ServiceNow: One Lock Behind a Hundred Doors — Is NOW a Buy After the 55% Crash? #

20 June 2026 | Price: $95.04 | Position: none — not a buy (category mismatch + no margin of safety) | Market cap: ~$98B | Graham: fails the defensive screen (growth name) — assessed via the Growth Stock Addendum

The set-up in one paragraph #

The question that prompted this came off a Reddit post: "$NOW is cheap now? Trump bought, the CEO bought, I bought 1430 NOWL at $5.40, TP $12.25." As usual, the value of the exercise was pulling the tangled claims apart ([shr-026] — treat every social thesis as lead generation, never analysis). The post is right about more than I first gave it credit for — and the one place it's wrong is the place its author actually put his money. ServiceNow is down ~55% from its high, still compounding revenue at 20%+, and sitting on the weakest kind of moat there is — which is exactly why the conversation stopped being about a Reddit post and became about a much better question: what is ServiceNow, really, and will an LLM eat it? Both sides, honestly.

Part 0: Cleaning up the Reddit post (and my own first mistake) #

Before the analysis, the claims — because three of them are true, one is a trap, and the most instructive error in the whole thread was mine.

• "The CEO bought 28,682 shares / ~$3M on 27 Feb" — true. Bill McDermott made a genuine open-market purchase at ~$104.60, pre-announced via 8-K, and terminated his 10b5-1 sell plan to do it. My first instinct was to flag it as internally inconsistent — "28,682 shares at $800+ is $24M, not $3M." I was wrong, and wrong in exactly the way the playbook warns against. ServiceNow did a 5-for-1 split on 18 December 2025; post-split it trades near $100, so 28,682 × ~$104.60 ≈ $3.0M reconciles perfectly. I "caught" an inconsistency that existed only because I was running on a stale pre-split price. That is [shr-042] (internal inconsistency is the cheapest tell that something is running on stale state — sometimes the something is you) and [shr-041] (verify your own assumptions, not just other people's). Lesson re-paid.
• "Trump bought $1–5M of NOW on 10 Feb" — true but analytically worthless. It's a real OGE disclosure (a dollar range, not a figure), but it was one of dozens of tech names bought in a single broad Q1 sweep. It is not stock-picking and carries zero signal. Ignore it.
• "85% of Fortune 500 / 98% retention" — both true. Standard, accurate company metrics (the 98% is reported as a renewal rate).
• "I bought 1430 NOWL at $5.40, TP $12.25" — this is the actual trap. NOWL is not ServiceNow. It's the GraniteShares 2x Long NOW Daily ETF — a leveraged, daily-reset product (1.51% fee, 52-week range $29 → $3.49) that bleeds value to volatility decay even when NOW rises. It trades near $4, not $5.40, and leveraged daily ETFs don't carry price targets — the "$12.25 TP" is invented. The poster is pitching the stock and buying a different, structurally-decaying instrument. Whatever you conclude about NOW, do not hold NOWL "for three months."

So the post is a good lead written by someone who doesn't know what he's holding. Onward to the real work.

Part 1: The Bull Case (steelmanned) #

1. This is not a value trap — the business is compounding #

NOW is down ~55% from its 52-week high ($211.48), -51% over one year, -35.5% YTD. Crucially, that is multiple compression, not business deterioration. Revenue growth has been remarkably stable:

Eight-plus quarters in a 19–22% band, re-accelerating in the most recent print. cRPO grew +22.5%. This passes the deceleration gate cleanly ([shr-043] — the "E" and "B" under the price are rising, not falling). Add a 98% renewal rate and 85% of the Fortune 500 as customers, and you have a genuinely sticky, durable compounder — not a Maersk-style cyclical trap ([shr-017]).

2. It's the cheapest it's been in years #

The de-rating is real. P/adjusted-FCF has compressed from ~89x (2023) → ~60x (2024) → ~38x today. Forward non-GAAP P/E is ~19x against ~20% earnings growth. For a business of this quality, that's the first time in its public life it has looked anywhere near reasonable.

3. The CEO put his own money down #

McDermott's $3M open-market buy is the strongest single bullish signal here — own money, pre-announced, with his sell plan torn up ([shr-002] — purchases cost the buyer something, exercises don't).

4. The AI line is real, not vaporware #

Now Assist crossed ~$750M ACV in Q1 2026 (target raised from $1B to $1.5B), and customers spending $1M+ on it grew >130% YoY. The "AI wrapper, no there there" framing from the March 2026 r/ValueInvesting audit ([shr-032]) is overstated — there is a real, fast-growing AI product.

