enrichment, remediation, segmentation, exception management, and governance should not require a handoff at every boundary.
What the Combined Workflow Is Supposed to Change
Armis brings the front end of this sequence: agentless discovery and behavior analysis across connected assets, including medical devices. Its medical device security platform says it tracks roughly 7 billion devices in real time and uses an asset intelligence engine covering more than 6.5 billion known devices globally.[2] ServiceNow brings the system of action: workflow orchestration, tickets, approvals, CMDB enrichment, security operations, risk governance, and reporting.
In a hospital, the useful test is whether the acquisition can make the following chain feel like one governed process rather than five separate projects.
| Workflow point | What changes if integration works | Who feels the difference |
|---|---|---|
| Agentless discovery | A connected medical device is identified without installing an endpoint agent or waiting for manual inventory reconciliation. | Security operations, biomedical engineering, asset management |
| Clinical risk identification | The vulnerability is interpreted with device type, behavior, location, exposure, and patient-care relevance instead of only a generic CVE score. | CISO team, biomedical engineering, clinical department leadership |
| Enterprise asset enrichment | The device record is connected to ownership, location, service history, dependencies, and governance fields in the enterprise system. | CMDB owners, compliance teams, IT service management |
| Remediation and segmentation | A work order, exception, patch review, isolation action, or network segmentation change is triggered with the right approvals. | Biomedical engineering, network teams, change advisory boards |
| Governance and evidence | The response is tracked through status, risk acceptance, audit trail, and policy reporting instead of living in side spreadsheets. | Risk, compliance, audit, executive security leadership |
The middle of that table is where many programs stall. Device discovery produces more truth than the organization can absorb. Vulnerability management adds more urgency than clinical teams can execute. Network segmentation promises containment, then runs into the reality that a device may depend on a vendor service, a nurse call integration, a radiology workflow, or a protocol that nobody wants to break during patient care.
If ServiceNow can preserve Armis’s device-level visibility while turning findings into governed action, the platform would address a genuine hospital bottleneck. A vulnerable infusion pump should not merely become a red dot. It should become a record with an owner, clinical context, compensating controls, a remediation path, a due date, an exception trail if remediation is not possible, and evidence that the response happened.
Where Healthcare AI Enters the Picture
The phrase “AI Control Tower” deserves some discipline. In ServiceNow’s acquisition narrative, the AI Control Tower is the governance layer connecting asset visibility, identity, risk, and workflow automation.[3] For healthcare, that is only meaningful if the AI layer improves triage, routing, prioritization, and governance without flattening clinical nuance into ordinary enterprise security language.
There are credible ingredients. Armis has the device intelligence and behavior telemetry. ServiceNow has the workflow base and the enterprise records where approvals, incidents, risk acceptances, audit evidence, and remediation tasks already live. ServiceNow’s Security and Risk business crossed $1 billion in annual contract value in Q3 2025, and analysts have described the Armis and Veza acquisitions as part of a move to expand ServiceNow’s security total addressable market from about $30 billion to $100 billion.[3][4]
But adoption scale is not the same as healthcare effectiveness. An AI-governed workflow has to answer operationally specific questions: Is this device actively communicating in a way that raises exposure? Does the recommended action require vendor approval? Would isolation interrupt clinical operations? Is the device in a patient-care area or a lab? Has biomedical engineering accepted temporary risk because a patch is not available? Those answers are not decorative metadata. They decide whether automation reduces risk or just accelerates bad tickets.
The AI value, if it materializes, will likely be less glamorous than the phrase suggests. It will be in better queues, fewer duplicate findings, smarter routing, cleaner risk explanations, faster exception reviews, and more consistent governance across thousands of devices that cannot all be treated like standard IT endpoints.
The Main Line Health Case Shows the Direction, Not the Average
Main Line Health is the most concrete healthcare example available from the materials around Armis’s healthcare momentum. In an Armis-published account, the health system discovered twice as many assets as expected, streamlined HIPAA audits, and reduced remediation time from more than two hours to about one minute by integrating Armis with existing security tools.[5]
That result is worth attention because it describes exactly the kind of reduction hospitals care about: not a more impressive asset count by itself, but less time moving from finding to action. It also needs to be read carefully. The evidence is vendor-published, and it reflects a specific deployment context rather than a neutral benchmark for what every health system should expect.
Mater Hospital in Ireland appears in the same Armis healthcare materials as an organization using Armis to close security blind spots and support compliance with the EU NIS Directive.[5] Armis also names healthcare and life sciences customers including Main Line Health, Mater Hospital, Corewell, Advent Health, and Takeda, while saying its broader customer base includes 9 of the Fortune 10 and more than 35% of the Fortune 100.[5] Those facts support market presence. They do not prove that the combined ServiceNow-Armis product has already solved the integration problem at health-system scale.
