BDS-1000 Dossier: CyberArk Software Ltd.

Corpus: BDS-1000 | Document: 06-main-dossier.md | Status: Final, human-vetted V4 score

Key Findings

• Economic: CyberArk is an Israeli-founded, Israeli-incorporated cybersecurity firm whose $25 billion acquisition by Palo Alto Networks (closed 11 February 2026) is estimated to have generated close to $2 billion in one-time capital-gains tax revenue for the Israeli treasury, on top of the company’s use of Israel’s “Preferred Technology Enterprise” reduced corporate tax regime.¹²
• Political: CyberArk’s founders and senior executives carry direct IDF Military Intelligence pedigree - co-founder Udi Mokady (Unit 8200) and co-founder Alon Cohen (Mamram) - and its Beersheba R&D center sits inside the government-sponsored CyberSpark ecosystem adjacent to IDF C4I facilities; CIO Omer Grossman joined in 2022 after more than 25 years of IDF service, including as Head of the IDF Cyber Defense Operations Center.³⁴⁵
• Military (consortium exposure): CyberArk is a confirmed member of the Israel Aerospace Industries-led Israeli Cyber Companies Consortium (IC3), which has delivered state-level cyber-export contracts abroad, though CyberArk’s own technical contribution to those specific contracts is not established beyond consortium membership.⁶⁷⁸
• Not found: No public evidence identified of any direct contract, tender, or procurement relationship between CyberArk and the Israeli Ministry of Defence, IDF, or Israeli security services; the company’s confirmed military-grade product certifications (Certificate of Networthiness, DoDIN APL, FedRAMP High, NIAP EAL2+) are exclusively United States, not Israeli, credentials.⁹

Target Profile

Key Facts:

• Founded 1999 in Israel by Udi Mokady and Alon Cohen¹²
• ~1,000 of CyberArk’s ~4,000 pre-acquisition employees were based in Israel; roughly 700 employees (10% of the post-merger global workforce) were notified of layoffs following the Palo Alto Networks acquisition¹⁷
• Beersheba R&D center opened May 2021 in the Gav-Yam Negev Tech Park, part of the government-sponsored CyberSpark national cyber ecosystem, expanded in 2021–2022⁵¹⁸¹⁹
• Acquired by Palo Alto Networks for ~$25 billion; deal closed 11 February 2026¹⁰

Executive Summary

CyberArk Software Ltd. is an Israeli-founded and Israeli-incorporated enterprise cybersecurity vendor, specializing in Privileged Access Management and Identity Security software, that operated as an independent NASDAQ-listed company from its 2014 IPO until its acquisition by Palo Alto Networks closed on 11 February 2026.¹⁰¹² The four domain audits underlying this dossier find that CyberArk’s Israel/Palestine nexus is overwhelmingly structural and economic rather than operational or military: the company was founded and has always been substantially headquartered in Israel, its founders and several senior executives carry IDF Military Intelligence backgrounds, and it is embedded in Israeli state-sponsored innovation and cyber-export infrastructure - but no audit identified a direct commercial relationship between CyberArk and the Israeli Ministry of Defence, the IDF, or Israeli security services.

The strongest documented vectors are economic and political. Economically, CyberArk’s $25 billion acquisition by Palo Alto Networks is reported to have generated close to $2 billion in one-time capital-gains tax revenue for the Israeli treasury, and the company benefited for years from Israel’s “Preferred Technology Enterprise” tax regime (6–12% corporate tax rates) on its Israeli-sourced IP income.¹² Politically, CyberArk’s founders (Udi Mokady, Unit 8200; Alon Cohen, Mamram) and its Global CIO/Chief Trust Officer Omer Grossman (25+ years of IDF service, including heading the IDF’s Cyber Defense Operations Center) represent a direct, named, and repeatedly cited IDF-to-boardroom pipeline; its Beersheba R&D facility sits inside the government-run CyberSpark ecosystem physically adjacent to the IDF’s C4I technology park.³⁴⁵ CEO Matt Cohen’s 13 October 2023 public statement affirming solidarity with Israel and confirming reservist mobilization among staff further anchors the company publicly to the Israeli side of the conflict, with no comparable statement addressing Palestinian civilian harm identified in any audit.²⁰

