ServiceNow

Key Findings

• Economic: ServiceNow directly operates a longstanding Israeli R&D and engineering footprint and materially expanded it through repeated acquisitions, including the $7.75 billion Armis acquisition completed in April 2026.^{1, 2}
• Political: Contemporary reporting says ServiceNow donated a combined $200,000 to Magen David Adom and International Medical Corps after 7 October 2023; the allocation between the two recipients is not disclosed.^{3, 4}
• Digital: ServiceNow and acquired Armis have substantial enterprise-cybersecurity capability, but the reviewed record does not establish a named IDF, Israeli intelligence, checkpoint-biometric, targeting, or settlement-surveillance deployment.^{2, 5}
• Military: U.S. defence agencies procure ServiceNow software, but no public evidence identified in the reviewed record of a ServiceNow or post-acquisition Armis contract with the IDF or Israeli Ministry of Defense.^{6, 7}

Target Profile

Executive Summary

ServiceNow is a U.S.-headquartered enterprise-software company with a significant and expanding Israeli R&D and acquired-technology footprint. Its Israeli operations originated through the Neebula acquisition and subsequently expanded through acquisitions including SkyGiraffe, Loom Systems, Armis, Traceloop, ai.work, and Sweep. The April 2026 Armis acquisition was a $7.75 billion cash transaction that brought Armis personnel and cyber-exposure-management capabilities into the ServiceNow group.^{1, 2}

The validated BDS-1000 result is driven by Economic and Political, not Military or Digital. Economic scores 7.40 because ServiceNow directly operates longstanding Israeli R&D and employment, and expanded that controlled operational presence in 2026. Political scores 8.26 because reported corporate donations included Magen David Adom, which the supplied scoring adjudication classifies under its Direct Financing rubric. Military and Digital each score 0.00 because the audits found no qualifying, sourced evidence of Israeli military procurement, Israeli-security deployment, targeting use, biometric surveillance deployment, or comparable qualifying nexus.

The record supports a distinction between direct corporate conduct and indirect association. ServiceNow’s ownership of Israeli engineering operations and acquired technology is direct economic involvement. The Armis founders’ prior Unit 8200 and elite-IDF technological-unit service is verified biographical context, but does not establish an IDF customer, defence contract, or ServiceNow corporate endorsement.^{10, 11}

Timeline of Relevant Events

Corporate Overview

ServiceNow’s primary business is enterprise workflow software, including IT-service management, security, automation, AI, and cloud-based operational tools. Its Israeli presence is not limited to sales representation: public filings identify ServiceNow A.B. Israel 2012 Ltd as a subsidiary, while historical and current material describes an Israeli engineering and R&D operation.^{8, 9}

The group’s Israel-linked footprint has grown substantially through acquisitions. Earlier transactions included Neebula, SkyGiraffe, Loom Systems, Appsee, and Atrinet; the 2026 sequence included Traceloop, Armis, ai.work, and Sweep. Armis is particularly material because ServiceNow acquired the company outright and subsequently integrated Armis capabilities into an Autonomous Security & Risk product offering.^{2, 5}

The available record does not establish that ServiceNow is Israeli-founded, Israeli-controlled, Israeli tax-resident, or headquartered in Israel. It instead supports a U.S. parent with a direct, controlled Israeli subsidiary and R&D footprint. The material does not provide standalone Israeli revenue, profit, tax, royalty, or repatriation figures; therefore, the scale of economic contribution can be assessed through operations, employment, and acquisitions, but not by allocating global profits to Israel.

