KPMG DIGITAL

Request: 6c6313ed-0dd2-429b-b444-f810adbb3bfa Evidence cut-off: 13 October 2026

Scope and entity attribution

KPMG is a global organization of legally separate member firms. KPMG International Limited is an English private company limited by guarantee that coordinates the organization but does not provide professional services to clients; member firms are locally owned/managed legal entities responsible for their own obligations and cannot bind one another.¹ Accordingly, Israel-specific findings below are attributed to KPMG Israel/Somekh Chaikin where the source supports that attribution. Evidence from KPMG LLP in the United States, KPMG LLP in the United Kingdom, KPMG in India, or global alliance material is identified separately and is not treated as proof of procurement, deployment or acquisition by KPMG Israel.¹

KPMG Israel currently describes itself as having about 1,700 multidisciplinary professionals.² A 2025 profile of KPMG Israel partner Ido Ron reported that roughly 300 of the firm’s then approximately 1,800 personnel were technology staff and that Ron led about 100 people across three technology divisions.³

Enterprise Technology Stack & Vendor Relationships

Israeli-origin software and services

KPMG’s wider network has several verified relationships with vendors in the packet’s Israeli-origin/Israel-linked search set, but the public record reviewed does not establish that these products form KPMG Israel’s own internal enterprise stack.

KPMG LLP in the United States currently markets a CyberArk alliance for privileged-account security and states that the parties have worked together on more than 50 client projects across multiple regions.⁴ The relationship is a client-services and implementation alliance; the page does not establish an internal CyberArk licence held by Somekh Chaikin.⁴

SentinelOne announced in January 2022 that KPMG LLP’s U.S. Cyber Response Services team would use the Singularity XDR platform for incident response and compromise assessments across its customer portfolio.⁵ In January 2023 SentinelOne announced a formal alliance with KPMG LLP for cyber investigations, incident response and preventive services.⁶ These sources establish a U.S.-member-firm service relationship and do not identify KPMG Israel as the procuring entity.^{5, 6}

Current KPMG-Google Cloud alliance material states that KPMG zero-trust, managed-detection-and-response and Secure AI offerings use or can be built around Wiz Cloud, Wiz Code and Wiz Defend alongside Google security products.⁷ The material is presented as KPMG-Google Cloud alliance content and does not identify Somekh Chaikin as the contracting entity or an Israeli government customer.⁷

KPMG in India records Palo Alto Networks recognition as Prisma Cloud Partner of the Year FY24 and Service Partner of the Year 2023.⁸ This is evidence of the Indian member firm’s relationship; no public evidence identified that the relationship is an internal KPMG Israel licence or an Israeli-state deployment.⁸

KPMG’s global alliances page currently lists both CyberArk and Palantir Technologies among its technology ecosystem relationships.⁹ Separately, the UK Government Digital Marketplace lists KPMG LLP services to design, implement, migrate, train and provide managed services for Palantir Foundry and AIP.¹⁰ A/HRC/59/23 discusses Palantir’s own Israeli military relationship, but no reviewed source links KPMG’s Palantir services to the Israeli state, IDF or occupied territories.^{11, 10}

For Check Point, NICE, Verint and Claroty, no public evidence identified in the reviewed current sources of a KPMG Israel licensing, subscription, integration or customer-delivery relationship.

Scale of dependency

The strongest evidence concerns technology used in KPMG member-firm client services rather than a KPMG-wide internal dependency. CyberArk is embedded in a multi-region privileged-access consulting alliance with more than 50 cited projects; SentinelOne is incorporated into KPMG LLP cyber-response workflows; and Wiz products are named components of KPMG-Google Cloud zero-trust, MDR and Secure AI offerings.^{4, 5, 7} None of the reviewed sources establishes that one of these vendors is KPMG Israel’s primary endpoint, identity, network-security or cloud-security platform.

Procurement and integrator relationships

KPMG Israel states that it delivers services to Israeli government offices through framework tenders across technology and innovation, automation/digitization, cloud infrastructure and information security/cybersecurity.¹² Its technology arm also describes cloud strategy, cloud infrastructure and landing zones, Cloud Centers of Excellence, FinOps, migration and modernization as core offerings.¹³

In July 2023, KPMG Israel said its technology arm, KPMG Edge/Technology Consulting, had been named Microsoft’s Partner of the Year in Israel and described significant joint activity in data, AI, cloud and cyber.¹⁴ This verifies a substantial KPMG Israel-Microsoft integration relationship, but the reviewed public material does not establish that Microsoft mandated or deployed a specific Israeli-origin security vendor through KPMG.¹⁴

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics

KPMG Israel currently advertises AI capabilities that include Face Recognition, Image Recognition, speech-to-text/text-to-speech and Video Analytics, offered for integration into client applications or end-to-end solutions.¹⁵ This verifies that the Israeli member firm offers biometric/computer-vision capabilities commercially. The page does not identify a police, military, intelligence, checkpoint or settlement customer.¹⁵

No public evidence identified that KPMG Israel has deployed Trigo, BriefCam, AnyVision/Oosto, Trax or another named Israeli-origin facial-recognition/retail-analytics product for its own operations or for an Israeli state/security customer.

