Palo Alto Networks

Key Findings

• Economic: Palo Alto Networks maintains a substantial Israeli R&D and operating presence, which its FY2026 filing says expanded materially through the February 2026 acquisition of CyberArk. The company reported $222 million of long-lived assets in Israel at 31 July 2026 and states that it intends to continue growing its presence there.^{1, 2, 3}
• Digital: Palo Alto Networks operates Israel-region cybersecurity infrastructure. Customers selecting relevant Israel regions can have security traffic, logs or telemetry processed or stored in Israel; the documentation also shows that processing is service-specific and does not establish that all customer data is routed to Israel.^{4, 5, 6}
• Political: From 2023 through 2026 the company repeatedly described Israel as an important cybersecurity, R&D and investment market while continuing acquisitions and expansion there. The reviewed audit found no corporate statement taking a position on Palestinian civilian harm, settlements, a ceasefire or Palestinian statehood.^{7, 8, 9}
• Not found: The audits identified no current named direct contract with the IDF or Israeli Ministry of Defense, no verified Project Nimbus role, no purpose-built kinetic weapons system, and no verified Palo Alto Networks facility or operation in an Israeli settlement.^{1, 10, 11}

Target Profile

Key Facts:

• The Israel R&D centre is described by Palo Alto Networks as its largest outside Silicon Valley.²
• The FY2026 subsidiary list includes Palo Alto Networks Ltd. and Palo Alto Networks Israel Holdings Ltd.¹⁵
• Palo Alto Networks completed its acquisition of CyberArk on 11 February 2026.³
• Long-lived assets in Israel were reported at $222 million at 31 July 2026, compared with $162 million a year earlier.¹
• The audits did not identify a verified Palo Alto Networks office, manufacturing site or acquired-company facility in the West Bank, East Jerusalem or Golan Heights.^{1, 10}

Executive Summary

Palo Alto Networks is a U.S.-incorporated global cybersecurity company with a substantial and continuing commercial, engineering and investment presence in Israel. Its current Israeli footprint includes R&D, sales, corporate subsidiaries and cloud-service infrastructure. The company describes its Israeli R&D centre as its largest outside Silicon Valley, while its FY2026 Form 10-K says its Israeli operations expanded materially through the CyberArk acquisition and that it intends to continue growing its presence there.^{1, 2} The same filing reports $222 million of long-lived assets in Israel at the end of FY2026.¹

The strongest documented nexus is economic. Palo Alto Networks has repeatedly acquired Israeli cybersecurity companies or technology teams, including Cyvera, LightCyber, Bridgecrew, Cider Security, Dig Security, Talon Cyber Security, CyberArk and Koi Security.^{3, 16, 17, 18, 19, 20} CyberArk became part of the group in February 2026, and Palo Alto Networks said the transaction further strengthened its Israeli R&D centre.³ These investments are accompanied by continuing direct operations in Tel Aviv and current Israeli subsidiaries.^{10, 15}

The digital record is also substantial but bounded. Palo Alto Networks operates Israel-designated regions for services including Prisma Access and Strata Logging Service, and it introduced a Tel Aviv service region for Advanced Threat Prevention in April 2025.^{4, 5, 6} Customers selecting relevant Israel regions can have security logs, telemetry or traffic processed or stored there. The company’s documentation simultaneously shows a mixed regional architecture: some service components associated with an Israel region may be processed elsewhere, and the audits did not establish that customers outside the relevant selected regions are automatically routed through Israel.^{4, 5} Nor did the audits identify a verified Project Nimbus contract or a current direct IDF or Ministry of Defense deployment.

Historically, there is documented Israeli public-sector cybersecurity procurement involving LightCyber technology. A 2017 Ministry of Justice maintenance engagement occurred after Palo Alto Networks acquired LightCyber, while an Israel Prison Service supplier record attributes an anomaly-detection procurement aggregate to the entity now displayed as Palo Alto Networks (Israel Analytics). The date of the underlying Prison Service award was not established, so whether Palo Alto Networks controlled the supplier at the time remains unresolved.^{21, 22, 16} These records concern cybersecurity software rather than weapons, kinetic targeting or military logistics.