Domain Summaries

Military: Military

Mechanism of Involvement

The validated Military score is 0.00 for Impact, Magnitude, and Proximity. This is not a finding that ServiceNow has no military-sector customers globally. The record documents U.S. defence procurement involving ServiceNow software by the U.S. Army, Defense Health Agency, U.S. Air Force, Defense Human Resources Activity, Defense Logistics Agency, and Naval Air Warfare Center. Those records establish U.S. defence-sector use of enterprise software and hosting, not procurement by the IDF, Israeli Ministry of Defense, or a named Israeli military unit.^{6, 7}

ServiceNow’s U.S. defence relationships concern enterprise-software channels, including procurement through Carahsoft and Department of Defense channels. This supports a general conclusion that ServiceNow software can be used in military administrative and operational IT environments. It does not establish a qualifying Israeli military nexus, and the scoring file specifically treats general association as insufficient for a positive Military frame.^{19, 20}

The Armis acquisition adds a cyber-security business that markets to U.S. federal and defence environments. Armis Federal describes cyber-asset visibility and exposure-management capabilities for government settings, while ServiceNow’s post-closing product announcement describes integrated asset visibility, exposure management, and security controls across IT, OT, IoT, and connected assets.^{21, 5} This is evidence of dual-use enterprise cybersecurity capability and of U.S. government/defence applicability, not evidence of Israeli military deployment.

The available product descriptions do not identify weapons, munitions, targeting systems, fire-control software, autonomous lethal systems, or an Israeli tactical product variant. ServiceNow and Armis materials instead describe workflow automation, cyber exposure management, connected-asset visibility, security operations, and governance. The evidence therefore does not meet the scoring threshold for a qualifying Israeli material-physical supply or military-support result.^{2, 5}

No public evidence identified of ServiceNow supplying heavy machinery, demolition equipment, construction plant, physical infrastructure equipment, logistics, base support, or sustainment services to the Israeli military, prisons, border authorities, or settlements. No public evidence identified of a ServiceNow or post-acquisition Armis contract with the IDF or Israeli Ministry of Defense.

The audit also distinguishes company conduct from individual biography. Nadir Izrael’s Unit 8200 service and the founders’ reported meeting in elite IDF technological units are supported as personal histories. Without further procurement, operational, or command evidence, those biographies do not establish ServiceNow or Armis supply to the IDF.^{10, 11}

Counter-Arguments and Evidence Limits

A reasonable counter-argument is that enterprise workflow and cybersecurity products may be adaptable for defence administration, intelligence, security operations, or logistics. The U.S. defence procurement and Armis Federal evidence confirms that general adaptability. Yet the scoring framework requires a documented qualifying result in the relevant Israeli nexus; general dual-use capability and U.S. defence use do not supply that missing link.^{6, 21}

The reported donation of tents and fleeces to soldiers on Mount Hermon is relevant political-support evidence but was assigned to Political rather than Military by the scoring adjudication. The supplied scoring file expressly states that it is not admissible as the governing positive Military frame. It should therefore not be used to alter the Military score.²²

The principal unresolved question is whether non-public, reseller-mediated, or classified Israeli government use exists. No public evidence identified in the reviewed material of such procurement. A material score change would require sourced evidence of an Israeli military or Ministry of Defense contract, deployment, named unit use, direct support for a military installation, or a purpose-built military capability.

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

The validated Digital score is 0.00 across Impact, Magnitude, and Proximity. This score does not deny ServiceNow’s significant Israeli technology footprint. SEC records identify an Israeli subsidiary, and the Neebula acquisition was described as establishing substantial engineering operations in Israel. The company subsequently acquired Israeli-origin mobile, AIOps, AI-observability, cyber, and workflow technology.^{1, 12}

The Armis acquisition materially expanded that footprint. ServiceNow acquired Armis for $7.75 billion, then announced a product integration involving Armis and Veza. The reported capabilities include asset intelligence, exposure management, connected-device visibility, security controls, AI-agent identity governance, and enterprise cyber-risk management.^{2, 5} These facts support direct ownership and development of digital technologies in Israel, rather than a merely incidental vendor relationship.

