Contents

ExpressVPN

  • Last Updated: November 18, 2025
  • No Comments
ExpressVPN
BDS Rating
Grade
B
BDS Score
647
V-MIL
3.8
V-ECON
7.2
V-POL
5.5
Open Full Report

1. Executive Dossier Summary

  • Company: Kape Technologies plc (as parent of ExpressVPN)
  • Jurisdiction: Isle of Man (Holding Company); London, UK (Operational HQ); Tel Aviv, Israel (R&D Center)
  • Sector: Digital Security, Privacy Software (VPN), Ad-Tech (formerly)
  • Leadership: Teddy Sagi (Sole Owner, E001); Ido Erlichman (CEO, E002)

Intelligence Conclusions:

  • Strategic Israeli Control: Kape Technologies, the parent of ExpressVPN, is 100% privately owned and controlled by Teddy Sagi, an Israeli billionaire residing in Tel Aviv.1 This structure consolidates all operational, financial, and strategic decisions under a single Israeli national, eliminating all public accountability and oversight.
  • Milit-Intel Leadership Core: Kape’s leadership exhibits a strategic, non-incidental pattern of recruitment from elite Israeli military and intelligence units. This includes its founder, Koby Menachemi (E003), from the signals intelligence Unit 8200 3, and its current CEO, Ido Erlichman (E002), an officer from the Duvdevan Unit (Unit 217), an elite special forces commando group.4
  • Active Ideological Alignment: Kape’s CEO, Ido Erlichman, publicly frames his corporate leadership philosophy as a direct extension of his IDF special forces service, detailed in his book, ‘Battle of Strategies’.5 This demonstrates a conscious and active ideological alignment with Israeli military doctrine, not a passive or past association.
  • Systemic Deception: Kape is the rebranded identity of Crossrider (E010), a company notorious for developing and distributing a platform used for adware, malware, and browser hijacking.7 The 2018 rebrand was a deliberate act to escape this reputation.10
  • Operational & Economic Base: Despite a London headquarters, Kape’s core technical and R&D operations are centered in Tel Aviv.11 The company has made strategic acquisitions within Israel, including the Tel Aviv-based Webselenese (E005), and presents itself as an “Israeli-founded company” in Israeli media.13
  • Market Manipulation: Kape (via its Webselenese acquisition) owns and operates major VPN “review” websites, including vpnMentor.com (E006) and Wizcase.com.9 These sites rank Kape-owned VPNs (ExpressVPN, PIA, CyberGhost) as their top recommendations, representing a systemic conflict of interest and a continuation of the deceptive modus operandi established in its Crossrider era.

2. Corporate Overview & Evolution

Origins & Founders

Kape Technologies was founded in 2011 as Crossrider Advanced Technologies.11 Its co-founder and original CEO was Koby Menachemi (E003).14 Menachemi is a veteran of the Israeli Defense Forces’ Unit 8200, the signals intelligence and cyberwarfare division often compared to the US National Security Agency.3

Crossrider’s business model was not privacy; it was ad-tech. The company provided a development platform that was widely used to create ad-injectors, toolbars, and browser hijackers, leading security firms like Malwarebytes and Symantec to classify its software as Potentially Unwanted Programs (PUPs) or adware.7 A 2015 Google security report identified Crossrider as a key “distributor” in the ad injection ecosystem, profiting from each installation.19

  • Assessment: The company’s origins are not in user protection but in user exploitation. Its technical foundation and initial leadership were drawn directly from Israel’s state surveillance apparatus (Unit 8200), establishing a culture and skillset antithetical to its current “privacy-first” branding.

Leadership & Ownership

In 2012, Crossrider was acquired by Israeli billionaire Teddy Sagi (E001) for $37 million.11 Sagi, an Israeli citizen and Tel Aviv resident 2, has a criminal history, having been convicted and jailed in the 1990s for “manipulating bond prices” and insider trading.17

In 2016, Ido Erlichman (E002) was appointed CEO.11 Erlichman is also a veteran of the IDF, having served as an officer in an elite Special Forces Unit 5, identified as the Duvdevan Unit (Unit 217).4 This unit is known for conducting undercover counter-terrorism operations, with sources describing its mission as including “intelligence operations and assassinations against the local Arab population”.4

In 2018, Erlichman, under Sagi’s ownership, rebranded the toxic Crossrider name to Kape Technologies 10 and began a new strategy: acquiring established “privacy” brands. Kape acquired CyberGhost (2017), Private Internet Access (2019), and, most notably, ExpressVPN (2021) for $936 million.22

In 2023, Teddy Sagi, through his holding company Unikmind Holdings Limited (E004) (registered in the Isle of Man), acquired 100% of Kape’s shares and delisted it from the stock exchange.1

  • Assessment: Kape’s leadership and ownership structure represents a direct and intentional link to Israeli national and military-tech interests. The company is privately controlled by an Israeli billionaire (Sagi) and operationally managed by a CEO (Erlichman) whose entire leadership philosophy is publicly sourced from his elite IDF special forces service. This is not a “global tech company”; it is a centralized, Israeli-controlled entity.