Part 2: The Bear Case (the data) #

1. "Cheap" disappears the moment you treat SBC honestly #

This is the central valuation fact for any growth-tech name ([shr-001], [shr-005]). ServiceNow expenses ~$2.0B/year of stock-based compensation — 14.6% of revenue — and that is a real cost to shareholders via dilution, not an add-back.

The flattering "~19x forward P/E" is a non-GAAP number that adds the $2B of SBC right back. On honest cash, you're paying ~38x FCF (a 2.6% real FCF yield) for ~20% growth — roughly a 1.9x PEG-equivalent. The Graham Growth Addendum says the same thing ([shr-004], implied growth = (P/E − 8.5) / 2):

Trailing GAAP already prices in more growth than the company is delivering. There is no Graham margin of safety here — this is fair value for quality, not a discount.

2. The insider signal is mixed, not a green light #

McDermott's buy is one conviction purchase. Net six-month insider flow is negative: ~$3.0M bought (all McDermott) against ~$4.4M sold across ten transactions by other officers and directors (Sands $1.48M, Canney $0.80M, Fipps ×3…). [shr-002] weights systematic C-suite buying; one symbolic buy against broad routine selling is amber, not green.

3. The AI narrative isn't in the whole-company numbers yet #

The honest version of [shr-032] holds even though "no AI revenue" is wrong: despite Now Assist ACV jumping ~$500M, full-year guidance didn't move, and GAAP gross margin compressed four straight quarters (~79% → ~75%). The AI is real but it is not yet accelerating total growth or defending margin — it's running ahead of its own financial proof.

4. The real reason it's down — and it's unresolved #

Q1 2026 beat on every metric and the stock fell ~18%. Drivers: Middle-East government deal slippage (timing), the $7.75B Armis acquisition diluting margin (−75bps), and — the big one — a sector-wide fear that agentic AI guts per-seat SaaS pricing. That last one is not a data question; it's a 3–5 year platform-survival question. Which is the whole point of the next section.

Part 3: The real question — is it just a database? #

This is where the analysis stopped being about NOW's quarter and became about its existence. The bear thesis, stated from first principles, is: "Build a secure DB, auth it properly, point an LLM at the APIs with the right permissions, add a few evaluators — and you've rebuilt ServiceNow." It's a strong argument. Here is where it lands.

The test that separates "just a DB" from a real moat #

"It's just a database" is true of every software company at the bottom of the stack — Google is "just an index," a bank is "just a ledger." The reduction only fails when value lives in something you can't get by copying the code. Three kinds, in descending strength:

1. Network effect — can't fork the users (Google's data flywheel, Facebook's social graph). Strongest. Irreducible.
2. Trust / liability / regulatory backstop — can't fork 15 years of audits and a government guarantee (a bank's deposit base; ServiceNow's FedRAMP/SOC 2 certifications). Medium, and erodable.
3. Switching cost / data gravity — can be forked; it's just expensive and annoying to leave. This is a toll, not a moat.

Run ServiceNow through it: there is no network effect. My ServiceNow instance does not improve because another company also runs ServiceNow. Its moat is almost entirely #3 (switching costs) with a sliver of #2 (compliance certs). It sits on the weakest rung. That is why it de-rates 55% the instant a new substrate threatens the toll — and it means the skeptic's "it's basically just a DB" is closer to true for ServiceNow than for almost any other software giant. That is not a defence of the stock; it is the bear case, stated precisely.

Where the "LLM + connection" thesis is right #

• Connectors got easy. Wiring one API to an LLM is genuinely trivial now. AI lowers the cost of writing and repairing integrations — a real chip off the integration moat.
• The no-code builder is under threat. If a business user can prompt an LLM to assemble a workflow, she needs neither ServiceNow's drag-and-drop builder nor a dev team.
• ServiceNow never replaced the judgment. This is the sharpest point of all. Across its entire catalog, ServiceNow routes a request to a human who decides and then records that he decided. It automated the cheap half (routing); the human approver's brain — the expensive half — it never touched. An LLM eats the expensive half. So value can migrate from the rail-owner to the judgment-provider, inverting the bull thesis.

