Military Audit - CyberArk Software Ltd.

Audit Date: 28 June 2026 Audit Phase: Military Corporate Status: CyberArk Software Ltd. was acquired by Palo Alto Networks; the transaction completed 11 February 2026 ¹². CyberArk operates as a wholly-owned subsidiary of Palo Alto Networks ¹. All findings below relate to CyberArk’s activities and leadership through the point of acquisition unless otherwise stated.

Direct Defence Contracting & Procurement

IMOD / IDF Direct Procurement

Source classes searched include CyberArk SEC filings ³⁴, IMOD and SIBAT press releases, the SIBAT Defence and HLS Directory landing page, and available Israeli government tender records. No public evidence identified of any contract, tender award, framework agreement, or memorandum of understanding between CyberArk and the Israeli Ministry of Defence, Israel Defence Forces, Israel Prison Service, Israel Border Police, or any other Israeli state security body.

The SIBAT Defence and HLS Directory is published as a PDF; the HTML landing page does not display company listings and the PDF contents were not accessible during this research session, so positive or negative listing of CyberArk cannot be confirmed from that source.

Israeli Cyber Companies Consortium (IC3)

CyberArk is a confirmed member of the Israeli Cyber Companies Consortium (IC3), which was established under the auspices of Israel’s Ministry of Economy and is led by Israel Aerospace Industries (IAI) - a state-owned Israeli aerospace and defence manufacturer ⁵⁶. IC3’s stated mission is to offer “large-scale, end-to-end cyber security solutions to nations worldwide,” in the words of IAI Cyber Division head Esti Peshin ⁵. IC3 is described in Israeli defence media as one of the few entities “in the world to offer cyber solutions at the national level” ⁷.

Confirmed IC3 member companies, per the January 2022 Checkmarx press release, include Check Point, Cognyte, CyberArk, XM Cyber, Mellanox, Cyber X, IAI, Bynet, ECI, Clearsky, and BGProtect ⁵⁶. IAI, the consortium lead, is described in IC3 primary-source materials as “a world-leading aerospace and defense company innovating and delivering state-of-the-art technologies in space, air, land, naval, cyber & homeland security for defense and commercial markets” ⁵. Earlier IC3 expansions added further cybersecurity vendors to the consortium; Siemplify joined in 2020 ⁸.

IC3 won a contract worth “tens of millions of dollars” to establish a National Cyber Center in Brazil, announced 27 March 2017 ⁹. CyberArk is listed as a consortium member in the primary-source announcement of that contract; however, the specific technical delivery roles publicly named in that announcement were assigned to Verint, Check Point, ClearSky, and CyberX - not to CyberArk by name ¹⁰⁹. IC3 has additionally been identified in Israel Defense reporting as operating in multiple Latin American countries ¹⁰⁷. IAI functions as the prime contractor for IC3 National Cyber Center export contracts ⁵⁸⁹.

CyberArk’s specific PAM-component delivery role within IC3 National Cyber Center contracts is asserted in an openintel.uk corporate dossier that returned HTTP 404 at the time of research and whose contents could not be verified as a primary source. CyberArk’s precise technical contribution to IC3 deliverables beyond confirmed consortium membership cannot be established from the accessible evidence reviewed.

US Military Procurement Vehicles

CyberArk products were made available through the US Army ITES Software Contract (Information Technology Enterprise Solutions – Software) in 2017, enabling Army-wide acquisition of CyberArk products through standard channels without bespoke tender processes ¹¹. No equivalent Israeli military procurement vehicle specifically listing CyberArk was identified.

Controlling Principals - Defence Backgrounds

Udi Mokady - Founder and Executive Chairman (from February 2023): Served in IDF Unit 8200 (Military Intelligence Directorate) prior to entering the private sector ¹²¹³. From 1997 to 1999, Mokady served as Vice President and General Counsel of Tadiran Spectralink Ltd., described by ASDSource as “a world leader in the design, development and production of state-of-the-art wireless communications systems for all types of manned/unmanned aerial, ground and surface naval platforms, and leading-edge Search and Rescue (SAR) systems for combat and non-combat applications” within the Elisra Group’s Communications and Data Links Division ¹⁴. Mokady’s role at Tadiran Spectralink was legal counsel rather than a technical or engineering position ¹²¹⁴. He co-founded CyberArk in April 1999, served as CEO from 2005 to February 2023, and was appointed Executive Chairman in February 2023 ¹².

Alon N. Cohen - Co-Founder (departed December 2011): Served six years in MAMRAM (the IDF Center for Computing and Information Systems, the IDF’s central computing unit) before co-founding CyberArk ¹⁵. Cohen departed the company in December 2011 following a Goldman Sachs equity stake acquisition and has held no board or operational role at CyberArk since that date ¹⁵.