Operations & Presence

While Kape maintains a corporate headquarters in London, UK, for regulatory and financial purposes 25, its operational and technical core is located in Tel Aviv, Israel.10 The company actively recruits for high-level engineering roles, such as C++ Software Engineers, in its Tel Aviv office, identifying this as a key R&D center.12

Furthermore, Kape’s strategic acquisitions have centered on the Israeli tech ecosystem. In 2021, it acquired Webselenese (E005), a Tel Aviv-based digital content company, for $149 million.28 Kape also retains Israeli PR firms, such as OH! Orenstein Hoshen, to manage its communications within Israel.30

  • Assessment: The London HQ provides a “flag of convenience” while the company’s brain and center of gravity remain in Tel Aviv. This operational structure ensures Kape’s integration with the Israeli tech sector, which is itself deeply intertwined with the state’s military and intelligence apparatus.

Public Positioning vs Behaviour

Kape aggressively markets itself as a “leading privacy-first digital security software provider”.25 Its mission, it claims, is to provide “complete online autonomy”.26

This positioning is directly contradicted by:

  1. Its Origin: As Crossrider, its business was built on software that violated user privacy and autonomy.7
  2. Its Marketing: Its acquisition of “review” sites vpnMentor and Wizcase, and their subsequent favorable rankings of Kape products, is a deceptive marketing practice designed to manipulate user choice, not inform it.9
  3. Its Personnel: The parent company of ExpressVPN hired a CIO, Daniel Gericke (E009), who was simultaneously being fined by the U.S. Department of Justice for his role in Project Raven—building and using offensive cyber-espionage tools for the United Arab Emirates to spy on journalists and activists.17
  • Assessment: The company’s public commitment to “privacy” is a marketing narrative, not a reflection of its corporate character. A documented pattern of deception—from adware distribution (Crossrider) to astroturfed marketing (Webselenese)—remains the consistent modus operandi under the same ownership (Sagi) and leadership (Erlichman).

Core Sensitivity:

  • The company’s leadership and technical core are systematically drawn from and ideologically aligned with the Israeli military and intelligence apparatus (Unit 8200, Duvdevan Unit), creating an intolerable and systemic counter-intelligence risk for any user genuinely seeking privacy from state-level actors.

3. Timeline of Relevant Events

Date Event Significance
1996 Teddy Sagi is convicted in Israel of “grave deceit, bribery, and insider trading” (bond manipulation). Establishes the criminal background of Kape’s future sole owner.20
2011 Crossrider Advanced Technologies is founded by Koby Menachemi (E003), a veteran of IDF Unit 8200. Implicates the company’s origin and technical foundation with Israel’s state surveillance apparatus.3
Dec 2012 Israeli billionaire Teddy Sagi (E001) acquires a 73% stake in Crossrider for $37 million. Establishes Sagi’s controlling ownership and the company’s full integration into his portfolio.11
2014 Crossrider lists on the London Stock Exchange’s AIM market. The company uses a UK financial domicile to access international capital.11
2016 Ido Erlichman (E002), a veteran of the IDF Duvdevan special forces unit, is appointed CEO. Cements the leadership’s ideological and professional alignment with elite Israeli military units.4
2016 Crossrider begins to shut down its ad-tech platform following years of being classified as adware. Marks the failure of the adware model and the need to pivot to escape the toxic reputation.9
2017 Kape (then Crossrider) acquires its first VPN, CyberGhost. The company pivots from creating privacy-violating software to acquiring privacy-protecting brands.22
Mar 2018 Crossrider plc officially rebrands as Kape Technologies plc. A purely cosmetic change to hide the company’s history as an adware distributor.10
Nov 2019 Kape acquires Private Internet Access (PIA). Kape consolidates its control over the VPN market, acquiring a major US-based provider.11
Mar 2021 Kape acquires Tel Aviv-based Webselenese (E005) for $149.1 million. Kape acquires major VPN “review” sites (vpnMentor, Wizcase), creating a systemic conflict of interest.28
Sep 2021 Kape acquires ExpressVPN for $936 million. Kape becomes a dominant force in the VPN market, rolling up a top-tier competitor.22
Sep 2021 News breaks that ExpressVPN’s CIO, Daniel Gericke (E009), was fined by the US DOJ for his role in Project Raven. Reveals a culture at ExpressVPN, just prior to acquisition, that condoned hiring ex-state intelligence operatives who built surveillance tools.17
2023 Teddy Sagi, via Unikmind Holdings (E004), acquires all remaining Kape shares, delisting the company. Kape is taken 100% private, solidifying Sagi’s total control and eliminating all public/shareholder oversight.1

