ServiceNow (NYSE:NOW) has quietly built one of the fastest-growing cybersecurity businesses in the industry, and on August 4, it made that ambition explicit. The company rolled out six new Autonomous Security solutions built to catch and fix threats before they turn into breaches, tied together under what it calls Shift Zero. The timing lines up with a security unit that is already outgrowing dedicated cybersecurity vendors, and the announcement explains why.

Bull Case: A Security Business Already In The Room

ServiceNow's security and risk franchise crossed $1 billion in annual contract value, backed by Q2 2026 subscription revenues of $3.88 billion (up 23% year-over-year in constant currency) and a remaining performance obligation base of $29 billion. CEO Bill McDermott notes it is growing faster than top standalone cybersecurity peers, aided by a 98% renewal rate. Those products were included in 16 of the company's top 20 deals, and cyber solutions appeared in 80% of its largest contracts overall. McDermott put it plainly: "we're in the party now."

The new release leans into that position. The average enterprise runs more than 70 separate security tools, and ServiceNow is trying to fold that sprawl into a single, governed system spanning exposure management, identity, cyber-physical assets, incident response, and compliance. Acquired technology does the heavy lifting: Armis brings real-time visibility across billions of connected devices, and Veza's Access Graph maps permissions across human, machine, and AI identities. Where a detection-focused vendor can flag a threat, ServiceNow's configuration database can trace which system, owner, and workflow the fix actually touches.

Bear Case: Growth Story Meets A Bigger Incumbent

The stock's recent bounce hides how much ground it still has to make up. Shares remained down 41% over the trailing 12 months even after jumping as much as 13.8% in the week of July 31, when ServiceNow beat guidance and raised its full-year subscription revenue outlook to $15.76 billion. That kind of gap between a strong quarter and a still-depressed share price points to a deeper worry: if AI agents can run enterprise workflows on their own, investors question how much terminal value an expensive workflow software stock deserves, no matter how good the next print looks.

The Autonomous Security rollout does not fully answer that worry yet, because it is not finished. Several of the pieces ServiceNow is counting on to make the "most complete" claim stick, including the Tier 2 SOC AI Specialist, the Vulnerability Resolution AI Specialist, continuous control monitoring, and cryptographic asset compliance, are not scheduled to ship until December this year. Until then, the platform's promise of governing every asset, identity, and agent in one motion rests partly on capabilities customers cannot yet test, leaving a gap between what ServiceNow announced and what it can currently prove in production.