Omer Grossman - Global Chief Information Officer (appointed 20 December 2022): Served in the Israel Defense Forces for more than 25 years ¹⁶¹⁷¹⁸. His most recent IDF appointment was Head of the IDF Cyber Defense Operations Center, in which capacity he “led joint and national cyber defense campaigns and operations” ¹⁶¹⁷. Prior to that, he served as Head of MAMRAM - described as “the central Cloud Service Provider of the IDF, providing data and infrastructure services to all military branches including the general command staff” - where he led hundreds of personnel who “developed, operated and secured the IDF’s main cloud environment” ¹⁶¹⁷. Grossman holds a Master of Science in Government Information Leadership from the National Defense University, College of Information and Cyberspace, Washington DC ¹⁶. At the time of appointment, CEO Udi Mokady stated: “Omer has been on the frontlines of cyber warfare, and has seen first-hand the acceleration of attacker innovation” ¹⁶. Grossman has appeared as a named speaker at Cybertech Global Tel Aviv, an Israeli government-sponsored cybersecurity trade event ¹⁹. This appointment is post-2020 and was current through the February 2026 Palo Alto acquisition ¹.

Shahar Layani - Chief Customer Officer (joined at founding, 1999): Prior to joining CyberArk at its founding, Layani served as an Intelligence Officer in the Israeli Air Force, specifically in a Combat Helicopter Squadron, responsible for “intelligence research, pilot briefings and missions planning” ²⁰²¹. In his current role, Layani leads implementation services, consulting services, training services, and customer support worldwide ²¹.

Military Reserve Duty

CEO Matt Cohen confirmed in his 13 October 2023 public blog post that “a small percentage of our team has been called to military reserve duty” following the 7 October 2023 Hamas attack, and stated CyberArk is “incredibly proud of all our team members” called to serve ²². CyberArk communications specialist Nick Bowman separately confirmed to The Record that “a few of CyberArk’s global team members were called up to support the military effort” ²³. CyberArk’s FY2017 Form 20-F (SEC EDGAR) identifies Israeli employee military reserve duty obligations as a risk factor capable of disrupting operations ⁴.

Dual-Use Products & Tactical Variants

Product Architecture

CyberArk’s core commercial offering is an enterprise Privileged Access Management (PAM) and Identity Security Platform delivered as software ²⁴³. No public evidence identified of purpose-built ruggedised, tactical, or mil-spec hardware variants of CyberArk products.

US Military and Federal Government Certifications

CyberArk’s Privileged Account Security Solution received the US Army Certificate of Networthiness (CoN) on 8 September 2016, certifying it for deployment across the Army Enterprise Infrastructure Network and verifying compliance with DoD and Army requirements for security, sustainability, and usability ²⁵²⁶. At the time of award, CyberArk was described as “the only comprehensive privileged account security solution” on the DoD Unified Capabilities Approved Products List (UC APL) ²⁵.

CyberArk PAM Self-Hosted (versions 14.0 and 14.2) is listed on the DoDIN APL (DoD Information Network Approved Products List) as an approved Cybersecurity Tool for US DoD customers ²⁷. CyberArk Endpoint Privilege Manager and Workforce Identity have achieved FedRAMP High authorisation for US federal government deployment ²⁴. CyberArk holds a NIAP Common Criteria EAL 2+ certification (2015), validating its solutions for use on US National Security Systems ²⁵²⁴. CyberArk products were made available on the US Army ITES Software Contract in 2017, enabling Army-wide procurement ¹¹.

All certifications referenced above relate to US military and US federal government use ^2511242726; they do not constitute Israeli military-specific product certifications or Israeli government procurement listings.

Israeli Military-Specific Certification

No Israeli Ministry of Defence, IDF-specific, or Israeli security-body product certifications for CyberArk products were identified in primary sources. No public evidence identified.

Heavy Machinery, Construction & Infrastructure

CyberArk’s product portfolio consists exclusively of enterprise cybersecurity software ²⁴³; the company does not manufacture, supply, or service heavy machinery, construction equipment, vehicles, earthmoving plant, or physical infrastructure products. No evidence of CyberArk equipment or services in Israeli settlements, along the separation barrier, within military installations in the occupied territories, or related to settlement construction or demolition was identified. Source classes searched include UN OHCHR documentation ²⁸, the Who Profits company profile URL (returned HTTP 404), B’Tselem publications, and NGO research reports.

