Palo Alto Networks DIGITAL

Target: Palo Alto Networks Audit phase: Digital Research date: 1 October 2026

Enterprise Technology Stack & Vendor Relationships

Palo Alto Networks is itself a cybersecurity-platform vendor with a substantial Israeli engineering and commercial footprint. Its current Israel careers page describes the Israel R&D center as the company’s largest outside Silicon Valley and says teams there develop major next-generation products including the Cortex XSIAM security-operations platform.¹ The company’s locations page separately identifies a Tel Aviv office supporting R&D, endpoint security, behavioral analytics, customer support and sales.²

The Israeli technology relationship is therefore principally one of owned R&D, acquired technology and direct product development rather than an identified dependence on an outside Israeli security vendor. The company acquired Tel Aviv-based Cyvera in 2014 for endpoint zero-day protection technology [pre-2020], and later integrated LightCyber’s automated behavioral-analytics technology into its platform [pre-2020].^{3, 4} More recent acquisitions integrated Bridgecrew’s infrastructure-as-code security into Prisma Cloud, Cider Security’s application and software-supply-chain security into Prisma Cloud, Dig Security’s data-security-posture-management technology into Prisma Cloud, and Talon Cyber Security’s enterprise-browser technology into Prisma SASE.^{5, 6, 7, 8}

Palo Alto Networks completed its acquisition of Israeli identity-security company CyberArk on 11 February 2026. The company says the transaction adds identity security as a core platform and further strengthens its Israeli R&D center.⁹ Its own acquisition overview also lists a broader sequence of security acquisitions used to build its endpoint, cloud and security-operations platforms.¹⁰

No public evidence identified of Palo Alto Networks itself licensing or subscribing to Check Point, Wiz, SentinelOne, NICE, Verint, Claroty or another named Israeli-origin cybersecurity vendor as a material internal dependency in the sources reviewed. The evidence instead shows owned subsidiaries, acquired technology and Palo Alto Networks-operated infrastructure.^{1, 10}

Palo Alto Networks maintains an Israeli partner ecosystem. Its authorized-training-partner directory lists Innocom and Zebra A.G.R as Israel-based training partners.¹¹ Who Profits’ Malam Team profile lists Palo Alto Networks among Malam Team’s technology partners; the same profile separately lists Elbit Systems, Israel Aerospace Industries, Rafael Advanced Defense Systems and IMI Systems among Malam Team clients.¹² That source does not identify which Malam Team vendor supplied which client, so it does not establish that Palo Alto Networks products were deployed to any of those defense companies.¹²

Surveillance, Biometrics & Retail Technology

Palo Alto Networks develops and sells network, endpoint, cloud, security-operations and identity-security technologies. LightCyber’s acquired technology performs behavioral analytics to identify anomalous network activity, and Palo Alto Networks’ Israel office description identifies behavioral analytics as an Israeli R&D focus.^{4, 2} This is enterprise cyber-defense analytics; the reviewed sources do not describe it as facial recognition, biometric identification, gait analysis or retail-customer surveillance.^{2, 4}

No public evidence identified of Palo Alto Networks providing facial-recognition or biometric-identification products from Trigo, BriefCam, AnyVision/Oosto, Trax or another comparable Israeli vendor.^{1, 10} no public evidence identified of Palo Alto Networks supplying an Israeli-origin predictive-policing, sentiment-monitoring or workforce-surveillance system to an Israeli state or commercial customer.^{1, 10}

No public evidence identified of a third-party managed-service or bundled-suite deployment that places facial recognition, biometrics or predictive-policing technology inside Palo Alto Networks’ own enterprise stack.^{1, 13} The company’s cloud-security products do, however, process security telemetry and logs in region-selectable infrastructure as described below.^{14, 15}

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Palo Alto Networks operates Israel-designated cloud-security infrastructure. In May 2023 the company announced expansion of Prisma Access to a Google Cloud region in Tel Aviv, describing the service as cloud-delivered Zero Trust Network Access for users, devices, data and applications in Israel.¹⁶ Current Prisma Access documentation lists both Israel Central and Middle-East West / Israel locations and explains that customer traffic is directed to defined compute locations, while customers can choose locations according to user and data-location requirements.¹⁷

The processing model is service-specific. Palo Alto Networks’ Prisma Access processing-location table shows that an Israel Strata Logging Service region maps Prisma Access Insights data to Israel, while Strata Cloud Manager configuration and SaaS Security Inline for that row are processed in Germany/EU and Device Security is not supported for that Israel logging region.¹⁴ This establishes a mixed regional architecture rather than evidence that all Palo Alto Networks customer data is processed in Israel.¹⁴

