Key Earnings Metrics

ServiceNow beat the high end of guidance across every top-line and profitability metric in Q2 2026. Subscription revenue grew faster than expected, operating margin came in well above plan, and AI ACV crossed the $1B threshold ahead of the company's year-end target.

• Subscription revenue: $3.877B, up 23% YoY in constant currency, 150 basis points above the high end of guidance. Growth was broad-based across technology, security, CRM, and employee workflows.
• Operating margin: 29.5%, 3 points above guidance. The beat reflects operating leverage as large deal volumes scaled without proportional cost increases.
• RPO: approximately $29B, up 22% YoY in constant currency. Average customer contract duration increased, signaling longer commitments.
• CRPO: $13.2B, up 21.5% YoY in constant currency, a 200 basis point beat versus guidance. This measures contracted revenue expected to be recognized in the next 12 months.
• 123 deals over $1M net new ACV, up 40% YoY. Security and risk solutions appeared in 16 of the top 20 deals, with 24 deals exceeding $1M.
• AI ACV exceeded $1B, on track to beat the $1.5B target by end of 2026. Customers with agentic AI in production grew 9x over the last nine months.

Management Commentary

CEO Bill McDermott framed ServiceNow's cybersecurity trajectory in direct terms. The company already operates a billion-dollar-plus security business, and management stated it is now the fastest-growing among the top 10 enterprise cybersecurity companies. McDermott positioned this as an eighth-ranked cyber business accelerating faster than established pure-play competitors.

The strategic framing centers on building an integrated end-to-end security platform. The stated scope spans cyber risk and compliance, agentic incident response, exposure management, identity and access security, cyber physical security, and continuous vulnerability detection. This stack sits on top of the company's ITSM and ITOM core infrastructure.

Management emphasized that the attack surface is expanding rapidly. With 2.2B agents entering the enterprise globally and 40B connected devices expected within four years, every ungoverned asset and identity multiplies the blast radius. McDermott described risk at scale as the primary concern keeping CEOs awake, with ServiceNow positioned as the bridge between AI deployment and enterprise security.

The AI Control Tower is gaining traction with partners. One global services firm is already using the portfolio to help clients triage cybersecurity activity. Management cited this as early validation that the governance layer is becoming a procurement priority, not just an internal platform capability.

CFO Gina Mastantuono reinforced that AI Control Tower is directly supercharging the security and risk business. ITOM demand is also benefiting, as customers treat the CMDB as an essential governance and data foundation for AI-driven operations.

On pricing model evolution, McDermott noted that 50% of net new business is already non-seat based. The company retains seat-based pricing where customers prefer predictability, but the shift toward consumption and outcome-based models is well underway.

Strategic Implications

The integration of Armis and Veza into the security stack is the most consequential architectural move this quarter. Armis tracks 7B devices in real time, addressing asset visibility gaps that plague incident response. Veza maps access across human, machine, and AI identities, which becomes critical as agent populations scale into the billions.

By combining awareness and identity with the actionability of the ServiceNow platform, the company is building a 360-degree enterprise security capability. This is not a point-product strategy. It is a platform play that leverages existing ITSM and ITOM deployments as the foundation for security operations.

The partnership with Microsoft Agent 365 via Project Arc extends agentic AI governance from desktops to data centers. The new agent, secured by the NVIDIA OpenShell runtime and governed by ServiceNow AI Control Tower, demonstrates that the company is positioning its governance layer as vendor-neutral. This matters because enterprises run multiple AI platforms simultaneously and need unified oversight.

Security and risk solutions appearing in 16 of the top 20 deals, with 24 deals over $1M, indicates that cybersecurity is now a material pull-through driver for the broader platform. Customers are not buying security in isolation. They are consolidating asset discovery, identity governance, and incident response on ServiceNow alongside their existing IT workflows.

The public sector demand pattern is notable. Government agencies and federal IT contractors are consolidating asset discovery and security response on ServiceNow. One agency is using Armis to move from asset-blind incident response to comprehensive threat hunting. Public sector procurement cycles are long, but once established, these deployments tend to expand and persist.

The planned launch of an AI-native conversational service desk product marks a business model evolution. With no tickets and AI-coded automation, this product targets the Fortune 500,000 through a product-led motion. If successful, it expands the addressable market beyond the enterprise segment that has historically driven ServiceNow's growth.

EmployeeWorks, combining Moveworks conversational AI with ServiceNow workflows, is creating an entry point for broader HR and employee experience deals. This mirrors the pattern seen in CRM, where initial deployments pull through larger platform commitments.

The 9x growth in customers with agentic AI in production over nine months is a leading indicator. It suggests that AI deployment is moving from pilot to production at a pace that will drive sustained demand for governance, security, and workflow orchestration.

What to Watch Next

I would watch four things over the next two quarters:

• Security revenue disclosure granularity: Management cited the security business as the fastest-growing among the top 10 cyber companies but has not disclosed a specific revenue figure beyond the billion-dollar threshold. Any breakout in future reporting would help quantify the trajectory.
• AI Control Tower attach rates: The product is early but already influencing partner-led deployments. I want to see whether attach rates in top-20 deals accelerate and whether standalone AI Control Tower deals emerge independent of broader platform purchases.
• Armis and Veza integration depth: The acquisitions are recent, and the stated integration spans asset visibility and identity mapping. I will track whether customer case studies move beyond asset discovery into active identity governance and automated response workflows.
• Non-seat-based revenue mix: At 50% of net new business today, this metric will reveal whether ServiceNow's pricing model is transitioning fast enough to capture agentic AI value without cannibalizing existing seat-based ARR.

Related coverage

• PayPal Q1 2026: TPV $464B Up 8% Currency Neutral, Branded Checkout Growth 2%
• Palo Alto Networks Q4 FY2026: RPO Crosses $21.2B, NGS ARR Reaches $9.1B