Proven Components, Unproven Combination
Armis enters the acquisition with independent market validation. Dark Reading reported that Armis was named a Leader in the 2026 Gartner Magic Quadrant for CPS Protection Platforms for the second consecutive year.[3] Forrester had also identified Armis as a Leader in IoT Security in its Q3 2025 Wave, while warning that how integrations and licensing play out would be paramount after the ServiceNow deal.[6]
That warning is more relevant to hospitals than a broad M&A victory lap. Integration quality determines whether biomedical engineering receives useful work queues or a flood of poorly scoped tasks. Licensing clarity determines whether device security becomes an enterprise capability or another module that only part of the organization can afford to use. Data-model alignment determines whether a clinical device appears in the CMDB as a living risk object or as a stale asset record with a better import source.
There is also a timing issue. The acquisition closed only three months before this article’s current date. Public evidence can support the strength of Armis’s visibility platform, the size of ServiceNow’s security workflow business, and the logic of combining the two. It cannot yet support a confident claim that the combined platform has repeatedly delivered end-to-end medical device remediation across large, complex health systems after the close.
Some of the more ambitious security claims should be handled the same way. Avasant reported that Armis provided vulnerability alerts up to 693 days before public disclosure in an example involving CVE-2022-43939.[4] That suggests the asset intelligence engine can create earlier warning in some circumstances. It does not mean every hospital will receive actionable clinical remediation guidance nearly two years before a public vulnerability disclosure, nor does it remove the need to validate whether the recommended action is safe for a specific care environment.
Why This Is Different From Another IoT Security Tool
Hospitals already have choices in IoT, OT, and medical device security. The reason ServiceNow-Armis is structurally interesting is not that it replaces every specialized control. It is that it tries to make visibility and remediation part of the same enterprise operating system.
A point solution can tell a security team that an imaging workstation is exposed. A vulnerability platform can rank the CVE. A network tool can enforce a segmentation rule. A service management platform can create a ticket. A governance system can collect evidence. The hospital problem is that each step may have a different owner, different data quality, different urgency language, and different tolerance for clinical disruption.
The acquisition’s healthcare AI significance rests on whether those steps become coordinated enough to change behavior. If the combined platform can identify a vulnerable device, understand its role in care delivery, enrich the enterprise asset record, route the right task to biomedical engineering or networking, recommend a safe compensating control, and preserve the governance trail, then it closes a long-standing gap. If it only places Armis findings inside a ServiceNow experience without changing ownership, prioritization, or execution speed, the operational gain will be much smaller.
The Remaining Healthcare Test
The practical test should center on workflow evidence rather than acquisition language. A health system does not need another console that proves the environment is complicated. It needs a way to turn medical device risk into accountable work without creating unsafe interruptions or burying clinical exceptions.
- Whether Armis’s real-time, agentless device intelligence remains fast and clinically specific after it is connected to ServiceNow records and workflows.
- Whether ServiceNow can enrich CMDB and risk records with medical-device context that biomedical engineering and clinical operations recognize as accurate.
- Whether remediation tickets carry enough detail to act on safely, including ownership, location, dependency, exposure, available compensating controls, and approval requirements.
- Whether AI-assisted prioritization distinguishes patient-care consequence from generic enterprise severity.
- Whether licensing and packaging allow the full visibility-to-remediation loop to operate across security, IT, biomedical engineering, and compliance rather than inside a narrow buyer silo.
The medtech manufacturer angle is adjacent but important. MD+DI framed the acquisition as relevant to manufacturers because stronger post-market visibility and cybersecurity workflow expectations can affect how device makers support customers, vulnerabilities, and lifecycle risk.[7] For hospitals, that reinforces a larger point: medical device security is increasingly shared across providers, manufacturers, platforms, and regulators, but the operational burden still lands inside the health system when a vulnerable device has to remain available for care.
The Industry-Intelligence Read
ServiceNow’s Armis acquisition is one of the more consequential healthcare cybersecurity platform moves because it targets the break between medical device visibility and action. The combined company can plausibly offer something hospitals have wanted for years: a governed path from discovering an exposed clinical asset to assigning, approving, executing, segmenting, documenting, or accepting risk around that asset.
The impact on healthcare AI remains conditional. The ingredients are strong: Armis’s real-time device intelligence, healthcare deployments, and market recognition; ServiceNow’s workflow, security operations, risk, and governance base; and a control-tower concept that fits the way complex organizations actually manage accountable work. The open question is whether the post-close integration turns those ingredients into cleaner queues, safer remediation, and auditable clinical-risk decisions across large health systems.
That is the standard the deal should be held to. Not whether the acquisition sounds strategically logical. It does. The healthcare test is whether an unpatched device in a patient-care environment moves from detection to governed action with fewer handoffs, fewer blind spots, and less operational friction than before.
References
- ServiceNow completes Armis acquisition, closing the gap between asset visibility and cyber risk — ServiceNow, 2026
- Armis Centrix for Medical Device Security — Armis
- ServiceNow Buys Armis, Gets AI Control Tower — Dark Reading
- ServiceNow’s Veza and Armis Acquisitions Solidify Foundations for Enterprise AI Security — Avasant
- Armis Announces Significant Business Momentum in Healthcare — Armis
- ServiceNow Buys Armis To Improve Its Proactive Security Platform — Forrester
- What ServiceNow’s New $7.75B Acquisition Means for Medtech — MD+DI
Comments
Join the discussion with an anonymous comment.