ServiceNow's AI Control Tower: Strong on Workflow, Unproven on Technical Enforcement

ServiceNow Inc. is making a substantial bet on enterprise AI governance with AI Control Tower, a system designed to discover and govern autonomous agents, work across different models and cloud providers, track spending and value, and prevent policy violations. The pitch targets ServiceNow's primary competitive advantage: a massive installed base of customers already running IT service management, configuration management databases, risk workflows and security operations on the platform.

That distribution advantage is real, according to research conducted through interviews with 15 large enterprise ServiceNow customers. But the same research exposes a gap between what management claims Control Tower can do and what customers have actually deployed. The company's marketing suggests AI governance is a single unified function, when in reality it breaks into three distinct technical layers that often require different vendors and budgets.

Three separate jobs, one marketing message

ServiceNow may not need to own every technical control to build a large business around AI governance. The company could create substantial value by owning the workflow layer—inventory, accountability, approvals, exceptions, remediation and audit history. But the current marketing pitch allows customers to collapse three separate jobs into a single phrase.

The first job is governance workflow and accountability. This is where ServiceNow demonstrates the clearest strength.

The second is AI lifecycle evidence—model versions, lineage, validation, bias, explainability and drift tracking. ServiceNow can coordinate this evidence, but customers frequently generate it using other platforms.

The third is runtime enforcement and AI security—intercepting an action, blocking a deployment, constraining an agent or revoking access in real time. Field research indicates this layer is often external, custom-built or human-mediated.

Approving a model and creating a remediation ticket are valuable activities. They are not, however, the same as technically validating the model, proving its lineage or blocking an action at runtime. ServiceNow's real opportunity is connecting all three layers, but it is not best-of-breed in each one according to its own customers.

The five pillars of ServiceNow's agentic AI strategy

AI Control Tower sits within a broader ServiceNow agentic AI strategy built on five reinforcing pillars.

• Model-agnostic posture: any model, agent, cloud, data source or system of record
• Shift from chat assistants to autonomous workers that plan, execute and adapt across workflows
• Centralized governance through AI Control Tower—discovery, ownership, access, observability, value and remediation
• AI cost and value management: token economics, model selection, budget control and ROI
• Pricing and packaging: Foundation, Advanced and Prime tiers designed to seed AI broadly, move customers up the stack and add consumption on top of subscriptions

These pillars reinforce one another. More agents create more governance demand. Model choice creates complexity. Governance addresses complexity and creates more reasons to stay on the platform. More usage drives more consumption. The critical question is whether AI Control Tower can extend ServiceNow's workflow advantage into technical governance and runtime control.

Numbers that underscore momentum

ServiceNow's competitive argument is not that it builds the best foundation models. Rather, the company already understands how work moves through enterprises. CEO Bill McDermott describes the moat in one word: "Context."

ServiceNow reports its platform supports roughly 100 billion workflows and nearly 8 trillion transactions. More than 500 customers were live with AI Control Tower within the first six months, according to executive Amit Zavery. The company reported AI annual contract value above one billion dollars in Q2, with a full-year target of $1.5B.

The configuration management database knows assets, services, owners and dependencies. IT service management and change management know how work is routed and approved. Identity and risk management understands controls, risks, issues and evidence. A specialized vendor may have deeper model analytics, but it often lacks the operational graph that identifies the owner, business service or remediation path.

Field study methodology

TheCUBE Research commissioned a qualitative study through partner Qualitate, which conducted fieldwork from September 15 through September 21, 2026. The final sample consisted of 15 completed large-enterprise interviews totaling 575 minutes. Eleven respondents were in North America and four in Europe. Five came from financial services, four from healthcare, three from technology and telecommunications, and three from public sector, manufacturing or other industries.

The sample was senior: three executives or vice presidents, ten directors or functional heads, and two senior managers. Every respondent had an existing ServiceNow footprint. Eleven of the fifteen customers had either installed, piloted or were actively evaluating ServiceNow AI Control Tower.

The study deliberately focuses on expansion, coexistence, implementation and control boundaries inside real accounts. There is an inherent bias toward the ServiceNow installed base—by design, since management's premise is that it has an installed-base advantage. The methodology specifically separates direct customer experience from management claims.

ServiceNow's workflow and operational moat holds up

All fifteen respondents recognized ServiceNow's workflow, operational integration or incumbency advantage. However, fourteen of fifteen described runtime enforcement as external, custom, human mediated, limited to selected paths or not proven at enterprise scale. The single exception was a limited financial-services pilot that successfully tested ServiceNow's blocking capability for at least one model and one agent.

