Armis and the machines hiding in plain sight

At Main Line Health, the first surprise was arithmetic. During a month-long evaluation, Armis detected a connected-device population in the low six figures, including thousands of biomedical devices. The health system had expected roughly half that number. Before anybody could debate which vulnerability deserved attention, there was a more awkward question: how had so much equipment escaped the count?

The machines were not necessarily hidden. They were doing their jobs. But an institution’s equipment and its security inventory can become two different things. A biomedical team knows a device as clinical equipment. IT knows an address. Procurement knows a purchase. An attacker needs only an opening between those descriptions.

The inventory was the first thing to fail

Main Line Health’s account, published by Armis, describes an existing asset-management system that could not provide comprehensive discovery. The evaluation changed the conversation by producing device-level detail the team had lacked. “We thought we had about half as many,” said Kevin Werner, its system director of operations. The discrepancy made an abstract security concern countable.

This is the opening Armis found in the market. Founded in 2015 by Yevgeny Dibrov and Nadir Izrael, it began with the expanding population of network-connected devices. The commercial insight was practical: equipment can be essential to an organization while remaining outside the tools used to secure its computers.

Listen before installing

A conventional endpoint agent is software installed on a device. That approach becomes difficult when the device is an infusion pump, an industrial controller or a machine with a tightly constrained operating system. Armis’s agentless approach observes network activity and combines it with information from systems the customer already operates. Collectors and integrations supply the evidence.

The Asset Intelligence Engine uses device characteristics and behavior to help classify assets and recognize deviations. Teams can investigate what something is, how it communicates and what risks surround it. The payoff is context: a computer missing protection software and a medical device unable to accept it require different decisions.

Research helped establish the company’s technical credentials. In September 2017, Armis disclosed BlueBorne, initially identifying eight Bluetooth-related vulnerabilities across major operating systems. The unsettling detail was the medium itself. A radio connection could create an attack route outside the familiar picture of a malicious link arriving in someone’s inbox.

The expensive distance between find and fix

Today, Armis sells Centrix as a modular exposure-management platform. Asset management supplies the inventory. Medical-device and OT/IoT security add specialized context. Vulnerability products help teams decide what deserves attention and coordinate remediation. Early Warning adds threat intelligence; application security extends the scope into software development. Buyers are enterprise teams, rather than individuals shopping for antivirus.

Armis spent $150 million acquiring Silk Security in April 2024. Silk’s contribution addressed an organizational problem: findings accumulate faster than teams can assign and resolve them. Correlating alerts matters, but so does identifying an owner. The acquisition helped connect the security team’s diagnosis to work somebody could actually perform.

The market is crowded. Claroty, Nozomi Networks, Forescout and Dragos address overlapping industrial-security needs. Armis’s proposition joins that physical equipment estate with broader enterprise asset and remediation work. It also works through other vendors: its Check Point integration pairs device intelligence with policy enforcement. Discovery becomes more useful when existing controls can act on it.

The IPO that became a different route

Armis sells enterprise subscriptions through direct sales and partners, with pricing shaped by contract scope. Its growth attracted substantial capital: $200 million in October 2024, then $435 million in November 2025 at a $6.1 billion valuation. At the latter announcement, Armis reported more than $300 million in annual recurring revenue. That subscription metric is different from recognized annual revenue.

An IPO was the stated destination. ServiceNow offered another route. In an interview after the deal announcement, Dibrov explained that its resources and reach among large enterprises could accelerate what Armis wanted to build. ServiceNow executive Pablo Stern traced the relationship to shared customers asking the companies to work together. The eventual acquisition grew out of an existing operational connection.

The useful unit of security is a device, its business role, and someone responsible for changing it.

An editorial reading of Armis’s approach

ServiceNow completed the purchase on April 20, 2026, announcing approximately $7.75 billion in cash. Its rationale connected Armis’s asset intelligence to its own workflows. Centrix would remain available separately while integration deepened. The meaningful test is what happens after an exposure is identified: whether the right team receives actionable work, and whether the change can be checked.

Start with one uncomfortable count

There is a method here readers can borrow. Run a bounded evaluation. Compare discovered assets with the accepted inventory. Bring equipment owners into the discrepancies. Then follow one finding through assignment and resolution. A prettier dashboard is a weak success criterion; a newly understood device with a responsible owner is more useful.

Deployment conditions still matter. Passive observation needs relevant traffic, and integrations need access. Armis’s 2025 OTORIO acquisition added on-premises capability for air-gapped industrial environments, acknowledging that cloud delivery cannot fit every site. A hospital also cannot simply interrupt essential equipment to satisfy a security queue. In Wales, CTM Health Board’s estate included an endoscopy-scanning van. The inventory problem follows the work, even when the work has wheels.