ServiceNow reported second-quarter results the evening of Wednesday, July 22, beating Wall Street’s expectations on revenue, margin, and bookings.
The backdrop made that harder than it sounds. Investors had spent the prior week watching IBM and Pegasystems blame artificial intelligence spending shifts for wrecking their own software businesses, and the market was primed to punish any sign of the same weakness.
IBM shares fell 25% on July 14, after warning that clients were shifting technology budgets toward AI infrastructure instead of software.
Pegasystems followed on July 22, dropping more than 16% after missing revenue estimates and citing what it called unprecedented disruption from AI competition, according to Yahoo Finance.
Traders had started calling it the “SaaSpocalypse,” Forbes noted, a bet that enterprise software growth was about to slow across the board.
ServiceNow (NOW) avoided that fate. Subscription revenue reached $3.9 billion in the quarter, up 24.5% from a year earlier, a ServiceNow press release confirmed.
Shares climbed 5.5% in premarket trading Thursday, July 23, to $100.67, according to Benzinga, as the same release disclosed that artificial intelligence contract value had crossed $1 billion, the number that dominated most of the day’s coverage.
A different billion-dollar number tells ServiceNow’s real story
That AI milestone was not the most consequential number on the call. ServiceNow’s security and risk business sells cybersecurity and compliance tools bolted onto its main workflow platform.
It had already crossed $1 billion in annual contract value organically back in the third quarter of 2025, according to a ServiceNow press release, before two acquisitions extended the lead.
CEO Bill McDermott put it bluntly on the July 22 earnings call, describing “a 10-figure cybersecurity business that’s growing faster than all the other top cybersecurity companies.”
That is a different kind of claim than the artificial intelligence milestone, since it points to an already profitable, already scaled unit rather than a nascent product line.
Bloomberg / Getty Images
ServiceNow’s 2 acquisitions built the business in 8 months
ServiceNow paid $7.75 billion in cash for cyber exposure firm Armis in December, its largest acquisition ever, and closed the deal in April.
Three weeks earlier, it had agreed to buy identity security company Veza for roughly $1 billion. Together, the deals were expected to more than triple ServiceNow’s addressable market in security and risk.
Related: ServiceNow gets bearish call before major earnings test
The spending mirrors a broader pattern among software companies. Google parent Alphabet paid $32 billion for cloud security startup Wiz, and Palo Alto Networks spent $25 billion on identity security firm CyberArk, both within the past year, according to CNBC.
Enterprise software companies increasingly treat cybersecurity as the growth engine that core subscription seats can no longer guarantee alone.
The same week, a critical flaw exposed the platform’s own risk
However, buying top-tier security firms does not automatically secure a company’s underlying foundation. The timing carries an uncomfortable irony. Nine days before the earnings call, ServiceNow disclosed a critical vulnerability in its AI Platform, tracked as CVE-2026-6875, that let unauthenticated attackers execute code without a username or password, according to SecurityWeek.
Researchers confirmed active exploitation beginning July 17, according to BleepingComputer, and ServiceNow said it had found no evidence the attacks reached instances it hosts, according to Help Net Security.
More AI:
- Workers just sent AI companies an ultimatum
- Palantir CEO has a blunt verdict on OpenAI and Anthropic
- Elon Musk pulls no punches with AI rivals as Grok 4.5 debuts
That does not undercut the security business as a growth story, but it complicates the pitch. ServiceNow is asking enterprise customers to trust it as their cybersecurity vendor in the same week its own platform needed an emergency patch.
Neither McDermott nor the analysts covering the stock addressed the vulnerability on the call.
Software companies are betting security can outrun AI disruption
ServiceNow’s quarter offers a preview of how mature software companies plan to survive the reallocation of corporate budgets toward AI infrastructure. Rather than compete directly for that spending, they are acquiring their way into categories like cybersecurity, where demand keeps climbing, regardless of the macro environment.
Global spending on information security is projected to grow more than 12% in 2026, to roughly $240 billion, according to a ServiceNow press release.
That strategy worked for ServiceNow this quarter. It depends on integration going smoothly and on the acquired businesses outrunning the disruption that just hit IBM and Pegasystems.
Investors weighing enterprise software stocks may need to ask less about how fast a company is adopting AI and more about how fast it can buy its way into markets AI cannot replace.
Related: Jim Cramer gives his two cents about Netflix stock