4. Financial & Ownership Exposure

Investors / Shareholders:

Kape Technologies plc is not a publicly-traded company and has no independent investors. It is a 100% owned, private subsidiary.

  • Unikmind Holdings Limited (E004): This Isle of Man-registered entity is the 100% shareholder of Kape Technologies plc.32
  • Teddy Sagi (E001): Unikmind Holdings is the personal investment vehicle for Teddy Sagi.1 Therefore, Sagi is the sole beneficial owner of Kape and all its assets, including ExpressVPN, PIA, and CyberGhost. Sagi is an Israeli citizen and resident of Tel Aviv.2

Contracts / Trade:

The company’s primary financial activity is not conventional trade but a “roll-up” acquisition strategy, consolidating the global consumer privacy market under its (and Sagi’s) control. The primary “trade” link to Israel is the acquisition of Israeli companies (like Webselenese) and the employment of its core R&D staff in Tel Aviv.12

Joint Ventures / R&D:

Kape’s R&D operations are centered in its Tel Aviv office.11 This situates its core intellectual property development within the Israeli tech ecosystem, which is structurally and culturally linked to the IDF and its intelligence units (e.g., Unit 8200).

Political / Philanthropic Donations:

No public information was available in the provided research material regarding Sagi’s or Kape’s direct philanthropic or political donations to specific Zionist causes or institutions. However, Sagi’s status as one of Israel’s wealthiest billionaires 2 and his residency in Tel Aviv 2 establish him as a key figure in the Israeli economy. His economic interests are inherently aligned with the stability and policies of the Israeli state.

Funding Table (Major Acquisitions & Buyout):

Entity / Source Instrument Amount Date Notes
Teddy Sagi Acquisition (Equity) $37 Million 2012 Sagi acquires 73% of Crossrider.11
Webselenese Acquisition (Cash & Shares) $149.1 Million Mar 2021 Acquisition of Tel Aviv-based “review” sites.28
ExpressVPN Acquisition (Cash & Shares) $936 Million Sep 2021 Acquisition of ExpressVPN.22
Unikmind Holdings (Sagi) Privatization (Buyout) ~$1.5 Billion (valuation) 2023 Sagi buys all remaining public shares to take Kape 100% private.1

Assessment:

Kape’s financial structure demonstrates an active and strategic economic alignment with Israel. This is not passive investment. The company is the private asset of an Israeli billionaire who, by centralizing ownership, has aligned the company’s fate with his personal interests. He has demonstrated a clear preference for:

  1. Israeli Leadership: Appointing an IDF special forces veteran as CEO (Erlichman, E002).
  2. Israeli Operations: Centering R&D in Tel Aviv.12
  3. Israeli Acquisitions: Purchasing Israeli companies (Webselenese, E005).

This structure constitutes a direct, strategic, and intentional economic tie.

5. Domains of Complicity

Domain 1: CEO & Leadership Ideological Support (V-POL Evidence)

Goal: To establish that Kape’s CEO, Ido Erlichman (E002), is not merely a veteran of the IDF but an active proponent of its ideology, applying military doctrine directly to his corporate leadership.

Evidence & Analysis:

The link between Kape’s leadership and the Israeli military is not a “guilt by association” based on mandatory service. It is a documented, strategic, and ideological choice.

