Political Audit: CyberArk

Corporate Communications & Public Stance

On October 13, 2023, CyberArk CEO Matt Cohen published a company blog post titled “Our Hearts Are Broken, but We Will Prevail,” describing the company as “horrified by the barbaric attack on Israel and the Israeli people,” expressing solidarity with Israeli employees, and confirming that a small percentage of the company’s team had been called to military reserve duty, with some employees volunteering ¹². A CyberArk communications specialist separately told The Record that “a few of CyberArk’s global team members were called up to support the military effort” and characterized the Israel-based workforce as accustomed to operating under pressure ². No public evidence identified of a comparable CyberArk corporate statement, blog post, or executive commentary specifically addressing Palestinian civilian casualties, the Gaza humanitarian situation, or the 2024 ICJ/ICC actions. No public evidence identified of CyberArk statements on Black Lives Matter/George Floyd (2020) or a geopolitically framed statement on the Russia-Ukraine war beyond generic technical cyber-threat advisory content. CyberArk’s SEC Form 20-F (FY2024) discloses geopolitical risk explicitly tied to “the conflicts between Israel and Hamas, as well as other hostile countries, such as Iran, and Ukraine and Russia,” framing these as contributors to a heightened cyber-threat environment and potential causes of IT/service disruption ³. CyberArk also markets its Beersheba R&D center’s proximity to the IDF’s C4I technology base and Ben-Gurion University as part of a “unique ecosystem of government agencies, academia, and industry,” framing the site as a strategic partnership rather than a standard commercial location decision ⁴⁵⁶⁷.

Operations in Occupied or Contested Territories

No public evidence identified of CyberArk offices, R&D facilities, sales operations, or subsidiary activity located within the West Bank, East Jerusalem, Golan Heights, or Gaza; CyberArk’s confirmed Israeli facilities are in Petah Tikva (headquarters) and Beersheba (Gav-Yam Negev Tech Park), both within the pre-1967 Green Line ⁴⁵⁷. CyberArk’s Beersheba R&D center sits inside the Gav-Yam Negev Tech Park/CyberSpark ecosystem, a joint venture of Israel’s Prime Minister’s Office (National Cyber Bureau), Ben-Gurion University, the Beersheba Municipality, and private cyber companies, situated adjacent to the IDF’s C4I technology base and launched by PM Netanyahu in 2014 as the “CyberSpark National Cyber Research Complex” ⁴⁷⁸. A self-published activist dossier (OpenIntel.uk) asserts a “Matrix IT reseller relationship” involving CyberArk, noting Matrix IT’s subsidiary in the Modi’in Illit settlement and its IMOD/IDF/police contracts, while itself caveating that this “does not constitute direct CyberArk contracts with Israeli defence end users” ⁹. The primary Who Profits company profile for Matrix IT confirms Matrix IT’s settlement subsidiary and defense-sector client list but contains no mention of CyberArk anywhere in the profile as a partner, client, or vendor, so this claimed nexus is unconfirmed by primary sourcing ¹⁰. CyberArk does not appear in the 2020 OHCHR database of business enterprises tied to settlement activity under HRC resolution 31/36 ¹¹¹². CyberArk is not named among the technology-sector entities identified in secondary reporting on UN Special Rapporteur Francesca Albanese’s July 2, 2025 report “From economy of occupation to economy of genocide,” which instead names Microsoft, Alphabet/Google, Amazon, HP, IBM, and Palantir ¹³¹⁴¹⁵. CyberArk is the subject of an active organized boycott listing that cites its Israeli headquarters/ownership, the CEO’s October 2023 statement, and the scale of the 2025 Palo Alto Networks acquisition as grounds for inclusion ¹⁶.