Asset discovery and telemetry can be surveillance-adjacent in a cybersecurity sense, particularly across IT, OT, IoT, medical devices, cloud, and code. However, the reviewed material characterizes Armis and ServiceNow products as cybersecurity and enterprise-management tools. It does not identify facial recognition, biometric identification, population monitoring, checkpoint systems, or a named deployment monitoring Palestinians.^{15, 5}

The record likewise supports ongoing enterprise AI and observability activity through Loom Systems, Traceloop, ai.work, and Sweep. The products’ stated roles are AIOps, enterprise AI, observability, workflow, security, and cyber-risk management. No public evidence identified that these acquired systems were designed to produce lethal targeting decisions, autonomous weapons effects, or human target lists.^{13, 16}

ServiceNow has government and public-sector offerings, and Armis was described as serving governments and critical infrastructure globally. These facts establish general government applicability. They do not identify an Israeli state customer, an Israeli security-body contract, a deployment for targeting, an IDF use case, or use by Shin Bet or Mossad.^{15, 23}

No public evidence identified that standard ServiceNow customer-instance data is hosted in Israel by default, that ServiceNow operates an Israel-specific sovereign cloud, or that Israeli authorities have a privileged legal or technical access path to non-Israeli customer data. Current Israeli hiring confirms product-security and engineering operations, but does not establish data-residency or government-access claims.^{9, 24}

Counter-Arguments and Evidence Limits

The strongest argument for a positive Digital score is that a major, controlled Israeli R&D footprint can produce digital capabilities with possible security or intelligence applications. That proposition is plausible at a general level, especially for cyber asset visibility and enterprise AI. The validated score nevertheless requires evidence of a qualifying Israeli digital deployment or effect, not only technological potential or corporate ownership.

The founders’ prior Unit 8200 and elite-IDF technological-unit service may raise questions about Armis’s technical provenance. The available biographies establish those personal histories but do not establish that ServiceNow, Armis, or a named product serves the IDF, intelligence agencies, checkpoints, settlement surveillance, or population-control infrastructure.^{10, 11}

The principal evidence gap is deployment-level documentation. A material score change would require a sourced contract, customer reference, technical case study, government procurement record, credible investigation, or other evidence linking ServiceNow or post-acquisition Armis technology to Israeli biometric surveillance, targeting, intelligence operations, settlement administration, or an equivalent qualifying digital mechanism.

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

Economic is the principal operational basis for ServiceNow’s score, with I=7.40, M=7.00, P=9.00, and a domain score of 7.40. The scoring adjudication treats ServiceNow as a direct operator of longstanding, current Israeli R&D and employment, rather than as a passive investor. That conclusion is supported by the Israeli subsidiary, historical engineering operations, current Israeli hiring, and recurring acquisitions of Israeli-origin technology businesses.^{1, 9}

The relationship is economically material in character even though the public record does not disclose standalone Israeli revenue or profits. ServiceNow’s Israel-linked exposure is principally software engineering, acquisition of operating companies, personnel, and controlled technology - not sourcing of physical goods. The audit found no public evidence of sourcing agricultural goods, minerals, settlement-manufactured products, or other material physical inputs from Israeli settlements.

The acquisition record demonstrates repeated capital deployment into Israeli-origin operations. ServiceNow’s 2017 filing recorded approximately $32 million consideration for SkyGiraffe; Loom Systems added an Israeli AIOps business in 2020; and the 2026 sequence added Traceloop, ai.work, Sweep, and Armis. These transactions show continued integration of local technical capacity into the ServiceNow group rather than isolated historical activity.^{12, 13}

Armis materially increases the scale of that exposure. ServiceNow announced the Armis transaction in December 2025 and completed it in April 2026 for $7.75 billion in cash, with Armis employees joining ServiceNow. The transaction was controlling operating ownership, not a minority or passive portfolio holding.^{15, 2}

ServiceNow’s current Israeli careers materials support the conclusion that the local operation remains active. Historical reporting described approximately 200 employees in Israel before Armis, while current listings include roles in Petah Tikva and Tel Aviv, including product-security and Armis positions. The score’s high proximity value reflects direct operation: ServiceNow owns the subsidiary, employs personnel, acquires technology companies, and incorporates their capabilities into its products.^{4, 24}

The scoring adjudication places the impact assessment at the upper end of Core R&D because of continued and expanded operations after the supplied notice dates. This is an economic-operational classification, not a finding that ServiceNow operates in settlements, is Israeli-controlled, or has an Israeli principal place of management. No public evidence identified of a ServiceNow office, subsidiary, named customer deployment, or directly attributed revenue in an Israeli settlement.