  1. The CEO’s Background: Ido Erlichman (E002) is not a mere conscript. He was an officer in an elite IDF Special Forces Unit.5 Sources identify this unit as the Duvdevan Unit (Unit 217).4 The role of this unit is not conventional defense; it is an elite commando unit specializing in undercover operations, with some sources explicitly noting its role in “intelligence operations and assassinations against the local Arab population”.4
  2. The Ideological Confession: Erlichman authored a book titled ‘Battle of Strategies’.33 His own professional biographies explicitly state the book is a “story on leadership and how to build successful and winning team based on true accounts from his experience as officer in the Special Forces Unit of the IDF“.5
  3. The Inference: This is the critical finding. Erlichman is not a man who left the military behind; he is a CEO who actively markets his corporate and leadership philosophy as a direct, battle-tested product of his elite IDF service. He is, by his own admission, applying the doctrines of an Israeli special forces unit to the management of a global “privacy” company. This is an unambiguous, active, and ongoing ideological alignment. The philosophy that governs ExpressVPN’s parent company is sourced directly from the Israeli military’s most elite and aggressive units.

Counter-Arguments & Assessment:

  • Counter-Argument: As noted in public forums, Israel has mandatory military service, and many tech workers have served in units like 8200. It is “not very helpful” to tag all of them as state assets.3
  • Assessment of Counter-Argument: This argument fails entirely in this context.
    • A. Specificity: Erlichman was not a typical conscript or a low-level analyst “listening to telephone calls”.3 He was an officer in one of the IDF’s most elite special forces units (Duvdevan), a unit specializing in offensive, undercover operations.
    • B. Intentionality: The link is not an incidental fact (like mandatory service) but a celebrated ideological choice. Erlichman’s book proves he intentionally and publicly models his leadership on his IDF experience. This is not “association”; it is “causation.”

Analytical Assessment:

The ideological alignment of Kape’s CEO with the Israeli military is demonstrable and explicit. Ido Erlichman’s public statements and writings confirm that his leadership of Kape is guided by doctrines he developed as an officer in an elite IDF special forces unit. This is a profound and direct political and ideological tie.

  • Confidence: HIGH
  • Named Entities / Evidence Map: E002 (Ido Erlichman); E008 (Duvdevan Unit);.4
  • Intelligence Gaps:
    • Full contents and specific doctrines outlined in Erlichman’s ‘Battle of Strategies’.
    • Erlichman’s specific rank and years of service in the Duvdevan Unit.
    • Any public statements by Erlichman specifically concerning the occupation of Palestine.

Domain 2: Structural Integration with Israeli Military-Tech Ecosystem (V-MIL / V-ECON Evidence)

Goal: To establish that Kape’s corporate structure, personnel strategy, and operational geography constitute a pattern of deliberate integration with the Israeli military-technology ecosystem, making it structurally inseparable from it.

Evidence & Analysis:

The “Erlichman-as-CEO” case (Domain 1) is not an isolated incident. It is the capstone of a corporate structure built from the Israeli military-tech pipeline.

  1. The Leadership Pipeline: The pattern is irrefutable.
    • Founder/CEO: Koby Menachemi (E003) was a developer for Unit 8200.3
    • Successor CEO: Ido Erlichman (E002) was an officer in the Duvdevan Unit.4
    • Key Staff: Liron Peer, Kape’s Head of Accounting, served for three years in Unit 8200.4
  2. The “London/Tel Aviv” Axis: This dual-location model is a strategic choice. The London HQ 25 provides Kape access to Western capital markets (like its 2014 AIM IPO) 11 and a veneer of EU/UK regulatory compliance. However, the Tel Aviv R&D center 10 functions as the company’s technical core. This structure allows an Israeli-controlled and Israeli-staffed company to operate globally under a British flag.
  3. The Economic Ecosystem: Kape operates as an Israeli company. It is owned by an Israeli billionaire (E001).2 It publicly identifies as an “Israeli founded company” in Israeli media.13 It acquires Israeli tech companies, such as Tel Aviv-based Webselenese (E005).28 It uses Israeli PR firms to manage its image.30

Counter-Arguments & Assessment:

  • Counter-Argument: Kape is a global company. It has over 1,400 people across ten locations worldwide.34 It is headquartered in London. It is logical to have an R&D center in Tel Aviv, a global “tech hub.”
  • Assessment of Counter-Argument: This argument confuses scale with character. While Kape is globally distributed, its center of gravity—its ownership (Sagi), its command-and-control (Erlichman), and its technical origins (Menachemi)—is exclusively Israeli. The decision to found the company with a Unit 8200 veteran, replace him with a Duvdevan special forces veteran, and hire other Unit 8200 veterans for key roles is a pattern. It demonstrates a deliberate cultural choice to build the company from the human-capital pipeline of the Israeli national security state.