Internal Governance, Content & Retail Policies

No public evidence identified of CyberArk HR action, termination, discipline, or legal action against any employee for pro-Palestinian speech, symbols, or union activity. Israeli law generally requires employers to continue salaries during reserve duty with National Insurance Institute reimbursement, and no CyberArk-specific supplementary reservist-pay policy beyond the CEO’s general statement of support was located ¹². No public evidence identified regarding platform, app-store, or content-moderation policy, as CyberArk is a B2B identity-security/enterprise software vendor without a consumer content platform, and this category appears structurally inapplicable to its business model. No public evidence identified of CyberArk retail-labeling, product-origin, or settlement-sourcing controversies, consistent with its status as an enterprise software company without a physical retail/consumer supply chain. The University of Aberdeen signed a CyberArk contract effective January 30, 2024, and in November 2024 the university’s Palestine Solidarity Society publicly objected, citing that CyberArk’s Chief Information Officer had “publicly referenced 25 years of service in the IDF, including work in cybersecurity” and describing CyberArk as “an Israeli company with strong ties to the IDF” ¹⁷¹⁸. The university’s response pointed to a general “Citizen’s Assembly” review mechanism rather than addressing the CyberArk-specific allegations directly, and the dispute remained unresolved as documented ¹⁸. Glasgow Caledonian University signed a three-year, £1,436,210.32 multi-factor-authentication contract with CyberArk announced November 3, 2023, and GCU’s Palestine Solidarity Society and Students’ Association subsequently proposed ending the relationship, citing CyberArk’s Israeli ownership, IDF-veteran leadership, and the CEO’s October 2023 statement, describing the contract as “a shocking display of the university’s complicity with ongoing genocide of the Palestinian people” ¹⁹. Secondary reporting notes that GCU’s Student Association “has previously endorsed” boycott, divestment, and sanctions activity generally, though the final vote outcome on the CyberArk-specific proposal could not be confirmed ²⁰.

Brand Heritage & State Partnerships

CyberArk was co-founded in 1999 by Udi Mokady and Alon Cohen, drawing on Israeli military-intelligence backgrounds - Mokady from Unit 8200 (the IDF Military Intelligence Directorate’s signals-intelligence unit) and Cohen from IDF Mamram, the IDF’s central computing/cloud unit ²¹²². This military-intelligence pedigree is widely referenced in industry and press profiles of the company and its founders as part of a broader “Unit 8200 alumni” cybersecurity-industry narrative ²¹. Chief Trust Officer and former Global CIO Omer Grossman describes over 25 years of IDF service, including as Head of the IDF’s Cyber Defense Operations Center leading “joint and national cyber defense campaigns,” and separately as head of IDF Mamram ¹⁷²³. CyberArk’s Beersheba R&D center was inaugurated in 2021 within the government-backed CyberSpark/Gav-Yam Negev Tech Park ecosystem, a joint venture of the Israeli Prime Minister’s Office’s National Cyber Bureau, Ben-Gurion University, and the Beersheba Municipality ⁴⁵⁸. CyberArk is described in industry reporting as a member of the Israeli Cyber Companies Consortium (IC3), established in 2016 under Israel’s Ministry of Economy and led by state-owned defense prime Israel Aerospace Industries, alongside Check Point, Cognyte, and other Israeli cyber firms, though this membership claim originates from a self-published dossier and no CyberArk-specific primary confirmation was located ⁹²⁴²⁵. CyberArk is reported to have provided support to CyberWeek 2025, hosted by Tel Aviv University’s Blavatnik Interdisciplinary Cyber Research Center and the Israel National Cyber Directorate ²⁶. No public evidence identified of CyberArk hosting a head-of-state visit directly, as Israeli President Herzog’s March 2026 visit was to the Israel National Cyber Directorate generally rather than a CyberArk facility specifically ²⁷.

Lobbying, Advocacy, Financing & Logistics

No public evidence identified of CyberArk-specific U.S. federal lobbying registrations, PAC filings, or FEC records based on available search coverage of lobbying-disclosure resources. No public evidence identified of CyberArk involvement in anti-BDS legislative lobbying or corporate membership in advocacy bodies organized around anti-BDS pressure. No public evidence identified of CyberArk corporate donations to FIDF, JNF/KKL, Lev Echad, Israeli reservist funds, Regavim, Im Tirtzu, or settlement organizations. CyberArk’s disclosed crisis response in October 2023 was internal and operational rather than externally directed, with the company stating it would draw on its India R&D footprint to help cover Israeli staff called to reserve duty, per secondary sourcing of company statements in a boycott-campaign database ¹⁶. A self-published activist dossier states there is “no evidence of CyberArk holding direct contracts or formal participation agreements with Israeli government cloud initiatives, specifically Project Nimbus,” a negative finding consistent with the independent Who Profits profile of Project Nimbus-linked vendor Matrix IT, which likewise does not name CyberArk ⁹¹⁰.

Corporate Structure & Primary Mission

CyberArk Software Ltd. was an Israeli-incorporated, NASDAQ-listed public company following its September 2014 IPO, until its acquisition by Palo Alto Networks, Inc. ²⁸²⁹. On July 30, 2025, Palo Alto Networks announced a definitive agreement to acquire CyberArk in a cash-and-stock transaction valued at approximately $25 billion, described as the second-biggest exit in Israeli technology history; the deal closed with CyberArk shareholder approval, making CyberArk a wholly owned subsidiary of Palo Alto Networks ³⁰²⁸³¹. Major disclosed shareholders prior to the acquisition included asset managers BlackRock, FMR, Thomas Bravo, Invesco, and T. Rowe Price, while Jerusalem Venture Partners was CyberArk’s original lead venture investor, holding a board seat via Managing Partner Gadi Tirosh, a CyberArk board member since 2011 and Lead Independent Director from 2016 ³²³³. No public evidence identified of an Israeli-government “golden share,” special veto share, or other state-held controlling instrument in CyberArk’s capital structure; CyberArk’s governance documents describe a standard one-share-one-vote structure ³⁴. No public evidence identified that CyberArk’s corporate charter or founding documents explicitly tie its primary mission to advancing Israeli state geopolitical goals, as its stated mission is commercial identity-security and cybersecurity software, though its founders’ IDF Unit 8200/Mamram backgrounds and continued operational embedding within Israeli state-linked innovation infrastructure are documented structural facts distinct from its legal corporate mandate ²¹⁴²².

Executive & Leadership Footprint

No public evidence identified of a Udi Mokady family foundation, personal FIDF/JNF donations, or IRS Form 990 filings under his name. Udi Mokady, CyberArk’s founder and CEO from 2005 to 2023 and Executive Chairman from 2023, is listed as an Israeli-American Council (IAC) Council Member for the New England region, and also holds an advisory role with the Monetary Authority of Singapore’s Cyber Security Advisory Panel, a Brandeis International Business School board-of-advisors seat, and a Catalyst Advisor position at General Catalyst, none of which are Israel/Palestine-advocacy-specific ³⁵. CEO Matt Cohen, who has led CyberArk since April 2023, authored the October 13, 2023 solidarity statement discussed above ¹⁹. Gadi Tirosh, CyberArk’s Lead Independent Director, is Managing Partner of Jerusalem Venture Partners, an Israeli venture capital fund with a cybersecurity investment focus, with no evidence found of a settlement-organization or explicit pro-Israel-advocacy board affiliation beyond his venture-capital role ³². Board member François Auque, on the board since February 2019, is a former Airbus Group executive; No public evidence identified of an Israel/Palestine-advocacy affiliation for him or of other named CyberArk board members holding seats in advocacy or settlement-linked organizations. Omer Grossman, Chief Trust Officer and formerly Global CIO (appointed December 2022), with over 25 years of IDF service including as Head of the IDF Cyber Defense Operations Center and head of IDF Mamram, is the executive most directly and explicitly cited by outside campaigners, including the University of Aberdeen Palestine Solidarity Society, as evidence of CyberArk’s institutional IDF ties ¹⁷²³¹⁸. Co-founder Alon Cohen served in IDF Mamram prior to co-founding CyberArk in 1999 ²¹. Following the 2025 acquisition, CyberArk’s controlling parent is Palo Alto Networks, Inc., founded in 2005 by Nir Zuk, an Israeli native who served as head of software development in IDF Unit 8200 through 1994 before founding the company and who stepped down from his CTO/board roles in August 2025 ²¹³⁶. Post-acquisition, Palo Alto Networks CEO Nikesh Arora publicly stated the firm remains “still committed to investing in Israel, even after US-Israeli founder left,” citing plans to double the Israel-based workforce via the CyberArk deal and prior wartime acquisitions of Israeli startups Talon Cyber Security and Dig for a combined $1 billion announced during the war in late 2023, and stating: “I firmly believe that the most amount of innovation in cybersecurity comes out of Israel. It’s not for debate; it’s a fact” ³⁶.

End Notes