CyberArk’s military-domain exposure is comparatively marginal and consists mainly of the company’s confirmed membership in the IAI-led Israeli Cyber Companies Consortium (IC3), a state-sponsored export vehicle that has won foreign government contracts (e.g., a “tens of millions of dollars” 2017 national cyber center contract in Brazil); CyberArk’s own technical contribution to that specific contract, however, could not be established beyond consortium membership.⁶⁷⁸ No audit found any direct CyberArk contract, tender, or procurement relationship with the IMOD, IDF, Israel Prison Service, or Israel Border Police, and CyberArk’s own confirmed military-grade certifications - a US Army Certificate of Networthiness, DoDIN APL listing, FedRAMP High authorization, and NIAP Common Criteria EAL2+ validation - relate exclusively to US, not Israeli, military and federal procurement.⁹ A secondary-source claim that Israeli reseller Matrix IT distributes CyberArk products to the IMOD, IDF, Air Force, Navy, and Military Intelligence was checked against Matrix IT’s primary Who Profits company profile, which lists Matrix IT’s own vendor partners without naming CyberArk anywhere; this reseller claim is accordingly unverified and is carried in this dossier only with that caveat.²¹²² No audit found CyberArk named in the OHCHR database of business enterprises linked to Israeli settlement activity, in UN Special Rapporteur Francesca Albanese’s 2025 “economy of genocide” report, or on the Who Profits company-profile database in its own right.²³

Digitally, CyberArk supplies no surveillance, biometric, predictive-policing, or offensive cyber capability of any kind; its two Israeli facilities (Petah Tikva headquarters, Beersheba R&D center) are documented as engineering sites, not hosting or surveillance infrastructure, and no evidence was found of CyberArk participation in Project Nimbus or any comparable state cloud program.²⁴ CyberArk’s own public statement, issued in response to UK boycott campaigns, asserts the company “has no direct interest in or corporate association with the IDF” and that its products “are categorically not tools which can be used for war.”²⁴

Weighing the vetted domain scores - Military 0.12, Digital 0.73, Economic 9.20, Political 5.74 - against the evidentiary record, the resulting composite BRS of 657 (Tier B, Severe) reflects a company whose Israel nexus is real, documented, and economically and politically significant, but whose military and digital-surveillance exposure the evidence does not support beyond consortium membership and unverified secondary claims.

Timeline of Relevant Events

Corporate Overview

CyberArk Software Ltd. was, prior to acquisition, an independent Israeli-incorporated, NASDAQ-listed public company operating a dual-headquarters structure common among Israeli technology firms listed on US exchanges: legal domicile and primary R&D base in Petah Tikva, Israel, alongside a US operational and SEC-correspondence address in Newton, Massachusetts.¹²¹³ Its two confirmed Israeli facilities are the Petah Tikva headquarters (historically home to roughly 1,200 of the company’s 4,000+ global employees) and the Beersheba R&D center opened in May 2021 within the Gav-Yam Negev Tech Park, part of the government-initiated CyberSpark national cyber ecosystem and located near the IDF’s C4I technology park and Ben-Gurion University.¹⁸¹⁹⁵ No CyberArk offices, R&D facilities, or subsidiary activity in the West Bank, East Jerusalem, Golan Heights, or Gaza were identified in any audit.²⁴

CyberArk’s most significant acquisitions prior to its own sale - Viewfinity (2015) and Idaptive (2020) - were both US-headquartered companies, not Israeli firms.¹² CyberArk Ventures, a $30 million corporate venture fund, has invested in cybersecurity startups Dig Security, Enso Security and Zero Networks; no Israeli surveillance, SIGINT, or military-technology firm was identified among its portfolio companies. CyberArk maintains formal technology-alliance partnerships with fellow Israeli-founded vendors Wiz (announced November 2024) and SentinelOne (announced February 2025), both product-integration go-to-market arrangements rather than internal-infrastructure procurement.²⁹³¹

A secondary-source dossier (OpenIntel.uk) asserts that Matrix IT is a “confirmed CyberArk reseller” serving the Israeli Ministry of Defense, IDF, Air Force, Navy and Military Intelligence.²¹ This claim was checked against the primary Who Profits company profile for Matrix IT, which documents that company’s own defense-sector activity and vendor partners (AWS, IBM, Microsoft, Dell, HP, Cisco, Oracle, Lenovo, Check Point) but does not mention CyberArk anywhere.²² This reseller relationship is therefore unverified and should not be treated as an established fact.

