CyberArk DIGITAL

Enterprise Technology Stack & Vendor Relationships

CyberArk is an Israeli-origin identity-security vendor headquartered in Petah Tikva, Israel, founded in 1999 ^{1, 2}. No independent evidence surfaced of CyberArk’s own internal use of Check Point, Wiz, SentinelOne, Nice, Verint, or Claroty products; available material documents CyberArk only as a supplier of security software to other organizations, not as a customer of peer Israeli vendors. No public evidence identified for CyberArk-as-customer of other named Israeli security vendors. CyberArk acquired Venafi, a US-headquartered machine-identity-management firm, from Thoma Bravo for approximately $1.54 billion, with the deal completed in October 2024 ^{3, 4, 5}. In the UK, systems integrator Computacenter holds a £1.4 million contract with Glasgow Caledonian University that deploys CyberArk’s multi-factor authentication software to secure the university’s Celcat and Seats platforms - an example of CyberArk’s technology reaching an institutional end customer via a third-party integrator, ongoing as of November 2024 ⁶. CyberArk software has reached a further UK public body through the same procurement route: the Student Loans Company, a UK government-owned non-profit, holds a CyberArk contract totalling over £1.4 million, which the SLC states was entered into via the UK government’s G-Cloud framework ⁷. While no evidence surfaced of CyberArk consuming peer Israeli vendors’ products internally, CyberArk does maintain formal technology-alliance and product-integration partnerships with other Israeli-founded security firms: on 13 November 2024 CyberArk and cloud-security vendor Wiz announced a partnership integrating the CyberArk Identity Security Platform with the Wiz Cloud Security Platform, under which CyberArk joined the Wiz Integration Network (WIN) and Wiz joined CyberArk’s C3 Alliance ⁸; and on 4 February 2025 CyberArk and SentinelOne announced an integration of CyberArk Endpoint Privilege Manager with SentinelOne’s Singularity Endpoint platform, feeding CyberArk identity data into SentinelOne’s AI SIEM and XDR use cases ⁹.

Surveillance, Biometrics & Retail Technology

No public evidence identified of CyberArk developing or deploying facial recognition, biometric identification, gait-analysis, or retail-loss-prevention technologies of the kind associated with firms such as Trigo, BriefCam, AnyVision, or Trax. CyberArk’s stated core product line is privileged access and identity security management, not biometric surveillance ². No public evidence identified of CyberArk-developed predictive-policing, sentiment-analysis, or workforce-surveillance tools. No public evidence identified of third-party biometric or surveillance tools being bundled or resold via CyberArk’s platform.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

CyberArk’s SaaS Identity Security Platform is built on Amazon Web Services and is marketed as operating “redundant data centers across the globe”; CyberArk also offers Secure Cloud Access supporting AWS, Azure, GCP, and on-premises environments ^{10, 11}. No specific confirmation was located that customer data for non-Israeli customers is processed within Israeli AWS zones. CyberArk maintains its headquarters and core R&D operations physically in Israel, with a Petah Tikva HQ campus and a second R&D center inaugurated in Beersheba in June 2021 ^{1, 12, 13}. As of the FY2019 Form 20-F, CyberArk reported 499 Israel-based employees; more recent 2025 reporting cites roughly 1,200 employees across the HQ and Beersheba R&D operations combined ^{2, 14}. No public evidence identified that CyberArk is a named participant or subcontractor in Project Nimbus, the AWS/Google Cloud-led Israeli government cloud contract. No public evidence identified of CyberArk marketing services explicitly for the “digital sovereignty” of Israeli state or military bodies beyond its general R&D presence in the country.

Defence, Intelligence & Security Sector Technology Relationships

CyberArk is a member of the Israeli Cyber Companies Consortium (IC3), established in 2016 under Israel’s Ministry of Economy and led by Israel Aerospace Industries (IAI), alongside members including Check Point, Mellanox, Verint, ECI, CyberX, ClearSky, XM Cyber, Siemplify, and IAI itself ^{15, 16, 17}. This is an industry-government cybersecurity R&D grouping rather than a documented direct weapons or kinetic contract. CyberArk is also named as a member of the Israeli Aviation Cyber Companies Consortium (IAC3), formed with IAI, Check Point, El Al’s Cockpit Innovation hub, and Karamba Security to develop cybersecurity solutions for commercial aviation ^{15, 18}. Co-founder, Executive Chairman and former CEO Udi Mokady served in an IDF military intelligence unit from 1986–1989 and is described in multiple secondary sources as a Unit 8200 alumnus ^{19, 20, 2}. Co-founder Alon N. Cohen is reported in secondary sources to have served in Mamram, the IDF’s Center for Computing and Information Systems, and is credited in that reporting with originating CyberArk’s early “Network Vault” architecture informed partly by that experience, though primary corroboration was not independently confirmed ². Global CIO Omer Grossman (2022–2025) served over 25 years in the IDF, most recently as Head of the IDF Cyber Defense Operations Center and previously as Head of Mamram; in September 2025 he moved into a newly created Chief Trust Officer / Head of CYBR Unit role at CyberArk, with Ariel Pisetzky succeeding him as CIO ^{21, 22}. No public evidence identified of a direct, named CyberArk contract with the Israeli Ministry of Defence, IDF, or Israeli intelligence agencies for software licensing, hosting, or analytics services - the available evidence documents personnel backgrounds and industry-consortium membership rather than confirmed government contracts. No public evidence identified of CyberArk developing or selling offensive cyber capabilities, zero-day exploit tools, or other “digital weapons”; CyberArk’s public product positioning is defensive identity and privileged-access security ². At board level, CyberArk director Ron Gutler - a member of the board since July 2014 - served as Chairman of NICE Systems Ltd. between May 2002 and February 2013; CyberArk’s own Form 20-F describes NICE as “a public company specializing in voice recording, data security, and surveillance” ²³.

