Armis

Name: Armis
Brand: Armis

Armis Centrix is a cyber exposure management platform that performs continuous discovery, classification, and risk prioritization across IT, OT, IoT, IoMT and cloud, producing a unified asset inventory and security context to support visibility, prioritization, and remediation workflows.

Est 2016|Valuation $7.8B|Raised $1.5B|53 Ref Customers

LinkedIn 49K|Web traffic 62K|FTEs 1,179

MarketsCloud-Native Application Protection Platform (CNAPP)Security Information and Event Management (SIEM)Endpoint Management (UEM)

Platform CoversCyber Risk Management Vulnerability Management IT Asset Management (ITAM)

Published Oct 24, 2026

01Common complaints

If your primary requirement is OT/ICS detection depth and OT-specific signature engineering
- Review signals indicate Armis focuses on broad discovery and context aggregation; organizations requiring deep, process-aware OT detection may prefer OT-native vendors (Claroty, Nozomi, Dragos). Validate with OT-specific PoCs.
If you need built-in enforcement independent of third-party controls
- Community feedback and sales discussions suggest enforcement actions may depend on integrations with firewalls, NAC, or other controls. If you require native inline enforcement, confirm architecture and supported control points.
If transparent, published pricing or a self-serve trial is essential
- Armis does not publish list pricing on major review platforms; procurement will typically require enterprise scoping.
If your organization lacks integration capacity
- Many benefits rely on integrating multiple feeds and systems; limited integration resources may reduce ROI.
If vendor independence post-acquisition is a procurement concern
- The vendor's acquisition by ServiceNow may affect procurement preferences; validate contract terms, roadmap commitments, and any potential platform bundling implications.
Current limitations acknowledged by the vendor
- Public product pages emphasize broad coverage and nondisruptive monitoring; explicit limitations are not prominently disclosed in marketing materials. Buyers should confirm limitations in technical documentation and during PoC.
Roadmap / not-yet-available features
- Public, time-stamped roadmap details are limited in accessible sources. Prospective customers should request a roadmap and feature delivery timelines during procurement.
Scale limitations
- The vendor states the platform supports enterprise scale; no public hard thresholds (for example, maximum asset counts) are documented in the cited sources.
Security or compliance gaps
- The Trust Center lists multiple certifications; buyers should confirm the scope of each certificate (which product components, regions, and dates) and request supporting reports.
API limitations or integration constraints
- Specific integration requests (for example, particular MDMs) have been described in reviews as slower to progress. Validate integration maturity, API capabilities, and available connectors during scoping.

- If your primary requirement is OT/ICS detection depth and OT-specific signature engineering - Review signals indicate Armis focuses on broad discovery and context aggregation; organizations requiring deep, process-aware OT detection may prefer OT-native vendors (Claroty, Nozomi, Dragos). Validate with OT-specific PoCs. - If you need built-in enforcement independent of third-party controls - Community feedback and sales discussions suggest enforcement actions may depend on integrations with firewalls, NAC, or other controls. If you require native inline enforcement, confirm architecture and supported control points. - If transparent, published pricing or a self-serve trial is essential - Armis does not publish list pricing on major review platforms; procurement will typically require enterprise scoping. - If your organization lacks integration capacity - Many benefits rely on integrating multiple feeds and systems; limited integration resources may reduce ROI. - If vendor independence post-acquisition is a procurement concern - The vendor's acquisition by ServiceNow may affect procurement preferences; validate contract terms, roadmap commitments, and any potential platform bundling implications. - Current limitations acknowledged by the vendor - Public product pages emphasize broad coverage and nondisruptive monitoring; explicit limitations are not prominently disclosed in marketing materials. Buyers should confirm limitations in technical documentation and during PoC. - Roadmap / not-yet-available features - Public, time-stamped roadmap details are limited in accessible sources. Prospective customers should request a roadmap and feature delivery timelines during procurement. - Scale limitations - The vendor states the platform supports enterprise scale; no public hard thresholds (for example, maximum asset counts) are documented in the cited sources. - Security or compliance gaps - The Trust Center lists multiple certifications; buyers should confirm the scope of each certificate (which product components, regions, and dates) and request supporting reports. - API limitations or integration constraints - Specific integration requests (for example, particular MDMs) have been described in reviews as slower to progress. Validate integration maturity, API capabilities, and available connectors during scoping.

