CyberArk POLITICAL

Corporate Communications & Public Stance

In the days following October 7, 2023, CyberArk issued a public statement describing itself as “horrified by the atrocities committed over the past week and concerned by the ongoing event” ¹. CEO Matt Cohen stated that “a small percentage of our team has been called to military reserve duty” and that some employees “bravely volunteered,” adding that the company was “incredibly proud” of its team members ^{1, 2}. A corporate blog post titled “Our Hearts Are Broken, but We Will Prevail” framed the events as “a human tragedy impacting every Israeli” and called for unity in support of “the people of Israel”; the original URL now redirects to a Palo Alto Networks page following the 2026 acquisition close, so the post’s full original text could not be independently re-verified ³. CyberArk’s official corporate X/Twitter account also posted that “CyberArk is proud to be an Israeli company. We stand in…” though the full text was not retrievable directly and is cited via secondary reference only ⁴. No public evidence identified of a comparable CyberArk corporate statement, solidarity post, or CEO commentary specifically addressing Russia’s 2022 invasion of Ukraine, the Black Lives Matter movement, or COVID-19. On the investor side, JP Morgan’s October 2023 analysis flagged CyberArk, alongside Check Point and SentinelOne, as among the software firms “most exposed” to the Israel-Hamas war owing to significant Israel-based operations and talent ^{5, 6}. CyberArk’s public-facing government and public-sector materials emphasize standard commercial/government-market credentials - FedRAMP High authorization, DoD Information Network Approved Products List status, and NIAP certification - rather than explicit geopolitical-partnership language ^{7, 8, 9}. CyberArk’s own FY2024 Form 20-F does, however, foreground regional conflict as a business-risk driver in explicitly geopolitical terms, stating that “the conflicts between Israel and Hamas, as well as other hostile countries, such as Iran, and Ukraine and Russia may result, and in certain cases have resulted, in a heightened threat environment and create unknown cyber risks, including increased risk of actors against Israeli companies, institutions and governmental bodies”, and separately listing “wars (including the conflicts between Israel and Hamas and Ukraine and Russia)” among the causes of potential IT-system and service disruption ¹⁰. No public evidence identified of CyberArk annual-report or investor-facing language framing its Israel operations as a “unique geopolitical partnership” beyond standard R&D and market-presence disclosure.

Operations in Occupied or Contested Territories

CyberArk is headquartered in Petah Tikva, Israel, within the internationally recognized 1949 Armistice (“Green”) Line, and operates an R&D center in Beersheba - also within Israel proper - located in the Gav-Yam Negev Tech Park adjacent to the IDF’s C4I Corps Park ^{11, 12, 13, 14}. No public evidence identified of CyberArk maintaining offices, dealerships, resellers, or subsidiary operations specifically within the West Bank, East Jerusalem, the Golan Heights, or Israeli settlements. The UN Office of the High Commissioner for Human Rights’ most recent update (September 2025) of its database of business enterprises linked to Israeli settlement activity lists 158 companies from 11 countries, including named firms such as Airbnb, Booking.com, Motorola Solutions, and TripAdvisor ^{15, 16}. No public evidence identified confirming that CyberArk’s name appears on this OHCHR database, based on targeted searches against secondary coverage of the list and the OHCHR database’s official landing page; the underlying database was not exhaustively paginated to conclusively rule out inclusion ^{17, 18}.

Internal Governance, Content & Retail Policies

No public evidence identified of HR actions, terminations, or lawsuits involving CyberArk employees over pro-Palestinian speech, symbolic expression, or union activity. As a business-to-business cybersecurity and identity-security software vendor rather than a consumer content or social platform, CyberArk’s governance profile differs structurally from platform companies; No public evidence identified of algorithmic-moderation or editorial-stance controversies attributable to the company. Similarly, as a software vendor without physical retail or consumer-product distribution, No public evidence identified of regulatory action concerning product-origin labeling or retail/supply-chain sourcing practices tied to CyberArk.