Analytical Assessment:

Kape Technologies is, for all intents and purposes, an Israeli company. Its leadership, technical origins, and operational core are deeply integrated with the Israeli military-tech ecosystem. The company’s structure is a pipeline for talent and ideology flowing directly from Israeli intelligence and special forces units into a corporation that now controls a significant portion of the world’s consumer “privacy” infrastructure.

  • Confidence: HIGH
  • Named Entities / Evidence Map: E001 (Sagi); E002 (Erlichman); E003 (Menachemi); E005 (Webselenese); E007 (Unit 8200); E008 (Duvdevan Unit);.3
  • Intelligence Gaps:
    • A full manifest of Kape’s Tel Aviv-based R&D team and their IDF service records.
    • Any known R&D partnerships or contracts with other Israeli firms or state entities.
    • Internal Kape documents detailing the strategic rationale for the Tel Aviv R&D center.

Domain 3: Systemic Deception and Market Manipulation (V-ECON Evidence)

Goal: To establish that Kape’s corporate character is defined by a modus operandi of systemic deception, rendering its “privacy-first” claims non-credible and demonstrating a risk to users.

Evidence & Analysis:

This domain prosecutes the company’s behavior. The evidence shows a consistent pattern of deceiving users for profit, a pattern that stretches from its origin to the present day.

  1. Phase 1: Deception via Product (2011-2017):
    • As Crossrider (E010), the company’s platform was used to create and distribute adware, Potentially Unwanted Programs (PUPs), and browser hijackers.7
    • Malwarebytes, for example, detailed how Crossrider variants would infect Macs via fake Flash installers and install malicious “configuration profiles” to hijack Safari and Chrome, forcing them to a search domain against the user’s will.8
    • This was the company’s core business model, acting as a “distributor” in a vast ad-injection ecosystem.19
  2. Phase 2: Deception via Identity (2018):
    • By 2018, the Crossrider brand was toxic and its ad-tech model was failing. CEO Ido Erlichman (E002) led a pivot.10
    • The company was rebranded to “Kape Technologies”.21 This was not a change in ownership (Sagi still owned it) or leadership (Erlichman still ran it). It was a purely cosmetic act to “complete the company’s pivot from ad-tech to cybersecurity” 10 and escape its reputation.
  3. Phase 3: Deception via Marketing (2021-Present):
    • Kape began acquiring trusted VPN brands (PIA, ExpressVPN).22
    • In March 2021, Kape acquired Webselenese (E005), the Israeli parent of “independent” review sites vpnMentor.com (E006) and Wizcase.com.9
    • The conflict of interest is immediate and absolute. These “review” sites, which receive ~6.1 million monthly visitors, now function as a captured marketing channel.9
    • Investigators noted that immediately after the acquisition, the rankings on vpnMentor and Wizcase changed to place Kape’s three VPNs (CyberGhost, PIA, ExpressVPN) in the top 3 spots.9

Counter-Arguments & Assessment:

  • Counter-Argument: Kape states it “completely shut down the program in 2016” 9 and “changed out the company’s leadership” to pivot to privacy. The company and its subsidiaries (like CyberGhost) now operate independently and are committed to privacy.36
  • Assessment of Counter-Argument: This argument is false.
    • A. Leadership Did Not Change: Ido Erlichman oversaw the final years of the ad-tech business and led the pivot.10 The ownership (Sagi) remained constant.
    • B. The Behavior Did Not Change: The modus operandi (deception for profit) remained identical. Kape simply transitioned from product-based deception (adware) to marketing-based deception (captured review sites). The acquisition of Webselenese is not a separate issue; it is the direct continuation of the Crossrider business philosophy.

Analytical Assessment:

Kape’s “privacy-first” branding is a calculated marketing strategy built on a foundation of systemic deception. The same entity (Sagi/Erlichman) that profited from user-exploitative adware (Crossrider) now profits from user-deceptive marketing (Webselenese). This documented history of bad faith demonstrates that Kape’s claims of user trust (e.g., “no-logs” policies) are unreliable, as the company’s core character is fundamentally opportunistic and anti-consumer.

  • Confidence: HIGH
  • Named Entities / Evidence Map: E001 (Sagi); E002 (Erlichman); E005 (Webselenese); E006 (vpnMentor); E010 (Crossrider);.7
  • Intelligence Gaps:
    • Internal editorial policies provided by Kape to vpnMentor and Wizcase post-acquisition.
    • Revenue/referral data showing the financial benefit of ranking Kape-owned VPNs in top positions.
    • Public-facing statements from Erlichman or Sagi justifying the Webselenese acquisition.