AI, Algorithmic & Autonomous Systems

No public evidence identified of CyberArk providing AI/ML, computer-vision, or autonomous decision-support systems to Israeli state, military, or security bodies. No public evidence identified of CyberArk’s AI models being trained on or given access to civilian population data, intercepted communications, or surveillance-derived datasets from Israel or the Occupied Palestinian Territories. No public evidence identified of CyberArk providing autonomous target-generation or tracking systems; CyberArk’s designed product function is identity and access security, not targeting.

Technology Ecosystem & R&D Footprint

CyberArk’s Israeli R&D footprint centers on its Petah Tikva HQ campus and a second R&D hub inaugurated in Beersheba in June 2021, sited near the Gav-Yam Negev Tech Park adjacent to the IDF’s C4I Corps Park and Ben-Gurion University of the Negev, with additional office space added by April 2022 ^{12, 13, 24, 25}. The Beersheba center includes a formal partnership with Ben-Gurion University involving researcher interaction and student internships, per public statements from BGU’s president ²⁴. A CyberArk-associated SEC filing (filer CIK does not directly match CyberArk’s own EDGAR CIK, so attribution is treated as unverified) discloses $5,543 thousand in cumulative Israel Innovation Authority grants carrying 3–5% royalty obligations on related sales, with royalty payments of $458K (2018), $41K (2019), and $228K (2020) - a standard Israeli R&D-grant/royalty regulatory structure rather than a military-specific arrangement ²⁶. CyberArk’s acquisition history includes Idaptive (US, 2020, $70M cash), Venafi (US, 2024, ~$1.54B), Zilla Security (2024, $165M plus $10M earnout), Aapi.io (2022), and C3M (2022), none of which are identified as Israeli-origin targets ^{3, 4, 5}. CyberArk itself was acquired by Palo Alto Networks for approximately $25 billion, announced in 2025 and completed February 11, 2026, described as the second-biggest technology exit in Israeli history; CyberArk’s Israel-based workforce was stated to be “maintained” post-close, though Palo Alto Networks conducted layoffs affecting “hundreds” of CyberArk employees the day after the deal closed ^{2, 27, 28, 29}. No public evidence identified of a formal patent co-development or licensing arrangement specifically between CyberArk and Technion, Hebrew University, or the Weizmann Institute. CyberArk also operated a corporate venture arm, CyberArk Ventures, launched on 12 May 2022 with a $30 million fund alongside strategic venture investors Venrock, YL Ventures, Team8 Capital and Merlin Ventures, and made disclosed investments in Dig Security, Enso Security and Zero Networks ³⁰. Palo Alto Networks’ completion announcement states that the combined company plans to adopt the “CYBR” ticker on the Tel Aviv Stock Exchange while retaining its Nasdaq listing under “PANW” - which it says would make it the largest company listed on the TASE by market capitalisation - and positions its Israeli research site as a primary global innovation hub ²⁸.

Civil Society Scrutiny & Regulatory History

CyberArk was not found in the OHCHR Database of Business Enterprises maintained pursuant to Human Rights Council Resolutions 31/36 and 53/25, as of the most recent 2025 update of that 158-entity list, a result cross-checked against an OpenSanctions mirror of the underlying OHCHR settlement dataset ^{31, 32, 33}. The Glasgow Caledonian University Palestine Solidarity Society launched a boycott campaign in November 2024 against the university’s indirect use of CyberArk’s MFA software (procured via Computacenter under a £1.4 million contract), citing CyberArk’s “strong ties to the IDF” and specifically naming then-CIO Omer Grossman’s 25-year IDF service; the university defended the procurement on WTO/UK non-discrimination procurement grounds and the software’s operational status ⁶. A dedicated activist boycott-tracking database profiles CyberArk and states it found “no direct military or surveillance applications… documented publicly,” classifying CyberArk as a lower-tier “Challenging Priority” target rather than a top boycott focus, citing CyberArk’s Israel-based tax contribution, its October 2023 CEO solidarity statement, and enterprise-market lock-in against named alternatives such as BeyondTrust, Delinea, and HashiCorp ³⁴. No public evidence identified of a dedicated Who Profits company profile for CyberArk in the sources reviewed. A search of AFSC Investigate’s company listing did not surface a dedicated CyberArk entry ³⁵. Around October 7, 2023, CyberArk CEO Matt Cohen issued a company statement expressing solidarity with “the people of Israel,” describing “human tragedy,” and confirming plans to use CyberArk’s India R&D center to help cover work for staff called to military reserve duty; a company spokesperson told The Record that “a small number” of CyberArk’s global team were called up and that the company had business-continuity plans in place, though the original blog post URL now redirects to a generic Palo Alto Networks page post-acquisition and could not be independently re-verified at its original location ^{34, 36}. Responding to the parallel UK public-sector procurement criticism over the Student Loans Company contract, a CyberArk spokesperson told The National that the company has “no direct interest in or corporate association” with the IDF; the same reporting records that CyberArk’s vice president of cyber research, Lavi Lazarovitz, is an active-duty officer in the Israeli Air Force, and that Scottish Greens co-leader Patrick Harvie criticised the use of public money on the contract ⁷. No public evidence identified of formal regulatory inquiries, export-control actions, or sanctions investigations into CyberArk’s sales or services to Israeli state entities.