Predictive analytics and monitoring

A March 2025 Globes profile quoted KPMG Israel partner Ido Ron saying that, after 7 October, his technology department worked on significant projects with the Ministry of Defense and the army and that its technology was also used on the battlefield for image analysis, video analysis and text analysis; the details were not disclosed.³ The source does not identify predictive policing, sentiment analysis, social-media monitoring, gait analysis, facial recognition or workforce surveillance in those military projects.³

Accordingly, for predictive policing, sentiment analysis, social-media monitoring and workforce surveillance supplied by KPMG to Israeli state bodies, no public evidence identified.

Third-party deployment

KPMG’s broader technology ecosystem includes CyberArk, SentinelOne, Wiz and Palantir relationships, while KPMG Israel has a substantial Microsoft partnership.^{14, 4, 5, 7, 9} no public evidence identified that a surveillance or biometric capability reached an Israeli state or settlement customer indirectly through one of these alliances on KPMG’s behalf.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data-centre operations in Israel

KPMG Israel markets cloud architecture, landing-zone, CCoE and migration services, but no public evidence identified that KPMG itself owns, operates, leases or co-locates a hyperscale data centre in Israel.¹³ The verified role is consulting, architecture, governance, migration and implementation rather than ownership of the underlying public-cloud region.^{13, 16}

Government cloud contracts and Project Nimbus

KPMG’s own Government of Israel client story states that the Government of Israel was moving from on-premises systems to Google Cloud and that KPMG helped design and build a provisional secure cloud foundation capable of supporting pilot workloads and future ministry migration.¹⁶ KPMG says it assembled specialists from four member firms - the United States, Germany, Israel and India - and delivered the minimum viable cloud foundation in 11 weeks.¹⁶

The same KPMG account states that the work included governance, networking and security design; a library of more than 100 Google Cloud security controls aligned to Israeli government requirements; single sign-on and multi-factor authentication; resource hierarchy and centralized billing; role-based privileged access; network topology; and infrastructure-as-code/policy-as-code for continued deployment.¹⁶ These are direct technology-provision and implementation activities for the Government of Israel, although the public page does not allocate each task to a particular KPMG member firm.¹⁶

AFSC Investigate’s current Alphabet profile independently states that, in a separate Nimbus tender, Israel contracted Somekh Chaikin-KPMG to establish a government cloud-migration strategy.¹⁷ This civil-society source is consistent with KPMG Israel’s own government/cloud offerings and KPMG’s Government of Israel cloud client story.^{12, 13, 16, 17}

The evidence therefore supports a KPMG/Somekh Chaikin role in the Government of Israel’s cloud-governance, migration and cloud-foundation programme associated with Nimbus.^{16, 17} It does not make KPMG the Nimbus hyperscale cloud provider: A/HRC/59/23 identifies Alphabet/Google and Amazon as the 2021 Nimbus core-infrastructure awardees and separately discusses Microsoft cloud use.¹¹

Data sovereignty, resilience and exposure

KPMG’s Government of Israel client story describes security and governance controls for ministry cloud workloads and a foundation intended to support future migration across government ministries.¹⁶ KPMG Israel separately markets secure cloud landing zones, CCoE, migration, multi/hybrid-cloud architecture and infrastructure/policy as code.¹³ These sources establish cloud-governance and resilience capabilities; no public evidence identified that KPMG itself operates the sovereign cloud infrastructure or controls the underlying Israeli cloud regions.

A/HRC/59/23 states that Microsoft, Alphabet and Amazon provide Israel broad cloud/AI capabilities and discusses Israel-located servers and data-sovereignty features in the wider state cloud environment.¹¹ The report does not name KPMG or Somekh Chaikin in that discussion. Conduct attributed to those cloud providers is therefore not attributed to KPMG here.¹¹

KPMG Somekh Chaikin’s April 2026 privacy notice says the Israeli partnership processes website-visitor personal data under Israeli privacy law; shares some information with other KPMG member firms and KPMG International for international engagements and compliance purposes; uses other parts of the KPMG network for functions including IT application hosting/support, conflicts checks and engagement services; and may transfer relevant personal data within and outside Israel.¹⁸ This verifies an Israel-connected data-processing and international-transfer pathway for the categories covered by that privacy notice.¹⁸ The notice does not establish where all KPMG client-engagement data is stored or routed, so no public evidence identified for a general claim that all KPMG client data is resident in Israel or exposed to Israeli-controlled infrastructure.