Where it overreaches #

The phrase "and a few evaluators" is where 80% of the work gets smuggled out of sight. Three things stay hard:

• Scale. "Connect everything" means hundreds of tools, and tool-selection accuracy degrades sharply as the count climbs. The proof is sitting in the harness this very post was researched in: an advanced agent environment does not load all its tool connections — it defers them and makes the model search for each one on demand, precisely because dumping every connection into context degrades the model. The people who most want "just give it all the APIs" to work built the opposite.
• Security. "Give it the API connection" describes a god-mode credential — the worst possible design. An agent acting for a user must inherit that user's permissions (per-user OAuth delegation), or you've built a textbook confused-deputy: anyone prompt-injects the agent into doing what they personally can't. Prompt injection is unsolved, so the manipulable component (the LLM) must never be the component that holds the keys.
• Guarantees. Auditors require controls to be deterministic and reproducible. "An LLM decided" fails an audit. The authorization gate, the segregation of duties, the immutable trail — these must be deterministic policy the LLM proposes to but cannot override. And 95%-reliable tool calls across a 10-step workflow compound to ~60% end-to-end; enterprises need ~100%.

The clean way to say it: an LLM is all you need for the part that was judgment. It's almost none of what you need for the part that was guarantees. Enterprise workflow software is ~20% judgment and ~80% guarantees + plumbing. AI eats the visible, impressive 20%. The 80% — deterministic auth, audit, reliability engineering, certification — is why it's still not a weekend project. But note: that surviving 80% is not ServiceNow-proprietary either. Anyone can build a policy engine. So the residual moat shrinks to certifications + incumbency + the connector library + switching costs — thinner than the bulls priced, not zero.

One lock behind a hundred doors #

The catalog makes the bet concrete. ServiceNow ships 100+ products across six "workflow families" — ITSM, ITOM, SecOps, GRC, CSM, HRSD, Legal, Procurement, App Engine, Integration Hub, ~3,000 store apps — but every one is the same primitive re-skinned: a request → routed for a human's approval → tracked → audited. ServiceNow's genius was selling one workflow engine N times by relabeling the form.

• Bull read: 100 products = 100 cross-sell surfaces, land-and-expand, the 98% renewal. Looks like 100 moats.
• Bear read: if all 100 are the same rail re-skinned around a human decision, and the LLM eats the decision, the differentiation between them collapses — they all reduce to "agent + audit log + connector." Whoever builds that once threatens all 100 at the same time. The breadth that looks like a hundred moats is a hundred instances of the same single moat — and AI is a master key for that one lock.

That is the entire investment debate in one image: a hundred doors, one lock. The bull bet is that ServiceNow re-keys every door to "agent + their rails" (Now Assist, AI Agent Studio — they are frantically stuffing AI skills into all 3,000 store apps) before anyone picks the lock. The bear bet is that the lock was never that good.

The verdict #

Not a buy at $95 — for two independent reasons, neither of which is "it's a bad company."

1. No margin of safety. On SBC-honest cash it's ~38x FCF for ~20% growth, and trailing GAAP already implies 24% growth against ~20% delivered. Fair value for quality — no Graham discount to lean on.
2. The thinnest kind of moat, at the exact moment its solvent is invented. ServiceNow's edge is switching costs (a toll), not a network effect (a moat), and AI is a toll-dissolving technology. The disruption question — does the incumbent own the agent substrate, or get disintermediated by it — is genuinely unresolved, and you'd be buying the coin flip at roughly fair value for the good outcome.

It's also a category mismatch for this satellite, which runs on value/income margins of safety (AGN, AIG, AKE), not "pay fair price for quality and pray it wins the agentic transition over five years" ([shr-019], [shr-016]).

What would change the verdict: a pullback toward ~25x SBC-adjusted FCF (~$60–65), where a real margin of safety opens — or one or two quarters where Now Assist ACV demonstrably lifts total-company growth above ~22% with GAAP gross margin stabilising, which would defang the disruption thesis. Either earns a proper score. Until then it's a watchlist name with an alert near $63, not a position.

The skeptic in this conversation was right about almost everything — the no-code moat, the integration moat, the non-technical-buyer moat, "it's mostly just a DB," "ServiceNow never replaced the judgment." Every one of those is a real soft spot. But the market found those soft spots too: that is what the 55% haircut is. The open question was never "is the bear right." It's "is the bear more right than the discount already assumes" — and at $95, that's an unknowable coin flip. Good company. Fair price. Thin moat. Live disruption. Wait.

Not investment advice. Figures independently verified against ServiceNow's Q1 2026 results (23 Apr 2026), SEC Form 4 filings (McDermott purchase, 27 Feb 2026), the OGE disclosure on the Trump purchase (released 14 May 2026), live quotes, and the ServiceNow product catalog as of 20 June 2026. Prices reflect the 5-for-1 split of 18 Dec 2025. The data above is the work, and the work says: a hundred doors, one lock — and an LLM standing in front of it with a lockpick. Fairly priced for the outcome where the lock holds. Wait for either a cheaper price or proof the lock holds.