Following the 30 July 2025 announcement and 11 February 2026 close of Palo Alto Networks’ approximately $25 billion acquisition, CyberArk became a wholly-owned subsidiary of Palo Alto Networks, with Athens Strategies Ltd. - an Israeli wholly-owned Palo Alto Networks subsidiary - serving as the merger vehicle.¹⁰¹¹ Palo Alto Networks’ own press materials describe the deal as reinforcing the company’s Israeli R&D center, already its largest outside Silicon Valley, and note plans for a secondary Tel Aviv Stock Exchange listing under ticker “CYBR.”¹⁰ Palo Alto Networks founder Nir Zuk is also a Unit 8200 alumnus, and post-acquisition CEO Nikesh Arora stated the firm remains “committed to investing in Israel,” citing plans to double the Israel-based workforce.³

Domain Summaries

Military: Military

Mechanism of Involvement

CyberArk’s military-domain nexus is indirect and consortium-based rather than contractual. CyberArk is a confirmed member of the Israeli Cyber Companies Consortium (IC3), established under Israel’s Ministry of Economy and led by state-owned defense prime Israel Aerospace Industries (IAI); other confirmed members include Check Point, Cognyte, XM Cyber, Mellanox, ClearSky and Bynet.⁶²⁵ IC3 won a “tens of millions of dollars” contract, announced 27 March 2017, to build a national cyber center in Brazil, with IAI as prime contractor; the primary-source announcement of that contract assigns specific named technical delivery roles to Verint, Check Point, ClearSky and CyberX rather than to CyberArk by name, though CyberArk is listed as a consortium member.⁷⁸ CyberArk is separately documented as a member of an aviation-cybersecurity consortium backed by Israel’s Ministry of Defense, Ministry of Economy, National Cyber Directorate and Israel Export Institute, alongside IAI, Check Point, Karamba Security and El Al’s venture arm.³²³³

CyberArk’s founders and select executives carry IDF technical/intelligence backgrounds: co-founder Udi Mokady served in Unit 8200 before co-founding the company in 1999, and co-founder Alon Cohen served six years in Mamram (the IDF’s central computing unit) before departing CyberArk in December 2011.³¹² Global CIO/Chief Trust Officer Omer Grossman, appointed December 2022, brought over 25 years of IDF service, most recently as Head of the IDF Cyber Defense Operations Center and previously as Head of Mamram.⁴ CEO Matt Cohen confirmed in an October 2023 blog post that “a small percentage” of CyberArk’s team had been called to military reserve duty following the 7 October Hamas attack.²⁰

On US military procurement, CyberArk’s Privileged Account Security Solution was awarded a US Army Certificate of Networthiness in September 2016 and made available through the US Army ITES-SW contract in 2017; CyberArk PAM Self-Hosted is separately listed on the DoDIN Approved Products List, and CyberArk Endpoint Privilege Manager and Workforce Identity hold FedRAMP High authorization, alongside a 2015 NIAP Common Criteria EAL2+ certification.⁹ These are exclusively United States military and federal government certifications.

Counter-Arguments and Evidence Limits

No audit identified any contract, tender, framework agreement, or memorandum of understanding between CyberArk and the Israeli Ministry of Defence, IDF, Israel Prison Service, or Israel Border Police; the SIBAT Defence and HLS Directory could not be searched for a CyberArk listing because its contents were inaccessible during research, so this cannot be confirmed either way.⁹ CyberArk’s specific technical contribution to the IC3 Brazil contract, and to IC3 activity generally, cannot be established beyond consortium membership; a secondary-source assertion of a CyberArk PAM-delivery role in that contract originates from a dossier (openintel.uk) that returned an HTTP 404 error and could not be verified.²¹ No verified bilateral supply relationship was found between CyberArk and Elbit Systems, Rafael Advanced Defense Systems, or IAI outside the IC3 consortium context. CyberArk manufactures no ruggedized, tactical, or mil-spec hardware, no heavy machinery or construction equipment, and no munitions or weapons-system components; its product line consists entirely of enterprise software.⁹ No export-licence denial, suspension, revocation, sanctions enforcement action, or civil penalty tied to CyberArk was identified by any government authority.