6. Network of Influence

Purpose: To expose the ecosystem of individuals, corporate entities, and state units that connect Kape Technologies to the Israeli state and its military-industrial complex.

Entity Table:

Name Type Role / Link
Teddy Sagi Person Sole Owner of Kape (via Unikmind); Israeli billionaire, Tel Aviv resident.
Ido Erlichman Person CEO of Kape Technologies; Veteran officer of Duvdevan Unit.
Koby Menachemi Person Co-founder & fmr. CEO of Crossrider; Veteran of Unit 8200.
Unikmind Holdings Ltd Entity Isle of Man holding company; 100% owned by Sagi; 100% owner of Kape.
Webselenese Entity Acquired Tel Aviv company; Parent of vpnMentor and Wizcase.
vpnMentor.com Entity Captured “review” site; Acquired by Kape; Used for marketing.
Unit 8200 (IDF) Entity (State) Israeli signals intelligence unit; Source of Kape’s founder (E003) & staff.
Duvdevan Unit (Unit 217) Entity (State) IDF elite special forces unit; Source of Kape’s CEO (E002).
Daniel Gericke Person CIO of ExpressVPN; Fined by US DOJ for role in UAE’s “Project Raven”.
Crossrider Entity Kape’s original name; Notorious adware/malware platform.
ExpressVPN Entity Acquired asset; Top-tier VPN provider now 100% owned by Kape.

Profiles of Key Actors:

  • E001 – Teddy Sagi: The sole, private owner of the entire Kape/ExpressVPN ecosystem. As an Israeli citizen and Tel Aviv resident with a vast fortune, Sagi’s economic interests are inextricably linked to the Israeli state. His criminal conviction for market manipulation 20 and his use of opaque holding companies (Unikmind1) demonstrate a preference for secrecy and a history of financial malfeasance. His 100% control makes Kape a personal instrument.
  • E002 – Ido Erlichman: The operational and ideological leader of Kape. Erlichman’s background as an officer in the Duvdevan Unit (E008) 4, an elite commando unit, is not a historical footnote. By his own admission, his IDF service forms the basis of his corporate strategy.5 He represents the active ideological bridge between the Israeli military and the “privacy” services Kape sells.
  • E003 / E007 – Koby Menachemi & Unit 8200: The origin of the company. Menachemi’s (E003) role as a founder from Unit 8200 (E007) 4 is significant. Unit 8200 is the primary engine of the Israeli surveillance state and the source of many of its most controversial tech exports (e.g., NSO Group). This establishes that the company’s DNA (Crossrider) was sourced directly from the state’s data-collection apparatus.
  • E009 – Daniel Gericke: The ExpressVPN CIO embodies the culture of impunity Kape acquired. His work for Project Raven—building surveillance tools for the UAE 17—shows he is a “poacher-turned-gamekeeper.” ExpressVPN’s decision to hire and defend him, and Kape’s subsequent acquisition, confirms a shared corporate culture that sees state-level surveillance operatives as desirable assets, not liabilities.

7. Sources & Verification Methodology

Methods:

Intelligence collection for this dossier relied exclusively on Open Source Intelligence (OSINT). Methods included:

  • Corporate & Financial Analysis: Review of Kape’s public filings, annual reports 32, and buyout announcements 1 to establish ownership and financial structure.
  • Media & Archive Analysis: Triangulation of reports from technology journals (ZDNet, CNET, Hackread) 16, Israeli financial press (Globes, Calcalist, Times of Israel) 1, and public forums 3 to trace corporate history and public criticism.
  • Personnel Vetting: Cross-referencing of executive biographies 5, corporate websites, and investigative reports 4 to document the military and professional histories of key leaders.
  • Technical Analysis: Review of security firm (Malwarebytes, Kaspersky) reports on Crossrider’s adware functionality.7

Verification:

Evidence was corroborated by seeking multiple, independent sources for key claims. For example, the military backgrounds of Erlichman and Menachemi are not based on a single source but are reported across multiple, unaffiliated investigative reports.3 The history of Crossrider is similarly documented by both security firms and Kape’s own admissions during its rebrand.8

Analytical Rationale:

This report adheres to the user’s high standard of proof. Inferences are drawn not from “guilt by association” but by establishing patterns of deliberate choice.

