Digital Audit: CyberArk

Enterprise Technology Stack & Vendor Relationships

CyberArk is itself an Israeli-origin cybersecurity vendor, founded in 1999 and headquartered in Petah Tikva, Israel ¹. Because of this, the “vendor relationship” framing largely inverts for this target: CyberArk is a supplier used by other organizations rather than primarily a customer of other Israeli technology firms. CyberArk maintains a formal technology-alliance and product-integration partnership with fellow Israeli-founded cybersecurity vendor Wiz, announced 13 November 2024, giving joint customers visibility and control over cloud-created identities through CyberArk’s “C3 Alliance”/Wiz Integration Network ². CyberArk also maintains a parallel alliance with SentinelOne, announced 4 February 2025, integrating CyberArk’s Endpoint Privilege Manager with SentinelOne’s Singularity Endpoint platform ³. These are joint go-to-market, product-integration partnerships marketed to shared customers rather than confirmed evidence of CyberArk’s own internal IT infrastructure. No public evidence identified that CyberArk itself procures Check Point, Claroty, or NICE products as internal enterprise infrastructure. CyberArk’s Privileged Identity Management software has reached UK public-sector customers through reseller/integrator Computacenter, including a three-year, £1,436,210.32 multi-factor authentication contract with Glasgow Caledonian University activated in October 2024 ⁴⁵, and a contract exceeding £1.4 million with the UK’s Student Loans Company, procured via a Computacenter-linked path through the Crown Commercial Service G-Cloud 13 framework ⁶. A secondary source, the OpenIntel.uk corporate-complicity dossier, asserts that Matrix IT is a “confirmed CyberArk reseller” in Israel serving the Israeli Ministry of Defense, IDF, Air Force, Navy and Military Intelligence ⁷. This claim was not corroborated on the primary Who Profits company profile for Matrix IT, which documents Matrix IT’s own defense-sector activities and vendor partners (including AWS, IBM, Microsoft, Dell, HP, Cisco, Oracle, Lenovo and Check Point) but does not mention CyberArk anywhere in the profile ⁸; this reseller claim should therefore be treated as unverified pending a primary corroborating source.

Surveillance, Biometrics & Retail Technology

No public evidence identified of CyberArk providing facial recognition, gait-analysis, or retail/loss-prevention biometric surveillance technology comparable to products associated with firms such as Trigo, BriefCam, AnyVision/Oosto, or Trax. No public evidence identified of CyberArk-provided predictive policing, sentiment-analysis, social-media monitoring, or workforce-surveillance tools of any kind.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified that CyberArk operates, leases, or co-locates a customer-facing data center inside Israel; its two Israel-based facilities - the Petah Tikva headquarters and the Beersheba R&D center - are documented as research, development and engineering sites rather than hosting infrastructure ^9101112. No public evidence identified of CyberArk participation in Project Nimbus or any comparable Israeli government or state-backed cloud programme. No public evidence identified of CyberArk marketing or contracting data-sovereignty or resilience services explicitly to Israeli state institutions or military bodies.