Deal disqualifiers: what makes a POOR fit

Small organizations that primarily require a simple network inventory tool
Organizations where deep OT process anomaly detection and signature engineering are the primary needs (may prefer OT-specialist vendors)
Buyers who require transparent list pricing, online self-service purchase, or a free/freemium trial

Why some customers left for competitors (churn reasons)

Direct, verifiable churn evidence is limited in public sources.
Inferred churn drivers from critical feedback include:
- Perceived gaps in OT-specific detection and alerting depth compared to OT-native vendors.
- Integration or workflow friction (for example, ticketing and SLA mapping issues).

02Why they buy

Review-derived strengths (distinguished from vendor marketing claims)
- Reviewers commonly cite broad device visibility and the centralization of contextual data for investigations and remediation as practical benefits.
- Several reviews reference a positive onboarding and support experience.
Vendor-asserted features or claims to validate in proof of concept
- The vendor describes an Asset Intelligence Engine aggregating large-scale telemetry for classification and behavior baselining; buyers should validate scale and applicability during evaluation.
- "Smart Active Querying" is described by the vendor as a selective query capability intended to limit impact on sensitive devices; buyers should evaluate nondisruptiveness during a PoC.
Areas where competitors have demonstrated advantages
- OT-origin vendors often provide deeper industrial protocol decoding, process-aware anomaly detection, and specialized OT threat intelligence.

- Review-derived strengths (distinguished from vendor marketing claims) - Reviewers commonly cite broad device visibility and the centralization of contextual data for investigations and remediation as practical benefits. - Several reviews reference a positive onboarding and support experience. - Vendor-asserted features or claims to validate in proof of concept - The vendor describes an Asset Intelligence Engine aggregating large-scale telemetry for classification and behavior baselining; buyers should validate scale and applicability during evaluation. - "Smart Active Querying" is described by the vendor as a selective query capability intended to limit impact on sensitive devices; buyers should evaluate nondisruptiveness during a PoC. - Areas where competitors have demonstrated advantages - OT-origin vendors often provide deeper industrial protocol decoding, process-aware anomaly detection, and specialized OT threat intelligence.

Why customers chose Armis over alternatives (from review signals)

Agentless discovery and passive monitoring capability is repeatedly emphasized as suitable where agents are not viable.
A broad integration library and the ability to centralize asset and security context for investigation and workflow purposes are frequently cited.
Positive support and onboarding experiences are noted in several reviews.

03Field reports

Gartner Peer Insights (CPS Protection Platforms)

Overall rating shown: high overall rating with a moderate number of ratings as displayed on the platform.
Positive (5-star) example quote (Dec 14, 2025):
- "Overall it has been a pleasant experience… better understanding and visibility to my environment and potential risks…"
Critical (3-star) example quote (Dec 9, 2025):
- "...good tool for asset visibility… OT/CPS capabilities… basic… limited ability to alert on true OT-specific threats, or build alerts based on customized queries (e.g. snort)."
Themes implied by visible excerpts:
- Strengths: integrations, mapping, vendor support, device visibility.
- Weaknesses: OT-specific alerting depth and customization for some users.

- Overall rating shown: high overall rating with a moderate number of ratings as displayed on the platform. - Positive (5-star) example quote (Dec 14, 2025): - "Overall it has been a pleasant experience… better understanding and visibility to my environment and potential risks…" - Critical (3-star) example quote (Dec 9, 2025): - "...good tool for asset visibility… OT/CPS capabilities… basic… limited ability to alert on true OT-specific threats, or build alerts based on customized queries (e.g. snort)." - Themes implied by visible excerpts: - Strengths: integrations, mapping, vendor support, device visibility. - Weaknesses: OT-specific alerting depth and customization for some users.