Counter-Arguments and Evidence Limits

A central limitation is the absence of localized financial disclosure. Publicly available material does not identify ServiceNow Israel’s revenue, profit, tax payments, intercompany royalties, dividends, or repatriation flows. The company’s 2023 annual report described customers in conflict-affected regions as immaterial to consolidated revenue and net assets, but it did not isolate Israel or provide current 2026 Israeli revenue.²⁵

The direct-operation assessment should not be inflated into a claim of Israeli ownership or national economic dependence. ServiceNow is a U.S. parent, and the reviewed material does not show Israeli beneficial control of the parent, a qualifying Israeli controlling shareholder, Israeli tax residency, or designation as nationally dominant infrastructure. The score reflects direct R&D and employment, not corporate nationality.

The key uncertainty is post-Armis headcount, local payroll, and the location of operational benefits from acquired intellectual property. A material score increase would require evidence of larger quantified local economic contribution, settlement-specific activity, or significant Israeli-state economic privileges. A material reduction would require evidence that Israeli R&D and employment were discontinued, materially reduced, or no longer directly controlled by ServiceNow.

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

Political scores I=8.90, M=6.50, P=9.00, producing a domain score of 8.26. The supplied scoring adjudication identifies ServiceNow’s publicly reported donation to Magen David Adom as the governing frame. Reporting stated that ServiceNow donated a total of $200,000 to Magen David Adom and International Medical Corps, alongside employee grants and other support after 7 October 2023.^{3, 4}

The score’s high impact and proximity values follow the supplied rubric adjudication: the donation was a direct corporate act through a national institutional channel, and the adjudication treats Magen David Adom as a military-welfare body for this scoring purpose. The magnitude score of 6.50 reflects the reported one-time nature and shared total; the scoring file explicitly states that this prevents a magnitude score of 7.00 or higher. This classification is rubric-specific and should not be expanded beyond the documented donation.

The donation record also includes conduct distinct from Magen David Adom. Calcalist and Globes reported $1,500 grants for employees at the Israeli development centre and support involving International Medical Corps. A separate Geektime report stated that ServiceNow donated tents and fleeces to soldiers on Mount Hermon and used routine office-purchasing budget for donations to evacuees.^{3, 22} The latter is single-source reporting and should therefore be treated with lower confidence than the grants and shared $200,000 donation.

ServiceNow’s public communications were not limited to expressions of solidarity with Israel. In October 2023, McDermott referred to the killing of employee Shlomi Sividia, solidarity with the Israel team, and a humanitarian crisis affecting millions in both Israel and Gaza; he described concern for innocent people on all sides. The record therefore does not support describing ServiceNow as publicly silent about Gaza at that time.¹⁴

ServiceNow’s continued Israeli corporate presence and 2026 acquisitions are relevant to political-context analysis because they show sustained local economic engagement. However, the evidence does not establish that the acquisitions were undertaken for a political or military purpose. Likewise, Armis-founder military biographies establish personal history, not a ServiceNow political endorsement, IDF funding arrangement, or state partnership.^{10, 2}

No public evidence identified of ServiceNow sponsoring settlement political events, endorsing annexation or settlement expansion, joining an anti-BDS advocacy organization, lobbying for anti-BDS legislation, donating to Friends of the IDF, JNF/KKL, Regavim, Im Tirtzu, or a settlement organization.