Twelve of fifteen identified a model-specific evidence gap—validation records, lineage, bias, explainability, drift history or AI-specific regulatory artifacts. Twelve of fifteen also tied governance value or switching cost to the wider Now Platform, mainly IT service management, configuration management database, change management and security operations.

The same ServiceNow architecture creates both the moat and its boundaries. ServiceNow is hard to displace because governance work is embedded in operations. But the value story degrades when the configuration management database is immature, the AI estate sits outside ServiceNow control paths, or regulators require technical evidence generated elsewhere.

One respondent characterized ServiceNow as more of a governance orchestration layer than the actual governance of AI. The reality is more nuanced: it is real governance, but strongest at orchestrating accountability and action.

Configuration management database dependency creates friction. A senior engineering manager at a large North American financial services company explained:

The CMDB dependency is big time on this because it must be cleaned up quite often, and that is the reason there are a lot of surveys that have been sent within the organization to actually clean up the CMDB on a regular basis. And a lot of auditing around is to be done as part of that.

Senior engineering manager, large North American financial services company

Three operating layers with different buyers and budgets

The interviews reveal that AI governance is separating into three distinct operating layers, each with different buyers and budgets.

Governance workflow and accountability

Inventory, ownership, approvals, exceptions, issues, remediation and audit history. ServiceNow has the clearest advantage here.

AI lifecycle evidence and regulatory proof

Model versions, lineage, validation, bias, explainability, drift and performance history. Hyperscaler-native tools, model platforms and specialists often supply this layer. IBM with Watsonx.governance, Fiddler AI and Credo AI are examples.

Runtime enforcement and AI security

Gateway policies, permission checks, agent identity, deployment gates and the ability to block or constrain actions. Security and AI platform budgets usually fund it. Palo Alto Prisma AIRS and Cisco AI Defense are examples.

This explains why architectures remain multi-vendor even when vendors claim end-to-end governance. There are three different activities involved: the completion of a workflow, a model validation artifact such as a report generated while evaluating a model, and a blocked action at runtime versus an asynchronous alert to a human.

The question for ServiceNow is whether it can own every layer or whether it will become the policy authority and hub for evidence that connects these three layers and acts as the system of action. The field study validates management's story while highlighting notable weaknesses.

ServiceNow's strength: turning a governance finding into work

An AI asset can be connected to an application, business service, owner and dependency in the configuration management database. Identity and risk management can attach controls, risks, issues, evidence and exceptions. IT service management, change management and Action Fabric can route the finding, track remediation and preserve the audit history.

Action Fabric is ServiceNow's interoperability and governance framework that lets external AI agents like Claude execute multi-step workflows inside ServiceNow in a headless manner, similar to Salesforce's Headless 360, bypassing the traditional interface.

One respondent put it simply: "Day one ServiceNow, day one workflow." Another noted that the configuration management database matters because an AI risk can be connected to the application and business-service owner. A model-risk tool may detect drift or bias, but if the organization cannot assign, prioritize, remediate and prove what happened, the control has limited operational value.

ServiceNow is exceptionally well positioned to be the system of action for AI governance. The question is how much technical evidence and enforcement it can bring into that system.

What end-to-end architecture should deliver

When the architecture works as advertised, AI Control Tower discovers the asset and establishes ownership. The configuration management database supplies application, service and dependency context. Identity and risk management brings policy, risk, control, evidence and exception records. IT service management and Action Fabric turn the finding into assigned remediation work. That internal path is ServiceNow's sweet spot.

Limits appear when the organization needs technical model evidence or a live intervention at runtime. Technical validation may come from a model platform or specialist vendor. Blocking may occur in an API gateway or security product. The telemetry then has to return to Control Tower as evidence. In several customer interviews, that connection was incomplete or unclear. Different teams owned governance, model tooling and security. Data models and workflows did not align automatically.

ServiceNow does not have to be the box that blocks every action. But it should define policy, identify the owner, send the decision to the right enforcement point, receive telemetry and preserve the audit trail. That is the closed loop.

The 'kill switch' claim does not hold up broadly

Bill McDermott stated on CNBC's Mad Money in July 2026 that ServiceNow possesses a kill switch to halt rogue AI agents and prevent disruptions, contrasting it with incidents like OpenAI's agent escaping a test environment and hacking Hugging Face. Field research exposes significant limitations to this assertion.

