CyberArk MILITARY

Direct Defence Contracting & Procurement

No public evidence identified of a verified direct contract, tender award, or memorandum of understanding between CyberArk and the Israeli Ministry of Defense (IMOD), the IDF, the Israel Prison Service, or the Israel Border Police; a search for Israel Prison Service technology contracts surfaced a comparable award to a different company, not CyberArk ¹. CyberArk is a founding/listed member of the Israeli Cyber Companies Consortium (IC3), established in 2016 under the auspices of Israel’s Ministry of Economy (not IMOD/SIBAT) and led by state-owned Israel Aerospace Industries (IAI), alongside Check Point, Cognyte, XM Cyber, Mellanox, CyberX, and others ^{2, 3, 4}. IC3’s stated mission is to offer advanced cyber-defense capabilities to national governments and to build “National Cyber Centers” for export to foreign governments ^{2, 3}. CyberArk is also a member of the Israeli Aviation Cyber Companies Consortium (IAC3), launched under Israel’s Ministry of Economy and Industry with IAI, Check Point, El Al’s Cockpit Innovation hub, Karamba Security, and ClearSky to develop cybersecurity for commercial aviation ^{5, 6}. Both consortium memberships are government-facing but civilian/economic-ministry-led rather than documented IMOD/IDF procurement contracts. No public evidence identified of CyberArk appearing in official SIBAT defense-export directories or international defense-exhibition catalogues in connection with Israeli state security contracts.

IC3’s export activity is documented in contemporaneous trade reporting. On 27 March 2017 the consortium was reported to have been awarded a contract worth “tens of millions of dollars” to establish a national cyber centre in a Latin American country, with IAI/ELTA overseeing implementation and the named technical delivery roles assigned to Verint (multi-vector threat protection), Check Point (threat prevention and forensics), ClearSky (cyber intelligence and defence methodologies) and CyberX (SCADA/ICS threat detection); CyberArk appears in that reporting among the consortium’s more recently added members and was not assigned a named delivery role in the announcement ^{7, 8}. Israel Defense valued the South American project at approximately US$50 million and stated that it included establishing a national CERT, and attributed the claim of being among “less than 12 players, worldwide, who can offer cyber solutions at the national level” to IAI/ELTA’s cyber division rather than to the consortium as a whole ⁹.

Outside Israel, CyberArk’s Privileged Account Security Solution obtained a U.S. Army Certificate of Networthiness in September 2016, following the solution’s addition to the U.S. Department of Defense Unified Capabilities Approved Products List, certifying it for use across the Army Enterprise Infrastructure Network against DoD and Army security requirements ¹⁰. On 31 January 2017 reseller Carahsoft made the solution orderable through the U.S. Army Information Technology Enterprise Solutions – Software (ITES-SW) contract vehicle, which carries only Certificate-of-Networthiness-certified commercial software ^{10, 11}. These are United States federal and Army certifications and procurement listings; they are not Israeli military certifications or Israeli government procurement records.

Dual-Use Products & Tactical Variants

CyberArk’s own SEC Form 20-F disclosures state that its products and solutions are currently not subject to supervision under the Israeli Defense Export Control Law, but disclose that if products were used for defense-related purposes or classified as dual-use goods and technology, the company would become subject to regulation requiring a defense marketing license from the Israeli Ministry of Defense ¹². No public evidence identified of a ruggedised, tactical, or mil-spec CyberArk product variant being marketed or confirmed sold to Israeli security forces.

Heavy Machinery, Construction & Infrastructure

No public evidence identified. CyberArk is a pure software (identity/privileged-access-management) company with no heavy machinery, vehicle, or construction equipment product lines, and No public evidence identified of CyberArk equipment or machinery use in settlement, barrier, or military-installation construction or demolition.

Supply Chain Integration with Defence Primes

No public evidence identified of a verified component-supply relationship, software or otherwise, between CyberArk and Elbit Systems, IAI, Rafael, or Israel Military Industries (IMI) as direct suppliers of defence-hardware sub-systems. An indirect institutional linkage exists via CyberArk’s IC3 consortium membership, where CyberArk (identity security) sits alongside IAI - the consortium’s leader and a major Israeli defence prime - in joint government-facing cyber-defense offerings, though this activity is oriented toward civil/national-cyber-infrastructure rather than weapons-platform component supply ^{2, 3, 4}.