Brand Heritage & State Partnerships

CyberArk’s founder, Udi Mokady (Executive Chairman; CEO from 2005–2023), is an alumnus of Unit 8200, the Israeli military’s signals-intelligence unit ^{19, 20}. Co-founder Alon N. Cohen is referenced in company-founding materials and in Mokady’s own commentary on the company’s history ^{21, 22}. A 2025 Drop Site News investigation into former Israeli intelligence personnel working in major technology companies reportedly groups Mokady among “hundreds of former Israeli spies” identified across the tech sector, including at CyberArk; the primary article could not be directly fetched this session and this finding rests on secondary search-result summarization rather than a verified direct quote ²³. CyberArk has publicly marked institutional milestones - including its 10-year IPO anniversary - with company leadership (CEO Matt Cohen, Executive Chairman Udi Mokady) framing these as achievements tied to the company’s Israeli-tech-sector identity ^{24, 25}. No public evidence identified of CyberArk explicitly marketing “military heritage” or “defense-sector origins” as a commercial selling point in its own promotional materials, as distinct from third-party or media characterizations of its founders’ backgrounds. On inaugurating the Beersheba site, CyberArk publicly framed its location as a strategic advantage, stating that “the proximity to IDF’s C4I corps, the Ben Gurion University, global brands, and startups at Beer Sheba’s cyber compound is a considerable edge for CyberArk and employees alike”; the same reporting records that the Gav-Yam Negev park houses Israel’s cyber campus and the National Cyber Directorate’s CERT centre alongside more than 70 development centres and startups ¹². The park itself was launched as a national cyber research complex announced by Prime Minister Benjamin Netanyahu at the Cybertech conference - an event sponsored by Ben-Gurion University of the Negev, the National Cyber Bureau, Israel Defense and the Israeli Ministry of Foreign Affairs - and is described as a complex combining Fortune 500 R&D facilities, cyber incubators, academic researchers and “national government and security agencies” on a single site ²⁶. No public evidence identified of CyberArk hosting Israeli government officials, receiving state honors, or sponsoring “Brand Israel”-type cultural or public-relations campaigns.

Lobbying, Advocacy, Financing & Logistics

CyberArk is listed as a “Challenging Priority Target” on the “Stop the Palestinian Genocide” boycott-campaign directory, which cites the company’s Israeli headquarters, approximately 1,200 Israeli employees, Beersheba R&D presence, founding by a Unit 8200 alumnus, the Palo Alto Networks acquisition, and a characterization of the company as “openly supportive” of Israel’s military response ²⁷. A student-run campaign at Glasgow Caledonian University, hosted on the university students’ association “Student Voice” platform, called for the institution to terminate a £1,436,210.32, three-year multi-factor-authentication services contract with CyberArk (rolled out November 2023, reported active for staff as of October 2024), citing the company’s Israeli ownership and executive/board links to the IDF ²⁸. This page functions as a student-submitted petition rather than a confirmed institutional decision; No public evidence identified confirming that Glasgow Caledonian University formally terminated the contract. A parallel campaign arose at the University of Aberdeen, which signed a CyberArk cybersecurity contract on 30 January 2024; in November 2024 the university’s Palestine Solidarity Society objected publicly, citing CyberArk’s links to the IDF - including that the company’s chief information officer has publicly referenced 25 years of IDF service, including cybersecurity work - and criticising the university’s lack of procurement transparency, its president stating that the society had demanded “an open window of all the companies that the university is associated with”. The university’s response pointed to a postponed “Citizen’s Assembly” that would “consider international conflict in its widest sense and would not be focusing on any particular conflict”, rather than addressing the CyberArk contract directly ²⁹. Founder Udi Mokady is separately listed as an Israeli-American Council (IAC) Council Member for the New England region, and also holds a seat on the Monetary Authority of Singapore’s Cyber Security Advisory Panel, a Brandeis International Business School board-of-advisors seat, and a Catalyst Advisor role at General Catalyst ³⁰. Separately, JP Morgan’s October 2023 investor note flagged CyberArk’s Israel-based exposure amid the Israel-Hamas war ^{5, 6}. No public evidence identified of a CyberArk-specific federal political action committee, OpenSecrets lobbying-client profile, or Federal Election Commission filing. No public evidence identified of CyberArk corporate donations to the Friends of the IDF, Jewish National Fund/Keren Kayemeth LeIsrael, Lev Echad, Regavim, Im Tirtzu, or other named military-welfare or settlement-linked organizations. No public evidence identified of CyberArk lobbying activity on boycott or anti-BDS legislation, or of CyberArk leadership holding formal roles with the Christians and Israel/CFI network, AIPAC, or the U.S.-Israel Strategic Technology Forum.