Defence, Intelligence & Security Sector Technology Relationships

CyberArk is a founding member of the Israeli Cyber Companies Consortium (IC3), established in 2016 under Israel’s Ministry of Economy and led by state-owned defense prime Israel Aerospace Industries (IAI); other documented IC3 members include Check Point, Cognyte, Mellanox, XM Cyber, CyberX and ClearSky ¹³¹⁴. CyberArk is also documented as a member of a separate aviation-cybersecurity consortium - backed by Israel’s Ministry of Defense, Ministry of Economy, National Cyber Directorate and Israel Export Institute - alongside IAI, Check Point, Karamba Security, ClearSky and El Al’s Cockpit Innovation venture arm, aimed at cyber defense for commercial aviation (airports, airlines and aircraft) ¹⁵¹⁶. IC3 is reported to have won a “tens of millions of dollars” contract, circa 2017, to build a national cyber center in a Latin American country (reported as Brazil), with IAI as prime contractor and CyberArk supplying the Privileged Access Management (PAM) sub-system ¹⁷¹⁸; a secondary characterization from the OpenIntel.uk dossier asserts that IAI’s broader package for this contract also included kinetic and surveillance hardware from other consortium members, though this framing was not independently re-confirmed by CyberArk primary sources ⁷. No public evidence identified of a direct, bilateral CyberArk contract with the Israeli Ministry of Defence, IDF, or Israeli intelligence agencies (Shin Bet, Mossad) in public procurement records. Responding to UK university and public-sector boycott campaigns in 2024–2025, CyberArk issued a formal public statement stating that “the company has no direct interest in or corporate association with the IDF” and that its “solutions are categorically not tools which can be used for war or any other act of aggression and are entirely defensive in nature” ⁶. CyberArk’s founder, Udi Mokady, has a Unit 8200 background and transitioned from CEO to Executive Chairman as part of the company’s leadership history ¹⁹. CyberArk appointed Omer Grossman as Global Chief Information Officer in December 2022 ²⁰²¹; student backlash at the University of Aberdeen in 2024 specifically cited Grossman’s 25 years of IDF service as part of its objection to the university’s CyberArk contract ²². CyberArk board member Ron Gutler served as Chairman of NICE Systems Ltd. - a voice-recording, data-security and surveillance-technology company - from May 2002 to February 2013, concurrent with his CyberArk board tenure since July 2014 ²³. No public evidence identified of CyberArk developing, selling, or maintaining offensive cyber capabilities, zero-day exploit tools, or digital weapons.

AI, Algorithmic & Autonomous Systems

No public evidence identified of CyberArk providing AI/ML, computer-vision, or autonomous decision-support systems directly to Israeli state, military, or security bodies. No public evidence identified that any CyberArk AI system was trained on or given access to civilian population data, intercepted communications, or surveillance-derived datasets from Israel or the Occupied Palestinian Territories. No public evidence identified of CyberArk providing autonomous target-generation, automated threat-detection-for-kinetic-use, or autonomous tracking systems to Israeli military or security forces; this is distinct from Matrix IT - a separate, unconfirmed alleged CyberArk reseller - whose own AI/ML Excellence Center is reported to develop AI solutions for “automatic target identification,” an activity attributed to Matrix IT itself and not shown to be CyberArk’s ⁸.

Technology Ecosystem & R&D Footprint

CyberArk operates two confirmed Israeli R&D/engineering sites: its headquarters in Petah Tikva, home to roughly 1,200 of the company’s 4,000+ global employees, and a research-and-development center in Beersheba’s Gav-Yam Negev Advanced Technologies Park, opened in May 2021 and expanded in April 2022 to target roughly 100 additional employees, located near the IDF’s C4I Corps park and Ben-Gurion University ^9101112. CyberArk’s global office footprint is further documented on its own corporate office-locations page ²⁴. CyberArk’s two most significant acquisitions - Viewfinity (2015) and Idaptive (2020) - were both US-headquartered companies rather than Israeli firms ¹. CyberArk Ventures, a $30 million corporate venture fund launched with partners Venrock, YL Ventures, Team8 Capital and Merlin Ventures, has invested in cybersecurity startups Dig Security, Enso Security and Zero Networks ²⁵²⁶. No public evidence identified of an Israeli surveillance, SIGINT, or military-technology firm (such as NSO Group, Cellebrite or Carbyne) among CyberArk Ventures’ named portfolio companies. CyberArk’s Board Chairman, Gadi Tirosh, is a General Partner at Jerusalem Venture Partners (JVP), which operates the JVP Cyber Labs incubator; Tirosh is credited with orchestrating JVP’s 2011 investment in CyberArk and has sat on the boards of other JVP portfolio cyber companies, including ThetaRay, Morphisec and GreenSQL ²⁷. No public evidence identified of a direct personal stake by Tirosh or JVP in NSO Group or Cellebrite. No public evidence identified of significant patent co-development or licensing arrangements between CyberArk and Technion, Hebrew University, or the Weizmann Institute. Palo Alto Networks announced a $25 billion acquisition of CyberArk on 30 July 2025 and completed the deal on 11 February 2026 ²⁸²⁹³⁰. Palo Alto Networks’ press release states the deal “reinforces Palo Alto Networks’ Israeli R&D center - already the largest outside Silicon Valley” and that the combined company plans a secondary Tel Aviv Stock Exchange listing under the ticker “CYBR,” making CyberArk a Palo Alto Networks subsidiary for group-attribution purposes ³⁰. Palo Alto Networks founder Nir Zuk is also a Unit 8200 alumnus ³¹³².