Politically, the audits document repeated corporate communications portraying Israel as an important cybersecurity innovation, R&D and investment market, including continued acquisitions during and after 2023.^{7, 8, 9} They also document a more interventionist corporate response to the Russia-Ukraine war, including a dedicated cyber resource centre and management’s statement that new sales in Russia had been halted.^{23, 24} The reviewed material did not identify an equivalent Palo Alto Networks statement on Palestinian civilian harm, settlements, a ceasefire or Palestinian statehood. This is a documentary comparison of corporate conduct; it does not establish a motive for the difference.

Timeline of Relevant Events

Corporate Overview

Palo Alto Networks, Inc. is a Delaware corporation headquartered in Santa Clara, California. Its parent company is U.S.-incorporated rather than Israeli, and the audits identified no Israeli state ownership, government-appointed director or golden-share mechanism.^{1, 12}

Its Israeli presence is nevertheless structurally significant. The FY2026 subsidiary exhibit lists Palo Alto Networks Ltd. and Palo Alto Networks Israel Holdings Ltd. as Israeli entities.¹⁵ The company operates R&D, support and sales functions in Tel Aviv, with first-party materials describing work on products including Cortex XSIAM, endpoint security and behavioural analytics.^{2, 10}

Acquisitions have been a central mechanism for expanding this footprint. Cyvera and LightCyber entered the group before 2020; Bridgecrew, Cider Security, Dig Security and Talon Cyber Security followed; CyberArk joined in February 2026; and Koi Security was acquired in April 2026.^{3, 16, 17, 18, 19, 20, 25, 29} Palo Alto Networks says CyberArk materially enlarged its Israeli operation.^{1, 3}

The audits found no verified Palo Alto Networks operating facility, manufacturing location, acquired-company facility or investment specifically situated in an Israeli settlement in the occupied West Bank, East Jerusalem or Golan Heights.^{1, 10} Israeli incorporation, a Tel Aviv office or an Israeli acquisition was not treated as evidence of settlement activity.

Domain Summaries

Military: Military

Mechanism of Involvement

The military audit did not identify a qualifying current physical military-supply relationship. Palo Alto Networks’ reviewed products are enterprise cybersecurity technologies rather than purpose-built weapons, targeting systems, guidance systems, fire-control systems or kinetic platforms.^{1, 2}

There is documented historical Israeli public-sector and security-body cybersecurity procurement. A Ministry of Justice LightCyber procurement in 2016 occurred before Palo Alto Networks acquired LightCyber and therefore was not attributed to Palo Alto Networks at award date.^{30, 31, 16} A later Ministry of Justice maintenance engagement, beginning in November 2017 and ending in August 2019, occurred after the acquisition and was attributed to the Palo Alto group.²¹

Open Budget also records ₪904,563 of Israel Prison Service procurement associated with an anomaly-detection system under the supplier identity now displayed as Palo Alto Networks (Israel Analytics). The underlying award date was not verified, preventing a firm conclusion on whether the transaction occurred before or after Palo Alto Networks acquired LightCyber.²²

A March 2026 announcement by Accel Solutions Group stated that its Danet Communications subsidiary had won a large network-security tender in partnership with Palo Alto Networks for the critical network infrastructure of an unnamed major Israeli customer. Because the customer was not identified, the audits did not infer a military or security-force end user.³²

Counter-Arguments and Evidence Limits

The strongest counter-evidence is the absence of a documented current named contract directly between Palo Alto Networks and the IDF or Israeli Ministry of Defense in the reviewed record. The audits also found no verified purpose-built military product, weapons-development programme, military logistics service, supply relationship with a named Israeli defence prime, or kinetic targeting system.