Corporate Structure & Primary Mission

CyberArk was founded in 1999 by Udi Mokady and Alon N. Cohen and completed its NASDAQ initial public offering in 2014 ³¹. Its stated corporate mission, per its own public-sector and government marketing materials, is the development and sale of commercial identity-security and privileged-access-management software to financial services, energy, retail, healthcare, and government customers globally ^{31, 9}. No public evidence identified of a state golden share, explicit charter language tying the company’s primary mandate to Israeli state geopolitical objectives, or any structural feature distinguishing it from a standard commercial technology enterprise. CyberArk was acquired by Palo Alto Networks in a roughly $25 billion cash-and-stock transaction, announced July 30, 2025, and closed February 11, 2026, following U.S., EU, UK, and Israeli regulatory clearance ^{32, 33, 34, 35}. Post-acquisition, CyberArk now operates as a subsidiary product line, branded “Idira,” within Palo Alto Networks ^{7, 8}. Approximately 700 former CyberArk employees were laid off by Palo Alto Networks the day after the deal closed ^{36, 37}; approximately 1,200 Israel-based CyberArk employees were reported to have received acquisition-linked equity compensation averaging roughly $500,000 each ³⁵. On the parent side, Palo Alto Networks’ Israeli-American founder Nir Zuk retired in August 2025 after two decades as founder and chief technology officer, with CEO Nikesh Arora stating that “our commitment to Israel has not changed despite the fact that Nir is not actively at Palo Alto” ³⁸. No public evidence identified this session of Palo Alto Networks’ own independent Israel/defense-sector contracting history (including any Project Nimbus-type government cloud or defense arrangement), which would be a relevant group-attribution consideration for the combined post-acquisition entity going forward.

Executive & Leadership Footprint

Founder and Executive Chairman Udi Mokady, who served as CEO from 2005 to 2023, is documented as a Unit 8200 alumnus ^{19, 20}, and is reported to be among the individuals identified in a 2025 Drop Site News database of former Israeli intelligence personnel working across major technology companies, based on secondary summarization of a primary article that could not be directly fetched ²³. Mokady publicly commented on the rationale for the Palo Alto Networks acquisition, describing a valuation threshold at which “you have to say yes” ²². Current CEO Matt Cohen made public statements in October 2023 acknowledging employee reservist mobilization and voluntary enlistment ^{1, 2}, and later co-marked the company’s IPO anniversary alongside Mokady as an institutional milestone ^{24, 25}. Omer Grossman, appointed Global Chief Information Officer in December 2022 and subsequently Chief Trust Officer, served more than 25 years in the IDF, most recently as Head of the IDF’s Cyber Defense Operations Center, where he “led joint and national cyber defense campaigns and operations”, and previously as Head of Mamram, the IDF’s Center for Computing and Information Systems, described as “the central Cloud Service Provider of the IDF, providing data and infrastructure services to all military branches including the general command staff”; he holds a Master of Science in Government Information Leadership from the U.S. National Defense University’s College of Information and Cyberspace ³⁹. He is the executive most directly cited by outside campaigners, including the University of Aberdeen Palestine Solidarity Society, as evidence of institutional IDF ties ²⁹. On the board, CyberArk’s Form 20-F identifies Gadi Tirosh as Lead Independent Director, a director since June 2011, chairman from July 2013 to June 2016 and lead independent director since July 2016, and Managing Partner from 2005 to 2018 at Jerusalem Venture Partners, an Israeli venture capital firm focused on cybersecurity that operates the JVP Cyber Labs incubator; the same filing identifies director Ron Gutler, on the board since July 2014, as former Chairman of NICE Systems Ltd. ¹⁰. No public evidence identified of a full, independently verified current board roster or of individual board-member research (beyond Mokady) into settlement-organization ties, defense-industry board seats, or personal political donations; this would require direct retrieval of CyberArk’s proxy or annual-meeting filings, which was not completed for this audit.