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts

The clearest direct evidence is KPMG Israel’s own technology leadership. In March 2025, Ido Ron told Globes that after 7 October his department shifted focus toward significant assistance projects with the Ministry of Defense, the army, hospitals and health funds.³ He described one Ministry of Defense project, mostly classified, that sought to streamline medical-committee processes.³ He also said the department’s technology was used on the battlefield for military needs involving image, video and text analysis, while saying further details could not be disclosed.³

In 2026 KPMG Israel stated that its Cyber Advisory team had supported Israel Aerospace Industries through CMMC Level 2 readiness, gap analysis and the official assessment process; IAI achieved the certification at the end of 2025, and KPMG Israel said it was currently supporting IAI’s annual affirmation.¹⁹ The post characterizes KPMG’s relevant expertise as spanning defence, cyber and cloud consulting.¹⁹ This is a continuing post-2024 defence-sector technology relationship.¹⁹

For a direct KPMG technology contract with Mossad, Shin Bet or another named Israeli intelligence agency, no public evidence identified.

Dual-use technology provision

The battlefield image/video/text-analysis work is verified as technology supplied by KPMG Israel’s department to meet army needs, but the public description is too general to determine the software, algorithm, data source or operational decision produced.³ It is therefore documented here as general-purpose/dual-use analysis capability. The source does not establish autonomous targeting, fire control or a purpose-built kill-chain system.³

KPMG Israel’s CMMC work for IAI is cyber-readiness/compliance support for a major defence company and is not evidence of weapons development.¹⁹

Offensive cyber and weapons technology

No public evidence identified that KPMG develops, sells, licenses or maintains zero-day exploit tools, offensive spyware or digital weapons for Israeli state actors. The reviewed military evidence concerns analytics, cloud/cyber consulting and defence-sector cybersecurity compliance.^{3, 19}

The verified 2025-2026 Ministry of Defense/army and IAI relationships occurred after the July 2024 and November 2024 legal milestones specified in the audit methodology; the sources establish continuation in time but do not by themselves establish legal knowledge, intent or liability.^{3, 19}

AI, Algorithmic & Autonomous Systems

AI/ML provision to state bodies

KPMG Israel currently markets face recognition, image recognition, voice technology, smart search, video analytics and generative-AI implementation.¹⁵ Moran Ben Gigi, head of KPMG Technology Consulting in Israel, states that he founded KPMG Israel organizations covering AI, digital, cloud and data and an R&D organization that builds AI products for multiple industries.²⁰

The Globes evidence shows that KPMG Israel’s technology organization provided battlefield image, video and text analysis for army needs and worked on a mostly classified Ministry of Defense medical-committee project.³ It does not specify which advertised KPMG AI products, if any, were used in those engagements.^{15, 3} No inference is made from the firm’s general AI catalogue to the military projects.

Training data and model development

No public evidence identified that a KPMG AI model was trained on Palestinian civilian data, intercepted communications, biometric records or surveillance-derived datasets from Israel or the occupied territories.

Autonomous systems and lethality

A/HRC/59/23 discusses Israeli military target-generation systems and Palantir’s relationship with Israel, but it does not attribute those systems to KPMG.¹¹ The KPMG-specific battlefield evidence is limited to image, video and text analysis.³ no public evidence identified that KPMG supplied autonomous target generation, fire-control AI, automated kill-chain software or autonomous lethal/tracking systems to Israeli forces.

Technology Ecosystem & R&D Footprint

Israeli R&D centres and technology organization

Moran Ben Gigi’s KPMG Israel biography says he founded the member firm’s advanced-technology organizations in AI, digital, cloud and data and also founded its R&D organization, which builds AI products for different industries.²⁰ Globes reported in 2025 that approximately 300 KPMG Israel staff were technology professionals and that Ido Ron managed about 100 staff across three technology divisions.³ This establishes a substantial Israeli technology/R&D footprint inside the member firm.^{20, 3}

KPMG Israel’s current technology pages show active AI, cloud and cyber engineering/implementation offerings, including face/image/video analytics, cloud landing zones, infrastructure as code and penetration/cybersecurity work.^{15, 13, 21}

Acquisitions and investments

In August 2025, Calcalist/Ctech reported that KPMG was acquiring the operations of Israeli technology company Q.V. Technologies, which develops AI-integrated solutions for SAP-based corporate systems, and that Q.V.’s services would be incorporated into KPMG’s offerings.²² The Jerusalem Post independently described the transaction as KPMG acquiring Q.V. Technologies and quoted KPMG Israel managing partner Eran Shalev describing the deal as part of the firm’s innovation strategy.²³ Q.V. founder Ronen Argov wrote on 14 August 2025 that Q.V. Technologies had “joined KPMG Israel.”²⁴

The integration is visible in KPMG Israel’s current Technology Consulting site, where “QV Technologies” is now listed as an offering covering end-to-end SAP consulting and implementation, AI and data intelligence, governance/risk/cyber and financial/business transformation.²⁵ The public evidence therefore establishes a 2025 acquisition/integration of Q.V.’s technology operations into KPMG Israel’s technology practice and continuing operational integration.^{22, 24, 25}

The reviewed public documents do not resolve the legal mechanics of the transaction. Calcalist specifically says KPMG was acquiring Q.V.’s “operations,” while the Jerusalem Post uses broader company-acquisition language; neither reviewed report provides a purchase agreement, share-transfer percentage or legal-buyer filing.^{22, 23} Accordingly, this audit does not characterize Q.V. Technologies Ltd as a subsidiary of KPMG International Limited, does not attribute the transaction to KPMG International as legal parent/buyer, and does not infer full equity ownership.^{1, 22, 23}

Apart from the verified Q.V. operational acquisition/integration, no public evidence identified in the reviewed sources of another KPMG Israel strategic equity acquisition of an Israeli cyber, surveillance, AI or military-technology company. The verified Microsoft, CyberArk, SentinelOne, Wiz, Palo Alto Networks and Palantir relationships are partnerships, alliances or client-delivery arrangements rather than evidence of equity ownership.^{14, 4, 5, 6, 8, 7, 9, 10}

Gad Somekh is the chairman of KPMG Israel.²⁶ Focused public searches on Somekh and the identified KPMG Israel technology leaders did not identify a disclosed personal equity stake in NSO Group, Cellebrite, Carbyne, Oosto/AnyVision, Wiz, Check Point, SentinelOne, Verint, NICE or another named Israeli surveillance/military-tech company. No public evidence identified of such controlling-principal investments; this is limited to public evidence and does not address non-public holdings.^{20, 3, 26}

Patents and intellectual property

No public evidence identified of a significant KPMG patent portfolio, patent co-ownership, IP-licensing agreement or formal technology co-development arrangement with Technion, Hebrew University or the Weizmann Institute. The reviewed public material identifies KPMG’s own Israeli R&D organization but does not identify such university IP arrangements.²⁰

Civil Society Scrutiny & Regulatory History

NGO, UN and academic scrutiny

The September 2025 OHCHR settlement-business database update, A/HRC/60/19, says 158 enterprises were listed after review under the Human Rights Council’s specified settlement-related activities.²⁷ Targeted exact-name searches of the report did not identify KPMG or Somekh Chaikin. The database is limited to specified activities and reviewed enterprises, so this search result is not treated as proof that no settlement nexus exists outside its scope.²⁷

A/HRC/59/23 discusses Project Nimbus, Microsoft, Alphabet/Amazon, surveillance/AI and Palantir in its technology section.¹¹ Targeted exact-name searches did not identify KPMG or Somekh Chaikin in that report. The separate KPMG Nimbus/CCoE evidence therefore comes from KPMG’s own client material and AFSC’s target-specific description, not from the Special Rapporteur report.^{16, 17, 11}

AFSC Investigate states both that the World Zionist Organization Settlement Division is a Nimbus user and that, in a separate tender, Somekh Chaikin-KPMG was contracted to establish a government cloud-migration strategy.¹⁷ These facts establish a programme-level nexus: KPMG had a government-wide Nimbus migration/governance role, while the Settlement Division was among Nimbus users according to AFSC.¹⁷ no public evidence identified in the reviewed sources of a direct KPMG contract with the Settlement Division or a KPMG deployment at a specific settlement.¹⁷

At the Human Rights Council’s 29 September 2026 meeting, an automatically generated UN transcript records CIVICUS stating that Israeli procurement documents list the Settlement Division among entities required to use Nimbus and calling for further scrutiny of cloud and AI services.²⁸ The transcript itself warns that it is an automatic transcription and not an official UN record, so this is recorded as a CIVICUS statement rather than an OHCHR factual finding.²⁸

Boycott and divestment campaigns

The reviewed Nimbus civil-society material documents campaigns directed at Google and Amazon, including employee opposition to Project Nimbus.¹⁷ no public evidence identified of an organized boycott, divestment or sanctions campaign specifically targeting KPMG because of its technology provision to Israel. Campaigns aimed at other Nimbus participants are not transferred to KPMG.¹⁷

Regulatory and legal actions

No public evidence identified of a regulatory inquiry, export-control case, sanctions proceeding or legal action specifically concerning KPMG technology sales or technology services to Israeli state, military or settlement entities. The reviewed evidence establishes government-cloud and defence-sector technology services, but not a technology-sale enforcement proceeding.^{16, 3, 19}