TrustRadius (small set of reviews with a high score)

Example positive quote (Dec 27, 2022):
- "Tracking rogue devices… blocking devices… reporting, easy interface, and analytics capabilities…"
Example con from a user review (feature request rather than deal-breaker):
- Integration with a particular MDM product was requested and described as slow to progress.
TrustRadius positioning (from page text): Armis is described as agentless/out-of-band for unmanaged and IoT devices, with integrations including SIEM, firewall, ITSM, and ITAM platforms.

- Example positive quote (Dec 27, 2022): - "Tracking rogue devices… blocking devices… reporting, easy interface, and analytics capabilities…" - Example con from a user review (feature request rather than deal-breaker): - Integration with a particular MDM product was requested and described as slow to progress. - TrustRadius positioning (from page text): Armis is described as agentless/out-of-band for unmanaged and IoT devices, with integrations including SIEM, firewall, ITSM, and ITAM platforms.

G2

G2 shows multiple reviews and a generally positive overall rating on vendor pages. G2 notes pricing is not provided publicly.
Some G2 entries indicate reviews invited via vendor channels; buyers should consider potential review sourcing bias when assessing these ratings.

Reddit / community feedback (mixed and often less verified)

r/sysadmin (Apr 2023) skepticism about enforcement claims: a user indicated sales discussions did not clarify how segmentation or enforcement would be implemented.
r/PLC (Sep 2022) critical OT detection anecdote: a single user reported poor experience with OT detections in ICS environments.
r/cybersecurity (Oct 2025) operational usage note: a user reported integrating Armis with feeds from multiple sources (Qualys, CrowdStrike, AD, Intune) to aggregate and correlate data.
r/servicenow (Mar 2026) integration friction: a user reported difficulty creating tickets from Armis in ServiceNow and mapping SLAs.

- r/sysadmin (Apr 2023) skepticism about enforcement claims: a user indicated sales discussions did not clarify how segmentation or enforcement would be implemented. - r/PLC (Sep 2022) critical OT detection anecdote: a single user reported poor experience with OT detections in ICS environments. - r/cybersecurity (Oct 2025) operational usage note: a user reported integrating Armis with feeds from multiple sources (Qualys, CrowdStrike, AD, Intune) to aggregate and correlate data. - r/servicenow (Mar 2026) integration friction: a user reported difficulty creating tickets from Armis in ServiceNow and mapping SLAs.

Specific outcomes customers achieved (with metrics when available)

Vendor case material (healthcare) states outcomes such as discovering more assets than expected and supporting HIPAA audit preparation; these are vendor-published claims and should be validated independently.
Vendor collateral includes a case indicating an organization reported complete visibility for certain environments; methodology and independent verification are not provided in the collateral.

Case Studies

Vendor case studies and collateral (treat metrics as vendor-published unless independently verified)
- Medical device security page
  - Collateral states outcomes such as discovering more assets than expected and supporting HIPAA audit preparation.
  - Critical evaluation: the materials do not provide baseline definitions, measurement methodology, or time windows; treat these as vendor-reported outcomes to be validated in procurement.
- AWS-based one-pager (Takeda)
  - Collateral states an outcome described as complete visibility in certain manufacturing environments.
  - Critical evaluation: "visibility" is not explicitly defined in the collateral (e.g., whether it refers to discovered assets, classification accuracy, continuous monitoring, or risk scoring), and independent confirmation is not provided.
- Additional case PDFs and marketing collateral exist in the vendor media repository.
  - Critical evaluation: vendor-produced case studies can illustrate typical deployment scenarios and workflows, but they should not be treated as independent evidence without further validation.
Mixed results / failures
- Direct, formal case studies documenting failed implementations were not identified in publicly accessible sources. Community feedback includes negative anecdotes and operational critiques that serve as counterpoints to vendor material.

