ServiceNow’s Credibility Test: Can a Security Slip and an IBM Alliance Coexist in the AI Governance Story?

ServiceNow shares fell 9.3% after an API vulnerability exposed customer data, but strong Q1 revenue growth, an IBM alliance, and upcoming EU AI Act enforcement bolster its enterprise AI governance narrative.

ServiceNow found itself caught between two very different headlines last week. Shares slid 9.30% in the seven sessions following the June 5 closure of a critical API vulnerability that had exposed customer data, closing at €88.56 on Friday. The selloff was amplified by a broader software sector wobble tied to interest-rate anxiety, but the company’s own security lapse cuts deeper: ServiceNow has been repositioning itself as the governance layer for enterprise AI, and the incident strikes at the heart of that pitch.

The irony has not been lost on investors. ServiceNow used its Knowledge 2026 conference to unveil “Autonomous Security and Risk,” expand its AI Control Tower, and open its Action Fabric to external agents — all part of a strategy to become the command center for AI, identity, and connected systems. Then came word that an API within its own platform had lacked authentication controls for weeks, allowing attackers to query employee data, IT tickets, and internal knowledge bases. The fix only arrived after anomalies were spotted.

A counter-narrative emerged almost immediately. ServiceNow announced a sweeping alliance with IBM that will embed Big Blue’s data and automation tools — including Red Hat Ansible and Hashicorp Vault — directly into the ServiceNow AI platform. The goal is to help enterprises modernise legacy applications and make their data AI-ready. The first joint solutions are due in the second half of 2026. The partnership signals that ServiceNow’s strategic momentum with the largest IT buyers remains intact, even as the stock takes a short-term hit.

The fundamentals behind the volatility are solid. First-quarter subscription revenue climbed 22.1% year over year to nearly $3.7 billion, driven by a surge in million-dollar contracts and rising adoption of Now Assist. Management raised its full-year subscription forecast and is targeting more than $30 billion in annual subscription revenue by 2030, with Now Assist contributing roughly 30% of that. Of the 54 Wall Street analysts covering the stock, 43 rate it a buy, with a consensus price target of €122.56 — a 38% premium to the current level. The RSI of 46.5 signals neither oversold nor stable, but the stock had jumped 19% in the month before the security scare, suggesting the drop is more a sentiment shock than a fundamental repricing.

What happens next hinges on two key dates. On July 29, ServiceNow reports second-quarter earnings, and management will need to show that Now Assist is converting users into premium subscribers rather than just adding free-tier customers. On August 2, the full enforcement rules of the EU AI Act for high-risk systems take effect, a regulatory catalyst that should drive enterprises toward centralised monitoring platforms — exactly what ServiceNow is building. But the security incident has added a layer of scrutiny. Oppenheimer, which reaffirmed an outperform rating after talking to 64 clients in late May, noted that AI, IT, risk, and security remain the top investment priorities among ServiceNow’s customer base. Yet the credibility of that governance story now depends on how management addresses the API gap in the coming weeks, including any further disclosures about affected customers and data exposures.

The IBM pact provides a tangible signal that ServiceNow’s enterprise relationships are expanding, not contracting. The market, however, is watching whether the company can secure its own infrastructure before selling that capability to others. Declarations no longer suffice; the next earnings call will be the first real test of whether the AI Control Tower can withstand a crisis it was meant to prevent.