Only one respondent reported a very positive pilot, and that was limited. In that case, at least one model and one agent were tested for blocking, auditors were satisfied, and the respondent gave high marks. That case directly supports management's claim in a selected environment.

The other fourteen respondents described runtime control as external, custom, human mediated, limited to selected paths or not proven at scale. What has not been validated—and appears to be a gap—is universal coverage across Azure OpenAI, custom agents, SaaS copilots, third-party models, shadow AI, multiple clouds and non-ServiceNow workflows.

One security practitioner estimated that only 30 to 40 percent of total AI activity could realistically pass through ServiceNow control paths today. The kill-switch claim is overstated. It is not yet proven as a universal enterprise runtime control plane.

Procedural proof versus technical proof

ServiceNow is strong at procedural proof—showing who approved a use case, which control was completed, who owns the exception, whether remediation occurred and what the audit history looks like. Several respondents said auditors accepted the ServiceNow record.

Gaps become more obvious in high-risk or regulated use cases. Survey respondents indicated ServiceNow gaps in many areas related to technical proof, including validation methodology, test dataset, model versions, training-data lineage, bias and fairness results, explainability, drift and performance history, prompt and response evaluations, hallucination and toxicity tests, permission evidence and a record of what the agent did at runtime.

Those artifacts are most often generated by alternative platforms—IBM, hyperscaler-native governance tooling, other model platforms, machine learning operations systems, privacy and AI governance specialists, or traditional model-risk tools. Control Tower can still become the place where that evidence is captured, evaluated, linked to policy and operationalized. But ServiceNow is currently overstating its position by using end-to-end language. Survey data suggests that today, ServiceNow is weaker at showing the complete evidence path for a real model or agent across a heterogeneous environment.

Buying decisions hinge on ServiceNow footprint and regulatory intensity

Where ServiceNow is deeply embedded and regulation is modest, Control Tower has its best expansion opportunity. This is the consolidation sweet spot for ServiceNow and probably represents the largest addressable market.

Where regulation is high and ServiceNow is deep, customers often preserve ServiceNow as the system of action but add independent lifecycle evidence and runtime controls. Coexistence is likely. That is also a fairly large chunk of the market.

Where regulation is high and the ServiceNow footprint is shallow, the field is open to independent AI governance and model-risk tools. Where both are limited, hyperscaler-native controls or lighter specialists may be sufficient.

The research exposes three different buyer personas. IT operations and platform owners value workflow, context and consolidation. Model-risk and AI governance teams value technical proof. Security teams own runtime control. The vendor that speaks to only one persona may win the feature argument and still lose the account.

Pricing and packaging create friction

This spring, ahead of ServiceNow Knowledge, the company replaced its legacy package tiers with three AI-native pricing and packaging tiers: Foundation, Advanced and Prime. Management reports price uplifts of roughly 20 to 30 percent in the lower AI tiers and more than 30 percent in Prime, with subscription commitments paired with usage-based meters.

The survey supports the momentum in ServiceNow annual contract values. It shows that the operating model drives higher invoices. But the data also exposes meaningful customer friction. Twelve of 15 respondents said pricing, packaging or total-cost were acute concerns. Thirteen described significant configuration, integration or staffing friction.

Eight respondents supplied actual data comparing expectations to actual costs. Seven of the eight said costs came in above expectations, and one described the rollout as broadly on budget. The cost overruns were not from licensing issues alone. They included partners, data normalization, configuration management database hygiene, custom workflows, integration engineering, permanent specialists, administration and external controls.

One respondent said: "We expected to need ServiceNow specialists, but we underestimated how permanent that would be."

Customer feedback on pricing included: "the packaging is frustrating," "We expect costs to increase" and "Our costs came in 30% above our original expectation."

This does not mean the value is poor. Some customers justified the extra cost. The issue is predictability. Customers should force ServiceNow to sell a bounded outcome, make integration assumptions explicit and show the full operating cost.

The market is fragmenting into distinct budget layers

Runtime enforcement and AI security include Palo Alto Networks, Guardrails AI, Kong, Lakera, HiddenLayer and Protect AI. Hyperscaler-native governance includes Microsoft Purview and Azure AI, Bedrock Guardrails and Vertex AI governance. Specialist or AI governance leaders include IBM, OneTrust, Credo AI, Holistic AI and ModelOp. Traditional governance, risk and compliance and model-risk tools include Archer, AuditBoard, MetricStream, LogicGate and Navex.

Notably, twelve of fifteen respondents were evaluating or deploying separate runtime controls, usually from cybersecurity or AI platform budgets. The obvious opportunity for ServiceNow is to orchestrate and preserve evidence across all these tools. The risk is that the vendor owning the enforcement point also captures the telemetry, the security buyer and eventually the policy decision. ServiceNow could receive a ticket after the fact instead of controlling the loop.

The answer is potentially openness with authority—customers choose any enforcement technology while Control Tower remains the policy system, accountability layer and durable evidence system of record to support the overall system of action.

Pressure testing management's claims

The incumbency and context moat is definitely supported by the survey. All fifteen respondents recognized ServiceNow's workflow, operational or installed-base advantage.

Model-agnostic orchestration is directionally supported. Customers value broad connectivity, but connector breadth is not the same as control depth.

The end-to-end governance claim is a stretch. Control Tower is strong on inventory, accountability and procedural evidence but model-specific artifacts are frequently generated elsewhere.

The kill-switch claim is also overstated. It is supported for selected pathways but definitely not yet as a universal runtime control plane. One positive pilot is good but 14 respondents describing external, custom or limited enforcement suggest immaturity.

Cost transparency is an execution issue. Value management is a credible promise. The packaging creates attach and consumption opportunity but implementation remains a source of friction.

The field is not saying Control Tower is vaporware. Claims that it is just a bolt-on are overstated, but its scope is currently limited. ServiceNow is strongest where governance turns into actual work. It is less proven where governance becomes mathematical model evidence or a real-time intervention across a heterogeneous estate.

The investor angle: compelling bull case with gaps

From an investor and strategic perspective, the bull case is compelling. AI Control Tower creates a new attach point into a sticky and powerful installed base. It converts configuration management database context into a governance system of action. The model-agnostic posture gives optionality across labs and hyperscalers. The commercial model creates subscription uplift plus consumption.

There are areas of concern. Based on customer surveys, runtime claims are ahead of broad field validation. Model-specific evidence still depends on adjacent tools with better depth. Implementation friction can slow adoption and create cost overrun surprises. Security vendors, deep governance experts and hyperscalers can capture control points and budget.

The business can be excellent without ServiceNow owning every technical control. Orchestration is the strongest position because buyers rarely want to replace every model platform, security product or cloud control. They want a common policy, accountability and action layer.

The company's valuation has fluctuated substantially, peaking in late 2024 at around $230B, dipping to the mid $80B range in April of this year. Market cap is now on the rise again at around $146B as of this writing. The valuation debate will rest on how successfully ServiceNow can convince investors that it is an AI winner, which in part depends on the company's ability to monetize the closed loop. If Control Tower becomes the policy authority and evidence hub, the moat expands. If it only receives alerts after other products make the important decisions, the strategic value is more limited.

What customers should do before scaling

The research does not say Control Tower lacks value. Quite the opposite. Customers consistently value ServiceNow's workflow, configuration management database context, accountability and ability to turn a governance finding into work. But orchestration is not the same thing as technical enforcement, and that distinction is where buyers can get into trouble. In fourteen of the fifteen interviews, broad runtime enforcement was external, custom, human-mediated, limited to selected pathways or not yet proven at enterprise scale.

Start by mapping the control sequence. For one specific model or agent, name the policy owner, the source of model-level evidence, the exact enforcement point, the telemetry path and the remediation owner. Do not accept an architecture in which every arrow disappears into a black box control plane.

Next, test a real violation. Pick a high-risk use case—an agent that can access sensitive data, move money, change infrastructure or interact with customers. Trigger a policy breach and show where the action is blocked or constrained. Then verify that the event comes back into the governance record, creates the right case, assigns an owner and preserves the evidence an auditor would need and accept.

Third, price the full operating model—not just the Control Tower license. Include identity and risk management and configuration management database dependencies, data normalization, connectors, implementation partners, external runtime controls, AI uplifts, service fees and the recurring specialists needed to maintain the system. Those operating costs are where many programs moved significantly beyond their original expectations.

Finally, protect optionality. This is fundamental to AI sovereignty. Architect around open APIs, explicit integration responsibilities, service levels and have compensating controls for an exit path. Buyers should have a shared accountability model with their vendors and internal stakeholders. Understand who owns the policy, who owns the enforcement point and who is accountable when a handoff fails.

The buyer gate should be no production-scale growth until one real violation is detected, blocked, recorded and remediated end to end. ServiceNow can be the system of action without being the only control. The buyer's job is to prove that the entire system works as a system.

https://www.youtube.com/embed/Y-LyGsuzbps?start=1&feature=oembed