  • The analysis of military ties (Domains 1 & 2) meets this standard by demonstrating a pattern of leadership selection (Founder, CEO, key staff) from elite military/intelligence units, and by citing the CEO’s own public statements (his book) as proof of active ideological alignment.
  • The analysis of Kape’s business practices (Domain 3) establishes a pattern of deceptive behavior, connecting the Crossrider adware model directly to the Webselenese conflict-of-interest model.
  • The assessment of “complicity” is therefore based on documented, strategic, and intentional actions by the company’s sole owner (Sagi) and CEO (Erlichman).

Works cited

  1. Teddy Sagi increases Kape stake to 87.6% – Globes English – גלובס, accessed November 11, 2025, https://en.globes.co.il/en/article-teddy-sagi-increases-kape-stake-to-876-1001445820
  2. Teddy Sagi – Forbes, accessed November 11, 2025, https://www.forbes.com/profile/teddy-sagi/
  3. “Kape Technologies was originally found under the name of …, accessed November 11, 2025, https://news.ycombinator.com/item?id=28554528
  4. Exposed: How Israeli spies control your VPN | MR Online, accessed November 11, 2025, https://mronline.org/2024/09/13/exposed-how-israeli-spies-control-your-vpn/
  5. Our History, Story & Team | About Us – Specops Software, accessed November 11, 2025, https://specopssoft.com/about/
  6. Company & Management Team – Outpost24, accessed November 11, 2025, https://outpost24.com/company/
  7. PUA:Win32/CrossRider threat description – Microsoft Security Intelligence, accessed November 11, 2025, https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/CrossRider&threatId=213930
  8. New Crossrider variant installs configuration profiles on Macs …, accessed November 11, 2025, https://www.malwarebytes.com/blog/news/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs
  9. Kape Technologies (Formerly Crossrider) Now Owns ExpressVPN …, accessed November 11, 2025, https://cyberinsider.com/kape-technologies-owns-expressvpn-cyberghost-pia-zenmate-vpn-review-sites/
  10. Capping Pivot to Cybersecurity, Crossrider Rebrands as KAPE | Ctech, accessed November 11, 2025, https://www.calcalistech.com/ctech/articles/0,7340,L-3733634,00.html
  11. CEO of Internet Privacy Company Kape Sets His Sights on a $1 Billion Market Cap | Ctech, accessed November 11, 2025, https://www.calcalistech.com/ctech/articles/0,7340,L-3777794,00.html
  12. C++ Software Engineer in Tel Aviv – Kape Technologies, accessed November 11, 2025, https://www.kape.com/position/c-developer-in-tel-aviv-2/
  13. Ido Erlichman, CEO of Kape Technologies – YouTube, accessed November 11, 2025, https://www.youtube.com/watch?v=BEnJlYtYkiE
  14. Koby Menachemi investment portfolio | PitchBook, accessed November 11, 2025, https://pitchbook.com/profiles/investor/107442-01
  15. Crossrider CEO: Teddy Sagi’s vision fits our plans – Globes English, accessed November 11, 2025, https://en.globes.co.il/en/article-crossrider-ceo-sagis-vision-fit-ours-1000977376
  16. Israeli firm Kape Technologies buys ExpressVPN raising privacy concerns – Hackread, accessed November 11, 2025, https://hackread.com/israeli-firm-kape-technologies-expressvpn-privacy/
  17. Trust, but verify: An in-depth analysis of ExpressVPN’s terrible …, accessed November 11, 2025, https://www.zdnet.com/article/trust-but-verify-an-in-depth-analysis-of-expressvpns-terrible-horrible-no-good-very-bad-week/
  18. Kaspersky Threats — AdWare.Script.Crossrider.gen, accessed November 11, 2025, https://threats.kaspersky.com/en/threat/AdWare.Script.Crossrider.gen/
  19. What is Kape Technologies? The Mysterious Company That’s …, accessed November 11, 2025, https://windscribe.com/blog/what-is-kape-technologies/
  20. How Teddy Sagi Built Playtech & Became A Powerful Billionaire, accessed November 11, 2025, https://www.casino.org/blog/teddy-sagi-playtech/
  21. Crossrider renamed Kape after switching to cybersecurity – Globes English, accessed November 11, 2025, https://en.globes.co.il/en/article-crossrider-renamed-kape-after-switching-to-cybersecurity-1001227178