- Vendor case studies and collateral (treat metrics as vendor-published unless independently verified) - Medical device security page - Collateral states outcomes such as discovering more assets than expected and supporting HIPAA audit preparation. - Critical evaluation: the materials do not provide baseline definitions, measurement methodology, or time windows; treat these as vendor-reported outcomes to be validated in procurement. - AWS-based one-pager (Takeda) - Collateral states an outcome described as complete visibility in certain manufacturing environments. - Critical evaluation: "visibility" is not explicitly defined in the collateral (e.g., whether it refers to discovered assets, classification accuracy, continuous monitoring, or risk scoring), and independent confirmation is not provided. - Additional case PDFs and marketing collateral exist in the vendor media repository. - Critical evaluation: vendor-produced case studies can illustrate typical deployment scenarios and workflows, but they should not be treated as independent evidence without further validation. - Mixed results / failures - Direct, formal case studies documenting failed implementations were not identified in publicly accessible sources. Community feedback includes negative anecdotes and operational critiques that serve as counterpoints to vendor material.

04Best fit

Company sizes

Best fit: mid-market to large enterprise and public sector organizations
- Rough guidelines: larger, multi-site organizations with significant OT/healthcare device footprints; also relevant for mid-sized regulated organizations with high device diversity.

Industries and verticals where adoption is strongest (with customer examples)

Healthcare and life sciences (medical device security use cases)
Manufacturing and industrials
Government / SLED
Critical infrastructure (utilities, energy)
Examples of brands listed by the vendor: Colgate-Palmolive, United Airlines, Takeda, Mondelēz International, DocuSign (vendor-asserted customer lists).

Roles and personas

Decision makers
- CISO / VP Security
- Head of OT Security / ICS security
- CIO / IT leadership
End users
- SOC analysts
- Vulnerability management teams
- IT asset management / CMDB owners
- Clinical engineering / biomedical device teams (healthcare)

Pain points and challenges the product addresses

Unknown and unmanaged device visibility
Incomplete CMDBs and tool data silos
Devices where agent deployment is not viable (IoT/OT/IoMT)
Overload of findings from multiple tools requiring prioritization

Qualification criteria: what makes a GOOD fit

Complex environments with many unmanaged/IoT/OT assets
An existing security stack (EDR, vulnerability management, SIEM, ITSM) that can be integrated to enrich context
A program goal such as CAASM/CTEM enablement, medical device risk management, OT visibility, or segmentation planning

05The pitch

What the product does (core value proposition in objective terms)

Armis Centrix™ is a cyber exposure management platform that performs continuous discovery, classification, and risk prioritization across IT, OT, IoT, IoMT (medical), cloud, and other connected asset categories. The platform primarily uses agentless/passive techniques with selective active querying.
Primary functionality: provide a unified asset inventory and security context (vulnerabilities, configuration issues, observed behavior, and third-party integration data) to support visibility, prioritization, and remediation workflows.

- Armis Centrix™ is a cyber exposure management platform that performs continuous discovery, classification, and risk prioritization across IT, OT, IoT, IoMT (medical), cloud, and other connected asset categories. The platform primarily uses agentless/passive techniques with selective active querying. - Primary functionality: provide a unified asset inventory and security context (vulnerabilities, configuration issues, observed behavior, and third-party integration data) to support visibility, prioritization, and remediation workflows.

Target market and market positioning

Primary customers are mid-market to large enterprise and public sector organizations with heterogeneous environments (IT + OT + medical + cloud) and a need for continuous asset visibility and risk posture assessment, including regulated industries and critical infrastructure.
Market framing commonly overlaps with:
- CPS Protection Platforms (Gartner category)
- CAASM / asset management & security
- OT/IoT security
- Medical device security
- Exposure management / CTEM enablement

- Primary customers are mid-market to large enterprise and public sector organizations with heterogeneous environments (IT + OT + medical + cloud) and a need for continuous asset visibility and risk posture assessment, including regulated industries and critical infrastructure. - Market framing commonly overlaps with: - CPS Protection Platforms (Gartner category) - CAASM / asset management & security - OT/IoT security - Medical device security - Exposure management / CTEM enablement

Get a comprehensive analysis of Armis including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →