ServiceNow Deep Dive: Too Cheap to Ignore?
The stock is down 57%, due the AI disruption narrative, however, the company is positioning itself to be an AI winner.
Welcome to Global Equity Briefing, my weekly investing newsletter.
I am Ray, a passionate investor and equity analyst. And today I am covering ServiceNow.
For over a decade, investors saw SaaS subscription-based business models as the best in the world!
The theory was that long-term contracts with large companies created a reliable and predictable growth model.
The most important word here is predictable.
Investors love predictability and hate uncertainty.
Thus, SaaS investors drove valuations to unsustainably high multiples, expecting this predictability to continue. Little did they know that there was a meteorite coming to obliterate SaaS stock valuations, and the name of that meteorite was AI.
When the AI boom started, investors began to question the assumptions behind SaaS multiples, causing ServiceNow to fall 57% from its all-time high.
Some investors believe that ServiceNow’s business model is no longer reliable, durable, or predictable.
Well, while AI will certainly disrupt the business models of some low-quality SaaS companies, it seems highly unlikely that vibe-coding will disrupt ServiceNow.
In fact, we are starting to see the first signs that AI could significantly increase ServiceNow’s total addressable market.
In this ServiceNow Deep Dive, I will explain everything an investor must know before buying the stock. Business model, services, the AI risk, the AI opportunities.
Most importantly, as always, I will conclude with a 2030 valuation model that calculates the target share price.
Let’s dig in.
1. Business Model
2. Competitive Advantages
3. Competitors
4. The AI Disruption Risk
5. The AI Opportunity
6. Q2 2026 Financial Results
7. Valuation
8. 2030 Valuation Model
9. Conclusion
1. Business Model
ServiceNow is a Software-as-a-Service (SaaS) platform that serves the needs of large enterprises.
Most importantly for potential investors, ServiceNow is not a simple point solution, it is a system of action.
It unifies corporate IT, HR, customer service, and security workflows through its suite of vast product offerings such as:
IT service management
IT operations management
Customer service management
HR service delivery
Cyber security operations
Creator workflows
Let me explain.
1.1. IT Service Management (ITSM)
ITSM is the core product that handles how a company manages tech support.
Without a centralized platform, tech support in a large enterprise would be chaotic. Employees would send random emails, make phone calls, or chat with IT staff, leading to lost tickets and long delays.
Many of us have been in a situation where we have to wait a long time for someone from IT to fix that “simple” issue you are having.
ITSM automates these requests, routing them to the right IT specialist based on what the problem is.
The platform divides this tech support into 4 core areas to ensure every issue is tracked and solved properly.
1. Incident management logs and resolves unexpected technical glitches quickly.
When a worker has a technical issue, like a broken MacBook, a forgotten password, or a software bug, they use ITSM to get help.
This is vital because it lowers the time an employee can’t do a task and lowers support costs.
2. Change management plans and track system and software updates, preventing large-scale systems from breaking during updates.
3. Problem management investigates the underlying root cause of repeating glitches in order to stop the same tech support issues from happening again.
4. Service request management has a digital catalog for workers to order hardware and licenses, enabling the standardization of procurement, speeding up item delivery.
In Q2 2026, licensed user growth for ITSM remained strong.
ServiceNow has integrated Now Assist, its generative AI assistant, into ITSM.
This AI helps by summarizing long chat histories and writing email replies to employees automatically, which speeds up support times and improves agent productivity.
1.2. IT Operations Management (ITOM)
ITOM is a product that monitors and manages the actual IT infrastructure.
This includes physical and virtual servers, networks, and cloud storage like AWS or Azure.
While ITSM is the help desk for people and processes, ITOM is the monitoring tool for the machines and software.
This monitoring is done because business software runs on thousands of connected databases and servers. If one server fails, entire systems can go offline. ITOM gives IT teams real-time visibility into what assets exist and how they are performing. This prevents business downtime, which can cost millions of dollars in lost business. It also helps businesses such as banks, phone companies, and manufacturing firms comply with strict government regulations that require tracking risks and protecting infrastructure.
ITOM capabilities could be packaged into different tiers depending on the needs of the company.
ITOM Visibility provides a complete view of IT infrastructure across on-premises and cloud environments. It scans networks to identify devices, applications, and servers, building and maintaining an accurate information database.
Also, this module shows how infrastructure components support business services, helping teams understand dependencies, assess outage impacts, and improve change planning.
Meanwhile, ITOM Health improves service reliability by collecting alerts from monitoring tools. It filters duplicate and unnecessary alerts, groups related events, and helps identify the root cause of incidents.
ServiceNow’s AI detects anomalies and automates analysis, enabling faster issue resolution and reduced downtime.