  22. Teddy Sagi – Wikipedia, accessed November 11, 2025, https://en.wikipedia.org/wiki/Teddy_Sagi
  23. Israeli cybersecurity firm buys ExpressVPN for close to $1b | The Times of Israel, accessed November 11, 2025, https://www.timesofisrael.com/israeli-cybersecurity-firm-buys-expressvpn-for-close-to-1b/
  24. Kape Technologies set for £1.25bn Unikmind takeover – Tech Monitor, accessed November 11, 2025, https://techmonitor.ai/technology/software/kape-technologies-unikmind-digital-privacy
  25. Our leadership team – Kape Technologies, accessed November 11, 2025, https://www.kape.com/our-leadership-team/
  26. Kape Technologies, accessed November 11, 2025, https://www.kape.com/
  27. Intego announced its acquisition by Kape Technologies, accessed November 11, 2025, https://www.intego.com/press-release/intego-announced-its-acquisition-kape-technologies
  28. Webselenese acquired by Kape Technologies – Business Wire, accessed November 11, 2025, https://www.businesswire.com/news/home/20210308005178/en/Webselenese-acquired-by-Kape-Technologies
  29. Kape Technologies 2025 Company Profile: Valuation, Investors, Acquisition | PitchBook, accessed November 11, 2025, https://pitchbook.com/profiles/company/54720-28
  30. OH! Orenstein Hoshen is expanding, accessed November 11, 2025, https://www.ohpr.co.il/post/oh-orenstein-hoshen-is-expanding
  31. Billionaire Teddy Sagi eyeing $1.5 billion buyout of cyber company Kape | Ctech, accessed November 11, 2025, https://www.calcalistech.com/ctechnews/article/bj6ufbuas
  32. Kape Technologies – AnnualReports.com, accessed November 11, 2025, https://www.annualreports.com/Company/kape-technologies
  33. Ido Erlichman – CEO at Kape – The Org, accessed November 11, 2025, https://theorg.com/org/kape/org-chart/ido-erlichman
  34. Kape Technologies PLC 21 March 2023, accessed November 11, 2025, https://pdf.dfcfw.com/pdf/H22_AN202303211584441241_1.pdf
  35. Former Malware Distributor Kape Technologies Now Owns … – Reddit, accessed November 11, 2025, https://www.reddit.com/r/privacy/comments/q3lepv/former_malware_distributor_kape_technologies_now/
  36. What is Kape Technologies? What you need to know about the parent company of CyberGhost VPN – CNET, accessed November 11, 2025, https://www.cnet.com/tech/services-and-software/what-is-kape-technologies-what-you-need-to-know-about-the-parent-company-of-cyberghost-vpn/
  37. EXPANDING – Annual Reports, accessed November 11, 2025, https://www.annualreports.com/HostedData/AnnualReportArchive/k/LSE_KAPE.L_2019.pdf
  38. LEADING IN DIGITAL PRIVACY AND SECURITY FOR CONSUMERS – AnnualReports.com, accessed November 11, 2025, https://www.annualreports.com/HostedData/AnnualReportArchive/k/LSE_KAPE_2020.pdf
  39. Privacy Is Our Priority – Annual Reports, accessed November 11, 2025, https://www.annualreports.com/HostedData/AnnualReports/PDF/LSE_KAPE_2021.pdf
  40. PSA: PIA is owned by an Israeli company – Kape Technologies : r/PrivateInternetAccess, accessed November 11, 2025, https://www.reddit.com/r/PrivateInternetAccess/comments/1nts98i/psa_pia_is_owned_by_an_israeli_company_kape/
  41. Should we be concerned over Kape Technologies buying out Express VPN – Reddit, accessed November 11, 2025, https://www.reddit.com/r/Express_VPN/comments/po1mq3/should_we_be_concerned_over_kape_technologies/
  42. Former Malware Distributor Kape Technologies Now Owns ExpressVPN, CyberGhost, Private Internet Access, Zenmate, and a Collection of VPN “Review” Websites : r/Express_VPN – Reddit, accessed November 11, 2025, https://www.reddit.com/r/Express_VPN/comments/pp6lwf/former_malware_distributor_kape_technologies_now/
  43. Our Merger with Kape Technologies – Addressing Your Concerns : r/PrivateInternetAccess, accessed November 11, 2025, https://www.reddit.com/r/PrivateInternetAccess/comments/dz2w53/our_merger_with_kape_technologies_addressing_your/
Leave a Reply

Your email address will not be published. Required fields are marked *

Related News & Articles