Counter-Arguments and Evidence Limits

The strongest counter-argument is that Magen David Adom and International Medical Corps were reported together in a shared $200,000 donation amount, so the amount directed to each organization is not disclosed. That limitation is reflected in the scoring adjudication’s magnitude assessment. It does not negate the reported Magen David Adom donation, but it limits precision about the donation’s allocation.^{3, 4}

A further limitation is the distinction between medical, humanitarian, employee-welfare, and military-welfare characterizations. The score uses the supplied rubric’s classification for Magen David Adom; the dossier does not independently make a legal or institutional conclusion beyond that scoring treatment. The tents-and-fleeces account involves soldiers but appears in a single retrieved report and should not be generalized into direct funding of the IDF as an institution.²²

No public evidence identified of settlement-specific political activity, political lobbying tied to Israel/Palestine policy, anti-BDS advocacy, or a recurring pattern of military-linked corporate financing. A material score increase would require evidence of repeated or larger direct financing, political advocacy, settlement support, or documented state-partnership activity. A material score decrease would require a correction or retraction of the reported donation evidence, or a scoring-rubric revision.

Named Entities and Evidence Map

Cross-Domain Counter-Arguments and Evidence Limits

The record distinguishes four different forms of relationship that should not be collapsed: Israeli R&D and acquisitions; U.S. defence-sector software procurement; individual military-service biographies; and post-7 October corporate donations and communications. Only the first and fourth are the validated bases of positive domain scores. U.S. defence procurement does not establish Israeli military supply, and founder biographies do not establish an IDF customer relationship.^{6, 10}

The public record is also incomplete in important ways. It does not disclose all reseller relationships, non-public government customers, classified deployments, local revenue, Israeli taxes, profit repatriation, or the allocation of the reported $200,000 donation between recipients. These gaps justify caution, but they do not displace the direct evidence of controlled Israeli operations, acquisitions, current hiring, and reported corporate donations.^{2, 3}

No public evidence identified in the reviewed material of ServiceNow activity in Israeli settlements, supply of physical military goods to Israel, an IDF or Israeli Ministry of Defense contract, targeting deployment, checkpoint biometric deployment, or a ServiceNow-linked Israeli sovereign cloud. Those absences are bounded public-record findings, not proof that no undisclosed activity exists.

Named Entities and Evidence Map

BDS-1000 Score

The validated BDS-1000 score is 729, placing ServiceNow in Tier B: Severe Complicity. Political is the highest scoring domain; Economic is the second positive domain. The Military and Digital nil scores reflect the requirement for documented qualifying Israeli-nexus evidence rather than general dual-use potential, U.S. defence sales, corporate presence in Israel, or biographical association.

Confidence, Limits, and Open Questions

Confidence is highest for ServiceNow’s Israeli subsidiary, acquisitions, active hiring, the Armis closing, the reported corporate donations, and McDermott’s public statement. These are supported by company materials, SEC filings, and contemporaneous reporting.^{9, 2}

Confidence is lower for the tents-and-fleeces report because it is single-source. The dossier treats it as a limited political-support fact and does not characterize it as direct IDF institutional funding.²²

Open questions include the undisclosed allocation of the $200,000 donation; the current post-Armis Israeli headcount; ServiceNow Israel’s standalone financial contribution; possible undisclosed or reseller-mediated Israeli public-sector deployments; and whether any product is used by Israeli authorities in ways not documented in the reviewed public record.

Recommended Actions

• For procurement and investment decision-makers, treat the validated score as principally reflecting direct Israeli R&D and acquisition activity plus the reported Magen David Adom donation, rather than military supply or surveillance deployment.
• Request from ServiceNow a current country-level operational disclosure covering Israeli headcount, subsidiary functions, material acquisitions, and any settlement-specific operations.
• Request clarification of the allocation, purpose, date, and subsequent recurrence or cessation of the reported $200,000 donation to Magen David Adom and International Medical Corps.
• Seek a public policy statement addressing whether ServiceNow or post-acquisition Armis has contracts, deployments, resellers, or support arrangements with the IDF, Israeli Ministry of Defense, Israeli intelligence bodies, or settlement authorities.
• Reassess Military and Digital only if deployment-level evidence emerges; reassess Economic if the Israeli R&D footprint materially changes; and reassess Political if donation reporting is corrected or new direct-financing evidence becomes public.