Furthermore, ITOM Optimization helps organizations manage cloud resources across all cloud platforms, providing visibility into usage and spending.
ServiceNow also identifies underutilized resources, recommends cost optimizations, and supports governance, helping organizations reduce cloud costs while maintaining operational efficiency.
In practice, ITSM and ITOM work together to build a proactive IT system.
Service management creates the ticket, while operations identifies why the issue is happening. When operations detects a server outage, it automatically builds an incident ticket in the service management system and alerts the correct repair team, resolving the problem before employees or customers even notice a slowdown.
1.3. Customer Service Management (CSM)
Customer Service Management manages customer support functions for ServiceNow users.
It connects front-office agents with back-office departments, like engineering, finance, or operations, to solve complex customer questions and issues.
Old customer databases only track emails and log phone calls.
They do not help solve the root cause of the customer’s problem if it requires another team to fix it.
CSM builds automated workflows that send customer issues directly to the team that can resolve them. This is vital because resolving issues quickly keeps customers happy and reduces customer churn. It is well known that keeping an existing customer is many times cheaper than acquiring a new one. In high customer acquisition cost industries, even a minuscule increase in customer retention can significantly boost profits.
ServiceNow platform uses specialized features to help support agents solve cases quickly.
Omni-channel support unifies email, chat, phone, SMS, and social media into a single workspace, giving agents a complete view of customer interactions. This enables faster responses and a more consistent support experience.
Next, a self-service portal provides customers with knowledge bases and AI-powered chatbots to find answers, submit requests, and reset accounts independently. This improves customer satisfaction while reducing support costs.
The advanced work assignment tool automatically routes cases based on business rules, agent skills, availability, and workload. This ensures each case is assigned to the most appropriate agent, improving efficiency and resolution times.
Furthermore, guided playbooks provide step-by-step guidance for handling common support processes. This helps agents deliver consistent, accurate, and compliant service while reducing training time.
Meanwhile, proactive CSM uses AI and monitoring data to detect outages and service issues before customers report them. Organizations can proactively notify affected customers, reducing inbound ticket volumes and improving the overall customer experience.
1.4. HR Service Delivery (HRSD)
Human Resources Service Delivery (HRSD) automates and simplifies employee HR workflows.
This replaces long emails, spreadsheets, and phone calls with a single secure platform.
Employees often have to navigate multiple confusing systems to get basic help with payroll or submit forms. This wastes time and lowers productivity.
HRSD gives them a single place to ask questions, view information, and complete tasks.
This improves employee satisfaction, keeps HR data secure, and frees HR teams from manual paperwork.
Employee center is a centralized portal or a mobile app where employees can access personalized content, search the knowledge base, submit requests, and track their cases in one place. By offering a single self-service experience, ServiceNow improves accessibility, reduces the need for HR assistance, and enables employees to quickly find the necessary information.
Next, case and knowledge management standardizes how employee inquiries are captured, routed, and resolved. Requests are securely assigned to the appropriate HR teams while informational articles help employees and AI agents find correct answers faster. The platform tracks case progress, resolution times, and service performance to improve efficiency.
Furthermore, lifecycle events automate workflows for major employee milestones, such as onboarding, promotions, transfers, and offboarding. Tasks are coordinated across HR, IT, facilities, and other departments, ensuring each activity is completed on time. This reduces manual effort, eliminates process gaps, and provides employees with a consistent experience throughout their employment.
Meanwhile, employee document management provides a secure, centralized repository for employee contracts, forms, and other HR documents. Role-based access controls help protect sensitive information while supporting compliance with privacy regulations. Digital document storage reduces paperwork, simplifies document retrieval, and streamlines HR processes across the employee lifecycle.
Standardizing these HR processes can help companies shorten onboarding times, reduce errors, and lower costs.
1.5. Security Operations (SecOps)
Security Operations (SecOps) connects security threat scanning tools.
ServiceNow’s automated workflows speed up security response and fix vulnerabilities.
Security teams are often overwhelmed by technical alerts. Even when they find a serious threat or a software vulnerability, it takes too long to coordinate with IT teams to eliminate the issue.
This significantly increases the probability of data breaches.
Security incident response tools automate the detection, containment, and remediation of security threats. They can isolate infected devices, block malicious activity, and coordinate response actions across security and IT teams. Automated workflows reduce response times, minimize business impact, and help organizations recover from incidents more quickly.
At the same time, ServiceNow’s Veza access graph provides deep visibility into identity permissions across users, machines, applications, and AI agents. By mapping access relationships throughout the enterprise, it helps organizations identify excessive permissions and enforce access, reducing exposure when login information is stolen.