Named Entities and Evidence Map

• IC3 (Israeli Cyber Companies Consortium) - confirmed CyberArk membership; led by IAI⁶²⁵
• Israel Aerospace Industries (IAI) - IC3 prime contractor and consortium lead; no bilateral CyberArk supply relationship confirmed outside IC3⁶⁷
• Udi Mokady - co-founder, Unit 8200 alumnus, Executive Chairman from Feb 2023³
• Alon Cohen - co-founder, Mamram alumnus, no role since Dec 2011¹²
• Omer Grossman - Global CIO/Chief Trust Officer, 25+ years IDF service⁴
• US Department of Defense / US Army - Certificate of Networthiness, DoDIN APL, ITES-SW contract holder⁹
• Israeli Ministry of Defence / IDF / SIBAT - no confirmed direct contract identified⁹

Digital: Digital

Mechanism of Involvement

CyberArk is itself an Israeli-origin cybersecurity vendor rather than a customer of other Israeli digital-surveillance firms; its digital-domain nexus runs through its own product ecosystem and R&D footprint. It maintains formal technology-alliance partnerships with fellow Israeli-founded vendors Wiz (announced 13 November 2024) and SentinelOne (announced 4 February 2025), both joint go-to-market integrations.²⁹³¹ Its Privileged Identity Management software reaches UK public-sector customers through reseller/integrator Computacenter, including a three-year, £1,436,210.32 contract with Glasgow Caledonian University and a contract exceeding £1.4 million with the UK’s Student Loans Company via the Crown Commercial Service G-Cloud 13 framework.²⁶³⁰ CyberArk’s confirmed Israeli facilities - the Petah Tikva headquarters and the Beersheba R&D center opened May 2021 - are documented as engineering sites; the Beersheba center is located near the IDF’s C4I technology park and the National Cyber Directorate CERT.⁵¹⁸¹⁹ Board Chairman Gadi Tirosh is a General Partner at Jerusalem Venture Partners, which operates the JVP Cyber Labs incubator and orchestrated JVP’s original 2011 investment in CyberArk.¹⁶

Counter-Arguments and Evidence Limits

No public evidence identified of CyberArk providing facial recognition, biometric surveillance, predictive-policing, sentiment-analysis, or workforce-surveillance technology of any kind. No public evidence identified of CyberArk operating, leasing, or co-locating a customer-facing data center inside Israel, or of any CyberArk participation in Project Nimbus or a comparable state cloud program. No public evidence identified of CyberArk developing or selling offensive cyber capabilities, zero-day exploit tools, or digital weapons. A secondary-source claim (openintel.uk) that Matrix IT is a “confirmed CyberArk reseller” serving the IMOD, IDF, Air Force, Navy and Military Intelligence was not corroborated by Matrix IT’s own primary Who Profits profile, which names other vendor partners but never CyberArk; this claim is accordingly unverified.²¹²² CyberArk does not appear in the OHCHR business-enterprises database or in UN Special Rapporteur Francesca Albanese’s 2025 “economy of genocide” report, which instead names Microsoft, Alphabet/Google, Amazon, HP, IBM and Palantir.²³ Responding to UK boycott campaigns, CyberArk issued a formal statement that it “has no direct interest in or corporate association with the IDF” and that its solutions “are categorically not tools which can be used for war or any other act of aggression and are entirely defensive in nature.”²⁴

Named Entities and Evidence Map

• Wiz - confirmed technology alliance (Nov 2024)²⁹
• SentinelOne - confirmed technology alliance (Feb 2025)³¹
• Matrix IT - alleged reseller to Israeli defense end-users; unverified, not named in Matrix IT’s own primary profile²¹²²
• Computacenter - confirmed reseller/integrator for UK public-sector CyberArk contracts²⁶³⁰
• Gadi Tirosh / Jerusalem Venture Partners - Board Chairman/Lead Independent Director; original lead investor¹⁶

Economic: Economic

Mechanism of Involvement

CyberArk is incorporated in Israel and has maintained its primary R&D and operational headquarters in Petah Tikva since founding in 1999, with the Beersheba R&D center (opened May 2021, within the government-designated CyberSpark technology zone) representing a further capital commitment to Israeli physical infrastructure.¹²¹⁸¹⁹ Prior to acquisition, CyberArk benefited from Israel’s “Preferred Technology Enterprise” and “Special Preferred Technology Enterprise” tax status, carrying reduced corporate tax rates of 6–12% on qualifying IP income, and is characterized in Israeli business press as a flagship anchor of the national cybersecurity sector.² CyberArk’s SEC 20-F filings confirm its products may be subject to the Israeli Defense Export Control Law, administered by the Ministry of Defense’s Defense Export Controls Agency (DECA), constituting a company-disclosed regulatory dependency on Israeli state approval for certain exports.²³⁴ The $25 billion Palo Alto Networks acquisition, closed 11 February 2026, is described in Israeli financial press as one of the largest technology exits in Israeli history and is estimated to have generated close to $2 billion in one-time capital-gains tax revenue for the Israeli treasury, based on an estimated 25–30% Israeli ownership share; secondary reporting further estimated that roughly 1,200 Israeli employees would receive an average of $500,000 each in acquisition-related equity.¹¹⁷ Approximately 700 employees (10% of the combined global workforce) were subsequently notified of layoffs.¹⁷ CyberArk donated employee stock options at IPO to Tmura (The Israeli Public Service Venture Fund), which converted to approximately $750,000 for Israeli nonprofits upon lockup expiration.³⁵³⁶

Counter-Arguments and Evidence Limits

CyberArk does not separately disclose Israeli-market revenue in its public filings, reporting geography only in broad regional categories (Americas; EMEA; Asia-Pacific), and does not characterize Israel as an export market since Israel functions as its home jurisdiction and R&D base rather than a sales territory.² No capital investments by CyberArk in the West Bank, Gaza, or Golan Heights are documented in any filing or press source. No state ownership stake, government board appointee, golden share, or charter provision structurally tying CyberArk to Israeli state policy objectives was identified in SEC filings.² No evidence was found linking CyberArk’s founding venture investor, Jerusalem Venture Partners, to defense-sector or settlement-linked investment portfolios. The $2 billion capital-gains tax estimate and the $500,000-per-employee equity figure derive from Israeli financial press and a boycott-campaign secondary source rather than from CyberArk’s own disclosures, and are carried here as reported estimates, not verified figures.¹¹⁷

Named Entities and Evidence Map

• Israeli Ministry of Finance / Israeli Treasury - beneficiary of estimated ~$2B capital-gains tax on the acquisition¹
• Israel Tax Authority - “Preferred Technology Enterprise” regime - confirmed reduced tax status (6–12%)²
• Palo Alto Networks, Inc. / Athens Strategies Ltd. - acquirer and Israeli merger vehicle¹⁰¹¹
• Jerusalem Venture Partners - founding lead investor, ~46% stake at IPO¹⁶
• Tmura (Israeli Public Service Venture Fund) - recipient of IPO-linked stock-option donation (~$750,000)³⁵

Political: Political

Mechanism of Involvement

CyberArk’s political nexus centers on public corporate statements, founder/executive IDF pedigree, and embedding in state-linked innovation infrastructure. CEO Matt Cohen’s 13 October 2023 blog post, “Our Hearts Are Broken, but We Will Prevail,” described the company as “horrified by the barbaric attack on Israel and the Israeli people,” expressed solidarity with Israeli employees, and confirmed staff reservist mobilization; no comparable CyberArk statement addressing Palestinian civilian casualties or the Gaza humanitarian situation was identified.²⁰ CyberArk’s Beersheba R&D center sits inside the Gav-Yam Negev Tech Park/CyberSpark ecosystem - a joint venture of Israel’s Prime Minister’s Office (National Cyber Bureau), Ben-Gurion University and the Beersheba Municipality, launched by Prime Minister Netanyahu in 2014 - adjacent to the IDF’s C4I technology base.⁵¹⁸²⁵ CyberArk is the subject of an active organized boycott listing (palestiniangenocide.org) citing its Israeli headquarters/ownership, the CEO’s October 2023 statement, and the scale of the Palo Alto Networks acquisition.³⁷ Two UK university boycott disputes are documented: a Glasgow Caledonian University Students’ Association motion to end the CyberArk relationship passed 144–46 (though a subsequent emergency meeting did not formally endorse a boycott), and University of Aberdeen students objected to a January 2024 CyberArk contract citing CIO Omer Grossman’s IDF service, with the university’s response deflecting to an unrelated scheduling matter rather than addressing the substance.²⁸²⁷ The Student Loans Company’s CyberArk contract was separately criticized by Scottish Greens co-leader Patrick Harvie, who called for boycott/divestment, while the Student Loans Company defended the procurement as compliant with the Public Contract Regulations 2015.³⁰

Counter-Arguments and Evidence Limits

No public evidence identified of CyberArk HR action, termination, or discipline against any employee for pro-Palestinian speech or activity. No public evidence identified of CyberArk-specific US federal lobbying registrations, PAC filings, or FEC records, nor of involvement in anti-BDS legislative advocacy. No public evidence identified of CyberArk corporate donations to FIDF, JNF/KKL, Regavim, Im Tirtzu, or settlement organizations. CyberArk’s stated corporate mission is commercial identity-security software; no evidence was found that its corporate charter or founding documents tie its mission to Israeli state geopolitical goals, notwithstanding its founders’ documented IDF backgrounds. CyberArk does not appear in the OHCHR business-enterprises database tied to settlement activity, nor among the technology firms named in UN Special Rapporteur Francesca Albanese’s 2025 report.²³ CyberArk’s own public statement asserts no direct corporate association with the IDF and characterizes its products as “entirely defensive in nature.”²⁴

Named Entities and Evidence Map

• Matt Cohen - CEO since April 2023; authored the October 2023 solidarity statement²⁰
• Omer Grossman - Chief Trust Officer/former CIO; central figure in student-boycott objections⁴²⁷
• Gadi Tirosh - Lead Independent Director; Managing Partner, Jerusalem Venture Partners¹⁶
• CyberSpark / Gav-Yam Negev Tech Park - government-backed ecosystem hosting CyberArk’s Beersheba facility⁵¹⁸
• Glasgow Caledonian University / University of Aberdeen / UK Student Loans Company - sites of documented boycott/divestment disputes²⁶²⁷³⁰

BDS-1000 Score (V4)

• V_MAX: 9.20 Sum_OTHERS: 6.59
• BRS Score: 657 Tier: B (Severe)

The composite score is driven almost entirely by Economic (V_MAX = 9.20), reflecting CyberArk’s status as an Israeli-incorporated, Israeli-founded company whose $25 billion sale generated a substantial, well-documented Israeli tax windfall and whose operations remain structurally embedded in Israel’s economy and export-control regime. Political contributes the largest secondary weight (5.74), reflecting founder/executive IDF pedigree and public wartime solidarity statements, while Military (0.12) and Digital (0.73) remain low because no audit found a direct military contract or surveillance-technology relationship. Under the BDS-1000 method, the score is scale-free: Impact (I) captures the type of activity involved, Magnitude (M) captures its scale, and Proximity (P) captures directness of the Israel/Palestine nexus; the resulting domain scores are combined into the BRS using the highest-scoring domain (V_MAX) plus a discounted sum of the remaining domains, all figures fixed following human vetting.

Methodology Note

• Every claim in this dossier traces to one or more of the four domain audits (Military, Digital, Economic, Political, dated 28 June 2026); no claim beyond those audits was introduced.
• Where an audit’s search found nothing (e.g., no direct IMOD/IDF contract, no Israeli data-center hosting, no lobbying filings), this dossier states “No public evidence identified” rather than inferring a relationship.
• Scoring is scale-free: Impact (I) reflects the type of activity, Magnitude (M) reflects its scale, and Proximity (P) reflects directness of connection to Israeli state/military conduct; scores were fixed during human vetting and are not altered here.
• Temporal rule: divestments, contract terminations, or exited operations are treated as mitigating factors, not omitted, and are recorded with dates where documented (e.g., Alon Cohen’s 2011 departure).
• Entity attribution follows a no-transitive-guilt standard: claims resting on unverified secondary sources (e.g., the alleged Matrix IT reseller relationship) are explicitly flagged as unverified rather than presented as fact, and claims specific to other companies (e.g., IC3 co-members’ named technical roles) are not attributed to CyberArk absent direct evidence.
• Where an activity plausibly implicates more than one domain (e.g., the CyberSpark/Beersheba government-ecosystem relationship touching both economic investment and political embedding), it is discussed in both relevant domain summaries rather than force-fit into one.

End Notes