ServiceNow AI Control Tower: Selling a Penthouse While Building the Frame

Dave Vellante (0:00)

ServiceNow is making one of the more consequential and visible bets in enterprise AI. The company says AI Control Tower can discover and govern any agent, work across models and clouds, track cost and value, and shut down behavior that violates policy, the old kill switch.

That sales pitch plays directly into ServiceNow's greatest asset, its install base.

ITSM, CMDB, risk workflows, security operations, and years of operating context give the company a distribution and data advantage that most AI governance vendors do not possess. Our research suggests that moat is real and tangible, but proprietary customer data with our partner Qualitate in a custom survey that we ran shows a little bit more nuanced picture. Control Tower is already strong as a governance workflow and system of action. There's no question about that. It can inventory AI assets, it can connect risks to owners, route approvals, do remediation and preserve an audit trail of all that.

What the field data has not broadly validated, however, is the claim that Control Tower is a complete technical governance and runtime enforcement plane across the heterogeneous enterprise. Hello, I'm Dave Vellante and welcome to Breaking Analysis number 330, ServiceNow AI Control Tower, selling a penthouse while building the frame. In this episode, we pressure test management statements against 15 in-depth interviews with ServiceNow customers conducted with our data partner, Qualitate. And we asked the question, is Control Tower becoming the enterprise control plane or is it limited to the governance system of action?

Here's the high-level answer. ServiceNow doesn't need to own, in our view, every technical control to build a very large AI governance business. It can create enormous value by owning the workflow around those controls, the inventory, the accountability, the approvals, the exceptions, the remediation, et cetera. But the market is collapsing three jobs into one phrase called AI governance, but it's more nuanced than that. So the first job is governance workflow and accountability, and this is where ServiceNow is the strongest. But the second is AI lifecycle evidence, model versions, lineage, validation, bias, explainability, and drift. ServiceNow, it can coordinate that evidence, but customers often generate that elsewhere. The third is runtime enforcement and AI security, intercepting an action, blocking a deployment, constraining an agent, or revoking access in real time at runtime. Our survey indicates this layer is frequently accommodated by external vendors or custom builds or humans. Now, the distinction is that approving a model and assigning a remediation ticket, they're valuable, but they are not the same as validating the model or approving lineage or blocking an action at runtime. ServiceNow opportunity, in our view, is to connect all three. But buyers should be skeptical of claims that connection, that connection across all three is already universally end to end.

Now, Control Tower sits inside a broader ServiceNow agentic AI strategy, which is built on five connected pillars. First is a model agnostic posture. Any model, agent, cloud, data source, or system of record.

The second is the shift from chat assistance, which ServiceNow introduced years ago, to autonomous workers that plan, execute, and adapt across workflows.

Third is centralized governance through AI Control Tower. We're talking here about discovery, ownership, access, observability, and value, and also remediation. Now, the fourth is AI cost and value management. Here we're talking about token economics, model selection, budget control, and ultimately ROI. And the fifth is monetization. So foundation, advanced, and prime tiers, which we'll talk about in a little bit more detail, they seed AI broadly, and they move customers up the stack and add consumption on top of subscription. So these pillars reinforce each other. More agents create more governance demand. More model choice creates more complexity. More governance creates more reasons to stay on the platform, and more usage drives more consumption and drives ACVs up. Our focus today is the key link in that flywheel chain, i.e., whether Control Tower can extend ServiceNow's workflow advantage into technical governance and runtime control. And as we said, pressure testing, management claims. Management's right to win argument is not that ServiceNow builds the best foundation model. It's that ServiceNow already knows how work moves through an enterprise. Bill McDermott describes the moat in one word, context.

ServiceNow says its platform supports roughly 100 billion workflows and nearly 8 trillion transactions.

Amit Zavery, cube alum, says more than 500 customers were live with AI Control Tower in the first six months. And ServiceNow reported AI ACV above a billion dollars in Q2, with a full year target of one and a half billion. Okay, so these are management reported figures, and they underscore the advantage ServiceNow has. The CMDB knows its assets, services, owners, and related dependencies. The IT service management piece and change management know how work is routed and approved. IRM understands controls, risks, issues, and evidence.