Meanwhile, vulnerability response tools integrate security scan results with central data to identify, prioritize, and remediate security risks. It automatically creates and assigns remediation tasks to the appropriate IT teams, prioritizing critical systems based on estimated impact.
Next, security posture control software continuously monitors on-premises and cloud environments to ensure assets comply with security policies. It identifies weaknesses, highlights compliance gaps, and provides visibility into an organization’s overall security posture.
Lastly, in Q1 2026, ServiceNow completed a $7.8B acquisition of Armis, expanding into proactive security.
Armis discovers and protects billions of physical connected assets, including manufacturing tools, medical devices, and IoT infrastructure.
To clarify, ServiceNow is not a cybersecurity platform like CrowdStrike, Okta, or Cloudflare.
Instead, it enables organizations to automate and manage security operations by connecting various cybersecurity tools, IT teams, and business workflows. It helps prioritize threats, coordinate incident response, manage vulnerabilities, and ensure security processes are completed efficiently across the enterprise.
However, it could, in the future, increase its cybersecurity offering by releasing new capabilities or acquiring a full-on cyberfirm.
“We now have a 10-figure cybersecurity business that’s growing faster than all the other top cybersecurity companies... I think cybersecurity will be bigger than ServiceNow is in the next few years.” Bill McDermott, CEO, Q2 2026 Earnings Call.
Essentially, the CEO expects that in a few years, probably 5-7 years, the cybersecurity vertical alone could generate as much revenue as the entire company is generating today.
1.6. Creator Workflows
Creator Workflows, powered by App Engine, is a low-code development platform that users use to build custom applications.
Every business has unique tasks that standard software cannot handle. Normally, building a custom app takes months of coding and costs a lot of money, creating a huge backlog for IT departments.
App Engine solves this by using low-code and no-code tools.
A low-code and no-code environment is a development platform that lets people build applications with visual drag-and-drop tools and minimal or no written code, making software creation faster and more accessible.
Having such functionality allows companies to build apps in days instead of months, alleviating IT backlogs and reducing development costs.
This ServiceNow offering helps companies digitize old paper forms and manual spreadsheets!
The App Engine might sound like vibe-coding, but it is not.
In short, vibe coding generates code, while App Engine generates entire apps and enterprise workflows that conform to an organization’s rules.
App Engine focuses on building structured business applications within ServiceNow’s platform using internal data, workflows, security controls, and governance.
This tool is primarily designed to build internal enterprise applications, not consumer-facing or standalone commercial apps.
These small apps automate specific business processes, for example, employee onboarding procedures, and securely use data already stored in ServiceNow or connected enterprise systems.
Its primary purpose is to rapidly build secure, workflow-driven business applications for internal enterprise use, rather than general-purpose external software like a mobile app.
1.7. Professional Services
In addition to selling software subscriptions, the company also provides what it calls Professional Services.
The professional services segment includes earnings from implementation, consulting, training, customer onboarding, and technical support fees.
Setup consulting is done to build and configure the software to meet a company’s specific business requirements.
Software only works well when its workflows are designed to match the company’s real processes, making the implementation a highly important part of the business.
Training is done to teach employees and system administrators how to manage the platform. The aim is to prevent costly errors and help users get the most value out of the software.
Meanwhile, customer onboarding is done to guide new customers through their first steps, enabling users to get comfortable with the system quickly.
In 2025, professional services brought in $395M, a 17% increase Y/Y.
However, this segment makes up only about 3% of the total revenues.
Furthermore, unlike the highly profitable subscription business, the professional services unit operates at a loss. In 2025, the GAAP gross loss for professional services was -$19M, which equals a negative 4.5% margin.
This unprofitability is a deliberate strategic choice.
ServiceNow uses its services unit to help with customer setup and to encourage long-term software adoption, rather than as a profit generator.
Setting up the platform is the largest expense for a new customer, typically costing 3 to 5 times the annual software fees. To protect its overall profitability, ServiceNow is moving implementation work to its global partner network.
ServiceNow relies on a large ecosystem of third-party partners like Accenture and IBM to do most of the setup work. This means ServiceNow does not depend on hiring thousands of human consultants. Instead, partners carry the load of setup work, while ServiceNow focuses on selling highly profitable software subscriptions.
Essentially, the company doesn’t see implementation and consulting as its core competency and prefers to focus on improving its platform.
Simply put, ServiceNow can sell more software subscriptions by partnering with consultants and system installers compared to if they had to go at this alone. This is why the professional services revenues have only grown with a CAGR of 10.6% since 2017, compared to a 27% CAGR of total revenue, but I will expand on this in the finances chapter.