Logistical Sustainment & Base Services

No public evidence identified of CyberArk providing catering, transport, fuel, waste-management, facilities-maintenance, telecom, or other base-support services to IDF installations, training facilities, or detention centres, whether in the West Bank, Golan Heights, East Jerusalem, or elsewhere. No public evidence identified of shipping, freight, or port-handling contracts connected to CyberArk, consistent with its business model as a software vendor rather than a logistics or services provider.

Munitions, Weapons Systems & Strategic Platforms

No public evidence identified of CyberArk manufacturing or licensing lethal platforms, munitions, or strategic-defence-system components such as Iron Dome, David’s Sling, Arrow, fighter aircraft, tanks, or warships. CyberArk’s core product - privileged access and identity security software - is general enterprise IT security infrastructure rather than a weapons or targeting system.

Export Licensing, Regulatory & Legal History

CyberArk’s SEC 20-F filings disclose that the company is subject to U.S. and Israeli export-control and sanctions laws generally, restricting sales to embargoed or sanctioned countries and persons, with encryption-technology export controls applying given its Israel-based R&D operations ^{13, 14, 12}. CyberArk’s own product documentation lists a set of countries subject to restricted access consistent with export-control compliance obligations ¹⁵. No public evidence identified of a specific Israeli, U.S., EU, or UK government decision to grant, deny, suspend, or revoke an export licence naming CyberArk products for Israeli military or security end-users. No public evidence identified of arms-embargo or sanctions-compliance enforcement actions against CyberArk. No public evidence identified of court proceedings, judicial review, or legal challenges against CyberArk, or against a government, regarding a CyberArk–Israel defence-supply relationship; a 2026 securities class-action reported by The D&O Diary concerns a different company, Alarum Technologies, and does not implicate CyberArk ¹⁶.

Civil Society Scrutiny & Documented Investigations

CyberArk appears on at least one BDS-aligned boycott-listing site, “Stop the Palestinian Genocide,” which cites the company’s Israeli headquarters and R&D footprint (approximately 1,200 employees, including a Beersheba R&D presence) and its tech-sector tax contribution to the Israeli state, its October 2023 solidarity statement and acknowledgment that “a few global team members were called to support [the] military effort,” and the scale of Israeli-tech integration into U.S. corporate infrastructure via the Palo Alto Networks acquisition ¹⁷. That listing explicitly acknowledges that “no direct military or surveillance applications are publicly documented” for CyberArk, basing its inclusion on economic and structural grounds rather than direct-supply evidence ¹⁷. The OHCHR Database of Business Enterprises pursuant to Human Rights Council Resolutions 31/36 and 53/25 did not surface a CyberArk-specific listing in available secondary reporting ¹⁸, nor did the July 2025 Albanese report “From economy of occupation to economy of genocide” (A/HRC/59/23) name CyberArk ¹⁹. A full-text search of the PAX June 2024 report “The companies arming Israel and their financiers” found no mention of CyberArk anywhere in the document ²⁰. No CyberArk-specific reference was located in Al-Haq’s Business and Human Rights advocacy materials ²¹. No public evidence identified of an NGO investigation (e.g., Who Profits, Amnesty International, Human Rights Watch, AFSC, SOMO, BankTrack) documenting a direct CyberArk defense or security supply relationship with Israeli state bodies, and No public evidence identified of an institutional divestment decision specifically citing CyberArk’s defence-sector activities.

Following the 7 October 2023 Hamas attack, CyberArk CEO Matt Cohen published a company blog post, “Our Hearts Are Broken, but We Will Prevail,” expressing solidarity with Israel and CyberArk employees and referencing plans to use the company’s India R&D centre to help cover for Israeli staff called to reserve duty ²². CyberArk’s official X/Twitter account posted a parallel statement on 13 October 2023 expressing solidarity with its Israeli team ²³. CyberArk’s FY2023-era SEC disclosures (Form 6-K and 20-F) describe workforce impacts from the war, including a limited part of the Israel-based workforce called to active reserve duty and risk-factor language addressing potential further call-ups and war escalation ^{14, 24}. CyberArk’s FY2017 Form 20-F had already identified the same structural exposure, stating that as of 31 December 2017 the company had 378 employees based in Israel, some of whom may be called for up to 54 days of military reserve duty in each three-year period (up to 70 or 84 days for non-officer commanders and officers respectively) until age 40 or later, and in certain emergency circumstances to “immediate and unlimited active duty” ¹³.