Civil Society Scrutiny & Regulatory History

CyberArk does not have a dedicated company page on the Who Profits database, and it was not found named in the OHCHR’s database of business enterprises pursuant to Human Rights Council Resolutions 31/36 and 53/25, its September 2025 update, or in UN Special Rapporteur Francesca Albanese’s A/HRC/59/23 report on the “economy of occupation to economy of genocide” ³³³⁴³⁵. CyberArk is nonetheless the subject of a dedicated boycott profile on the “Stop the Palestinian Genocide” targeted-boycott campaign site, which cites the company’s Israeli ownership and origin, its founders’ Unit 8200 background, the Palo Alto Networks acquisition, and CEO Matt Cohen’s October 2023 statement referencing employee military mobilization ³⁶. That October 2023 statement, titled “Our Hearts Are Broken, but We Will Prevail,” was published on CyberArk’s own corporate blog ³⁷. In the UK, a series of university and public-sector boycott campaigns emerged in 2024: a Glasgow Caledonian University Students’ Association student-voice motion calling to end the university’s CyberArk relationship passed by a vote of 144–46, though a subsequent emergency Students’ Association meeting voted down formal endorsement of a boycott ⁴⁵; a University of Aberdeen contract signed 30 January 2024 drew student backlash citing CyberArk’s inclusion on a “Boycott Israel” high-impact list and CIO Omer Grossman’s IDF service, with the university’s response deflecting to an unrelated scheduling matter rather than addressing the contract directly ²²; and the Student Loans Company’s contract, procured via the Crown Commercial Service G-Cloud 13 framework, was criticized by Scottish Greens co-leader Patrick Harvie, who called for boycott/divestment, while the Student Loans Company defended the procurement as compliant with the Public Contract Regulations 2015 ⁶. No public evidence identified of any formal regulatory inquiry, export-control enforcement action, or sanctions-related investigation into CyberArk’s sales or services to Israeli state entities. CyberArk’s SEC Form 20-F filings for fiscal years 2016 through 2024 disclose standard risk-factor boilerplate regarding U.S. and Israeli export-control and sanctions-law exposure and note heightened cyber-threat and operational-disruption risk arising from the Israel-Hamas war, without disclosing any actual violations or investigations ³⁸³⁹⁴⁰. CyberArk also benefits from Israeli “Preferred Technology Enterprise” tax status, carrying a reduced corporate tax rate of 6–12% depending on classification and location under Israel’s 2017 tax amendment, as disclosed across multiple 20-F filings ³⁹. Following the Palo Alto Networks acquisition, secondary reporting cited in the boycott-profile source estimated that roughly 1,200 Israeli CyberArk employees would receive an average of $500,000 each in acquisition-related equity (approximately NIS 2 billion in total), with the OpenIntel dossier separately estimating related capital-gains tax revenue to Israel at close to $2 billion, a figure not independently verified ²¹³⁶⁷. A JPMorgan analysis reported that Check Point, CyberArk and SentinelOne were among the companies most exposed to the Israel-Hamas war ⁴¹.

End Notes