The 2016 LightCyber Ministry of Justice procurement predated Palo Alto Networks’ ownership of LightCyber. The Israel Prison Service record has an unresolved award date. The 2026 critical-infrastructure tender does not name the customer. These distinctions prevent historical or ambiguous cybersecurity procurement from being converted into a claim of current military contracting.

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

Palo Alto Networks directly operates Israel-region cybersecurity infrastructure. Prisma Access documentation lists Israel locations and allows customers to select compute locations according to user and data-location requirements.^{4, 26} Strata Logging Service documentation states that the region selected at activation determines the physical location in which log data is stored and lists an Israel-Tel Aviv region.⁵

The service architecture is not uniform. Palo Alto Networks’ processing-location documentation shows that some data associated with an Israel logging region is processed in Israel while other service components are processed in Germany or elsewhere in the EU.⁴ The audits therefore establish customer-selectable Israeli data processing and storage, rather than universal transfer of Palo Alto Networks customer data to Israel.

In April 2025, the company added a Tel Aviv service region for Advanced Threat Prevention inline cloud-analysis requests, citing data-residency and performance considerations.⁶ Israel endpoints also exist across other cloud-delivered security functions described in the audits.

The digital audit additionally identified historical state-sector cybersecurity provision through LightCyber and a civilian commercial relationship with EL AL, which uses Cortex XDR and Unit 42 services.³³

Counter-Arguments and Evidence Limits

No public evidence was identified of Palo Alto Networks being a named prime contractor or subcontractor for Project Nimbus. No verified direct contract with the IDF, Ministry of Defense or an Israeli intelligence agency was identified in the retained digital evidence.

The Israel-region architecture is customer-selectable and service-specific. The evidence does not show that customers outside the selected Israel regions are automatically routed through Israel or that every dataset is accessible from Israel.

Who Profits lists Palo Alto Networks as a technology partner of Malam Team and separately lists Israeli defence companies among Malam Team clients.¹¹ The source does not connect a Palo Alto Networks product to any particular defence customer, so the audits treated this as channel proximity rather than proof of a defence deployment.

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

Economic integration is the clearest documented Israel nexus. Palo Alto Networks operates a major Israeli R&D centre, maintains Israeli subsidiaries and has repeatedly acquired Israeli cybersecurity companies and teams.^{1, 2, 15}

The CyberArk transaction materially increased that exposure. Palo Alto Networks completed the acquisition in February 2026, and its FY2026 filing records $21.1 billion of accounting purchase consideration.^{1, 3} The company says its Israeli operations expanded meaningfully as a result and that it intends to continue growing its presence there.¹

The FY2026 filing reports $222 million of long-lived assets in Israel at 31 July 2026, up from $162 million one year earlier.¹ The company’s Israeli R&D operation is described as its largest outside Silicon Valley.²

This current footprint follows earlier acquisitions including Cyvera, LightCyber, Bridgecrew, Cider Security, Dig Security, Talon Cyber Security and Koi Security.^{16, 17, 18, 19, 20, 25, 29}

Counter-Arguments and Evidence Limits

The audits found no verified Palo Alto Networks office, acquired-company facility, manufacturing site or sourcing relationship specifically located in an Israeli settlement in the West Bank, East Jerusalem or Golan Heights.^{1, 10}

The company does not separately disclose Israel revenue in its FY2026 filing, and no precise consolidated Israel headcount was identified in the reviewed public material.^{1, 2} Global R&D expenditure likewise cannot be treated as Israel-specific expenditure without additional evidence.

The audits also found no public evidence of Palo Alto Networks underwriting Israeli sovereign debt, running Israel Bonds activity, extending settlement-specific finance or having an Israeli state ownership interest.