CyberArk sponsorship or affiliation with the Magshimim youth cyber-training initiative, which has documented links to IDF cyber-training pathways, forms part of the same Israeli tech-and-security ecosystem discussed in broader industry reporting ^{25, 26}. Broader industry reporting on Israeli cybersecurity firms’ wartime posture situates CyberArk within a sector described as materially supporting Israel’s war effort, though without company-specific allegations against CyberArk beyond its own public statements ^{27, 28}.

Controlling Principals

CyberArk founder Udi (Ehud) Mokady, who served as Chairman/CEO through 2025 and subsequently as Executive Chairman, is reported to have served in Israeli military intelligence from 1986 to 1989 ²⁹. CyberArk’s own Form 20-F records that from 1997 to 1999, immediately before co-founding the company, Mokady served as general counsel at Tadiran Spectralink Ltd., described in the filing as “a producer of secure wireless communication systems” ¹³; an aerospace-and-defence industry directory describes Tadiran Spectralink, part of the Elisra Group’s communications and data links division, as “a highly specialized producer of advanced wireless communications systems for all types of UAVs, airborne platforms and ground stations, guided weapons, and space vehicles”, also supplying search-and-rescue systems for combat and peacetime operations ³⁰. The role he held there was a legal rather than an engineering one ¹³. Chen Bitan, CyberArk’s General Manager for Israel and Chief Cyber Transformation Officer, previously served in the IDF in a software-engineering unit, ending as Department Manager at the Mamram Academy, the IDF’s programming-training academy ^{31, 32, 33}. Omer Grossman joined CyberArk as Global Chief Information Officer in December 2022 and later became Chief Trust Officer and Head of the “CYBR Unit” in September 2025; prior to CyberArk he spent more than 25 years in the IDF, most recently as Head of the IDF Cyber Defense Operations Center, and previously as Head of Mamram, the IDF’s central cloud/computing service ^{34, 35, 36, 37, 38}. Reporting of that appointment describes Mamram as “the central Cloud Service Provider of the IDF, providing data and infrastructure services to all military branches including the general command staff”, with Grossman leading “a unit of hundreds of people who developed, operated and secured the IDF’s main cloud environment”, and states that at the IDF Cyber Defense Operations Center he “led joint and national cyber defense campaigns and operations”; the same source records that he holds a Master of Science in Government Information Leadership from the U.S. National Defense University, College of Information and Cyberspace, in Washington DC, and quotes Mokady describing him as having been “on the frontlines of cyber warfare” ³⁴. Board member François Auque, who joined CyberArk’s board in February 2019, is a former Chairman of Airbus Ventures, former head of Airbus’s space division, former CFO of Aerospatiale-Matra, and has served as a Director at Airbus Defence & Space SA since 2014 - an active defence-industry directorship held concurrently with his CyberArk board seat ^{39, 40, 41}. No public evidence identified of equity holdings in Israeli defence primes, FIDF or reservist-fund donations, or public co-belligerency statements by named CyberArk principals beyond the CEO’s October 2023 solidarity statement and the personnel-background facts noted above.

Corporate Transition

As of 11 February 2026, CyberArk completed its acquisition by Palo Alto Networks for approximately $25 billion and now operates as a subsidiary ^{42, 43, 44, 45}. This audit predominantly covers the pre-acquisition period during which CyberArk operated as an independent NASDAQ-listed Israeli company ^{46, 13, 14, 12}. Separate reporting has documented a broader pattern of former Israeli intelligence (including Unit 8200) personnel employed across major technology firms, including Palo Alto Networks, though this finding pertains to the parent company’s own personnel base rather than to CyberArk directly ⁴⁷.