CyberArk’s physical facilities are located in Petah Tikva (headquarters) and the Gav-Yam Negev Tech Park, Beersheba, within the internationally recognised sovereign territory of Israel ²⁹³⁰. The Beersheba campus is co-located in a technology park that also hosts the IDF C4I (Command, Control, Communications, Computers and Intelligence) directorate and the National Cyber Directorate CERT ³⁰. No supply relationship or contractual nexus with settlement construction, settlement infrastructure, or related physical activities was identified.

No public evidence identified for any sub-category of heavy machinery, construction equipment, or settlement infrastructure involvement under this section.

Supply Chain Integration with Defence Primes

IC3 / IAI Consortium Relationship

CyberArk’s most proximate relationship with a defence prime is its confirmed membership of IC3, which is led by IAI (Israel Aerospace Industries) - a wholly state-owned Israeli aerospace and defence prime ⁵⁸. IAI functions as the prime contractor for IC3 National Cyber Center export contracts ⁵⁸⁹. CyberArk is a confirmed named member of this consortium across multiple primary sources ⁵⁶¹⁰. The IC3 Brazil 2017 contract, worth “tens of millions of dollars,” is the sole primary-source contract award identified for IC3 during this research session ⁹. Whether CyberArk sub-contracted specific components within that delivery - beyond consortium membership - cannot be established from accessible primary sources.

Component Supply to Other Israeli Defence Primes

Source classes searched for bilateral supply relationships include SEC filings ³⁴, CAAT databases, Elbit Systems and Rafael Advanced Defense Systems corporate disclosures, and news archives. No public evidence identified of verified supply relationships between CyberArk and Elbit Systems, Rafael Advanced Defense Systems, Israel Aerospace Industries (as a direct bilateral procurement relationship separate from the IC3 consortium), or Israel Military Industries (IMI/Elbit Land).

Joint Development and Co-Production

No verified joint development programmes, co-production agreements, technology transfer arrangements, or licensed manufacturing agreements between CyberArk and Israeli defence firms were identified in primary sources. No public evidence identified.

Logistical Sustainment & Base Services

CyberArk’s product portfolio consists entirely of enterprise cybersecurity software ²⁴³. The company does not supply catering, transport, fuel, waste management, facilities maintenance, freight, or any other logistical sustainment or base services to military or defence organisations.

No public evidence identified for any sub-category of logistical sustainment or base services under this section.

Munitions, Weapons Systems & Strategic Platforms

CyberArk holds no verified role as a prime contractor, licensed sub-contractor, or component supplier for any weapons system, lethal autonomous platform, munitions production line, or strategic military platform ²⁴³. CyberArk’s PAM software is not purpose-built to generate targeting decisions or kinetic weapons effects and does not meet the threshold of a weapons system under standard Military domain boundaries.

No public evidence identified for any sub-category of munitions, weapons systems, or strategic platform involvement under this section.

Export Licensing, Regulatory & Legal History

Export Licence Decisions

Source classes searched include UK ECJU strategic export licensing data (July 2025 and February 2026 publications), US Bureau of Industry and Security (BIS) records, Israeli Defence Export Control Agency (DECA), and the Campaign Against Arms Trade (CAAT) database. No public evidence identified of any decision by a government authority to grant, deny, suspend, or revoke export licences specifically for CyberArk products to Israeli military or security end-users.

Regulatory Compliance Posture

CyberArk’s Form 20-F FY2024 (SEC EDGAR, filed 12 March 2025) identifies compliance with US and Israeli export control laws as a material risk factor ³. CyberArk’s FY2017 Form 20-F separately identifies Israeli employee military reserve duty obligations as a risk factor affecting operational continuity ⁴. Both filings confirm CyberArk operates under US and Israeli export control regimes ³⁴. No enforcement action, civil penalty, or consent agreement between CyberArk and any export control authority was identified.

Arms Embargo and Sanctions Compliance

No investigations, enforcement actions, citations, or findings against CyberArk related to arms embargo compliance or international sanctions violations were identified. No public evidence identified.

Legal Challenges

No court proceedings, judicial reviews, or legal challenges against CyberArk - or against any government authority regarding CyberArk’s supply relationships with Israel - were identified. No public evidence identified.

Civil Society Scrutiny & Documented Investigations

UN OHCHR Database of Business Enterprises (A/HRC/60/19, September 2025)

CyberArk is not listed in the UN OHCHR database of business enterprises involved in settlement-related activities, as updated in September 2025 (A/HRC/60/19, covering 158 companies) ²⁸. The database focuses on companies involved in settlement construction, real estate, mining, quarrying, and related activities; no cybersecurity or PAM software companies were identified in the database as updated ²⁸.