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

The political audit documents repeated company communications from 2023 through 2026 presenting Israel as a strategic cybersecurity, R&D and investment market. After 7 October 2023, Palo Alto Networks continued its acquisition strategy in Israel. Its Dig Security announcement described a longstanding commitment to its Israel team and continued growth of its footprint, while the Talon announcement described confidence in the Israeli cybersecurity ecosystem.^{7, 8}

The company subsequently agreed to acquire CyberArk in July 2025 and completed the transaction in February 2026.^{3, 28} CEO Nikesh Arora also publicly described Israel as a major source of cybersecurity innovation during a December 2025 visit.⁹

The audit compared this posture with Palo Alto Networks’ public Russia-Ukraine response. The company maintained a dedicated Russia-Ukraine cyber resource centre and management stated in 2022 that new sales in Russia had been halted while the company complied with sanctions.^{23, 24} No comparable corporate statement addressing Palestinian civilian harm, settlements, a ceasefire, Israeli military conduct or Palestinian statehood was identified in the reviewed material.

The audit also documents federal lobbying on cybersecurity, defence, intelligence and federal procurement subjects. The reviewed lobbying descriptions did not identify Israel, Palestine, Gaza, BDS, settlements or U.S. aid to Israel as lobbying subjects.

Counter-Arguments and Evidence Limits

Continued investment in Israel and positive statements about Israel’s cybersecurity sector do not by themselves establish endorsement of Israeli government or military policy. The audited statements largely concern employees, acquisitions, R&D and technology markets.

No public evidence was identified of a Palo Alto Networks corporate donation to the IDF, FIDF, JNF/KKL, a settlement council, an Israeli reservist fund or a comparable military-welfare or settlement organization. The company’s general employee charitable-matching programme does not establish that any such organisation received corporate funds.

No verified settlement-specific office or operation was identified, and no target-specific settlement-related court case, sanctions action or regulatory proceeding against Palo Alto Networks was found in the reviewed record.

Founder Nir Zuk’s personal status also requires care. He resigned as CTO and director in August 2025 while remaining within a disclosed expected advisory period through 2 November 2026.¹⁴ Personal conduct after his resignation cannot automatically be treated as a corporate act.

Named Entities and Evidence Map

BDS-1000 Score

Method: V6.5.

BRS Score: 663 - Tier B (Severe Complicity under the BDS-1000 rubric).

V_MAX = 7.40; Avg_OTHERS = 2.7533. Domain values use V = I × min(M/7,1) × min(P/7,1); BRS = ((V_MAX + 0.2 × Avg_OTHERS)/12) × 1000, rounded to the nearest integer. These are the final examiner-adjudicated and reviewed values.

The evidence record identifies Economic as the most extensive documented nexus because of the scale, continuity and direct ownership of Israeli R&D, subsidiaries and acquired companies. Digital reflects directly operated Israel-region cybersecurity services with bounded customer-selected data exposure; Political reflects documented corporate communications and comparative public posture; Military contains historical cybersecurity procurement but no qualifying current military-supply frame.

The methodology is evidence-only and scale-free: activity type determines Impact, the documented scale and continuity determine Magnitude, and directness of the company’s relationship determines Proximity. Historical, divested, pre-acquisition and unresolved relationships are qualified rather than automatically attributed to the current group.

Methodology Note

• Evidence-only: Findings in this dossier are limited to facts and searched absences recorded in the four supplied domain audits. Allegations that were unverified, wrongly attributed or unresolved are excluded or explicitly qualified.
• Scale-free criteria: Impact concerns the type of documented activity; Magnitude concerns its scale and continuity; Proximity concerns how directly the activity is attributable to Palo Alto Networks.
• Temporal treatment: Pre-acquisition, divested or exited operations are distinguished from current activity. The 2016 LightCyber procurement, for example, predates Palo Alto Networks’ ownership and is not attributed to the company at award date.
• Entity attribution: Relationships are not transferred transitively. A channel partner’s relationship with a defence company does not establish that Palo Alto Networks supplied that defence company without evidence connecting the product, customer and deployment.
• Settlement treatment: A verified settlement operation may be relevant to both economic and political analysis under the supplied methodology. No verified Palo Alto Networks settlement operation was identified in these audits.
• Searched absences: “No public evidence identified” means the bounded research described in the audits did not find qualifying public evidence. It is not a categorical claim that no undiscovered evidence exists.