UN Special Rapporteur Report A/HRC/59/23 (Albanese, 2 July 2025)

CyberArk is not named in UN Special Rapporteur Francesca Albanese’s report A/HRC/59/23, “From Economy of Occupation to Economy of Genocide,” published 2 July 2025 ³¹. The report and its accompanying database of over 1,000 companies address primarily arms manufacturers, cloud computing providers, surveillance companies, construction materials firms, natural resource companies, and financial institutions ³¹³². The cybersecurity PAM software sector is not specifically addressed in the report ³¹.

PAX Report “Companies Arming Israel and Their Financiers” (June 2024)

The PAX June 2024 report focused on manufacturers and suppliers of weapons systems, including Boeing, General Dynamics, Leonardo, Lockheed Martin, RTX, and Rolls-Royce. No public evidence identified of CyberArk’s inclusion in that report.

BDS Movement and Boycott Profiles

CyberArk appears on the “Stop the Palestinian Genocide” boycott profile, which describes it as an Israeli cybersecurity firm with executive ties to the IDF through founders’ and officers’ military backgrounds ³³. That profile explicitly states: “no direct military or surveillance applications documented publicly” ³³. No confirmed entry for CyberArk on the BDS Movement’s official corporate targeting list was identified.

Who Profits / AFSC Investigate

The direct company profile URLs for CyberArk on Who Profits (whoprofits.org) and AFSC Investigate (investigate.afsc.org) both returned HTTP 404 during this research session. Confirmed active profiles for CyberArk on either platform could not be established from accessible sources. No public evidence identified.

Al-Haq, SOMO, BankTrack, and Don’t Buy Into Occupation

No specific mention of CyberArk was identified in Al-Haq reports, SOMO publications, BankTrack corporate profiles, or the Don’t Buy Into Occupation (DBIO) report series, including the November 2025 DBIO update. No public evidence identified.

JP Morgan Analyst Assessment (October 2023)

JP Morgan identified CyberArk as one of the cybersecurity companies “most exposed” to the Israel-Hamas conflict in an October 2023 analyst note, citing CyberArk’s concentration of personnel and R&D operations in Israel - approximately 31–32% of total workforce as of 2022–2023 - as the primary exposure driver ³⁴.

Glasgow Caledonian University (GCU) Contract Dispute

In autumn 2023, Glasgow Caledonian University awarded a £1,436,210.32 contract to Computacenter UK Ltd - a UK IT reseller and CyberArk Advanced Partner since 2008 - to supply CyberArk multi-factor authentication (MFA) software for a three-year term, with implementation commencing October–November 2024 ³⁵³⁶. GCU’s Palestine Solidarity Society launched a student boycott campaign in November 2024, urging students to avoid university systems secured by CyberArk MFA and citing the IDF service backgrounds of CyberArk executives, specifically naming Omer Grossman’s more than 25 years of IDF service ³⁶. GCU’s Students’ Association published a proposal entitled “GCU TO END RELATIONSHIP AND CONTRACT WITH CYBERARK,” though this was a student-body proposal and not a confirmed institutional university decision ³⁵.

GCU’s administration defended the contract, stating the university is “bound by World Trade Organisation and UK Government procurement rules and is not legally permitted to discriminate in its procurement decisions on grounds of nationality” ³⁶. CyberArk did not respond to media requests for comment on this matter ³⁶. No confirmed institutional divestment or contract termination by GCU was identified.

Corporate Response to Civil Society Pressure

CEO Matt Cohen issued a public blog post titled “Our Hearts Are Broken, but We Will Prevail” on 13 October 2023, describing the 7 October 2023 Hamas attack as “a barbaric attack on Israel and the Israeli people,” confirming that “a small percentage of our team has been called to military reserve duty,” and declaring CyberArk to be “incredibly proud of all our team members” serving in the reserves ²². CyberArk communications specialist Nick Bowman separately confirmed to The Record that “a few of CyberArk’s global team members were called up to support the military effort” ²³. CyberArk’s fourth annual ESG Report, published July 2024, does not address civil society concerns regarding defence supply relationships or its Israeli market operations ³⁷.

No subsequent public statements by CyberArk responding to civil society concerns about its defence supply chain relationships were identified. No public evidence identified of any contract terminations, end-use monitoring commitments, or policy changes in response to civil society pressure. No public evidence identified of any CyberArk policy response to the ICJ Advisory Opinion of July 2024, the ICC arrest warrants of November 2024, or the UN Albanese report of July 2025 ³¹. CyberArk’s acquisition by Palo Alto Networks, announced July 2025 and completed February 2026 ¹², occurred after each of these legal milestones with no identified policy statement from either company addressing them.

End Notes