Strata Logging Service, the company’s cloud log-storage service, added an Israel region in November 2023.¹⁸ Current region documentation says the region selected at activation determines the physical location in which log data is stored and lists an Israel - Tel Aviv region with Israel-specific ingestion, telemetry and access endpoints.¹⁵ Accordingly, customers choosing the Israel region can store security logs in Israel; the documentation does not show that customers outside that selected region are automatically routed there.¹⁵

Other cloud-delivered security functions also have Israel endpoints. Palo Alto Networks’ Advanced DNS Security documentation lists a Tel Aviv regional service domain.¹⁹ In April 2025 the company added a Tel Aviv service region for Advanced Threat Prevention inline cloud-analysis requests, specifically citing data-residency and performance requirements as reasons a customer may select a regional endpoint.²⁰ Strata Cloud Manager prerequisites likewise list an Israel service endpoint for cloud management.²¹

Palo Alto Networks’ privacy trust center publishes global privacy, subprocessor and transfer-assessment materials, but the public page reviewed does not state that all customer personal data is transferred to Israel.¹³ Google Cloud’s March 2026 service-data subprocessor register identifies Palo Alto Networks as a subprocessor for Cloud IDS and Cloud NGFW Enterprise technical support and lists Israel among the countries from which that technical support may be performed.²² The Google record establishes a permitted support location; it does not establish that every Google customer dataset is accessed from Israel.²²

No public evidence identified that Palo Alto Networks is a named prime contractor or subcontractor for Project Nimbus.^{16, 17} no public evidence identified of a Palo Alto Networks contract specifically marketed as sovereign-cloud infrastructure for the Israeli government or military.^{16, 17} The verified record instead shows commercial Israel-region cybersecurity services available to customers generally.^{16, 15}

The company continued Israel-region product operations after 19 July 2024 and November 2024: the April 2025 Advanced Threat Prevention Israel region, current 2026 cloud-region documentation and the February 2026 CyberArk transaction are all post-date evidence of ongoing Israeli technical operations.^{20, 17, 9} The reviewed sources do not establish that those post-date services were provided to the IDF, Ministry of Defense, intelligence agencies, settlements or settlement authorities.^{9, 17, 20}

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of a direct Palo Alto Networks contract, procurement award or service agreement with the Israel Defense Forces, Israeli Ministry of Defense, Israeli intelligence agencies or Israel Police in the sources reviewed.^{1, 2, 12} Search results for Israeli channel partners and individual personnel were not treated as evidence of a state-security contract without a named product, contracting entity and deployment.^{11, 12}

Palo Alto Networks does have a verified Israeli critical-infrastructure/commercial customer relationship with EL AL. A December 2024 Palo Alto Networks case study states that the Israeli airline uses Cortex XDR and Unit 42 managed services/retainer support for cybersecurity operations.²³ EL AL is a civilian airline, and the case study does not identify the IDF, Ministry of Defense or an intelligence agency as the customer.²³

Who Profits lists Malam Team as a Palo Alto Networks partner and separately lists Israeli defense companies among Malam Team’s clients.¹² Because that profile does not connect a Palo Alto Networks product to a particular Malam Team defense customer, it is evidence of channel proximity only and not evidence of a Palo Alto Networks military deployment.¹²

No public evidence identified of Palo Alto Networks selling or maintaining offensive zero-day exploit tooling, a purpose-built digital weapon, or an autonomous target-generation/fire-control system for an Israeli state actor.^{1, 10} Palo Alto Networks’ reviewed products are described as defensive network, endpoint, cloud, identity and security-operations platforms.^{1, 5, 9}

AI, Algorithmic & Autonomous Systems

Palo Alto Networks’ Israel R&D center develops Cortex XSIAM, which the company describes as an autonomous security-operations platform using data, analytics and automation.¹ The company also uses AI/ML in cloud-delivered threat analysis; its 2025 Tel Aviv Advanced Threat Prevention region supports inline cloud analysis using machine-learning-based detection engines.²⁰ These are general-purpose cybersecurity capabilities rather than systems described in the reviewed sources as kinetic targeting or weapons-effect technology.^{1, 20}

Dig Security’s technology was integrated into Prisma Cloud to discover, classify, monitor and protect sensitive data across cloud data stores, while Talon’s enterprise-browser technology was integrated into Prisma SASE for controlled access to business applications from managed and unmanaged devices.^{7, 8} These products can process security and access data, but the reviewed sources do not identify Israeli state, military or intelligence training datasets, intercepted communications, or Palestinian civilian data as model-training inputs.^{7, 8}

No public evidence identified of Palo Alto Networks providing AI/ML platforms to the IDF, Israeli Ministry of Defense or intelligence agencies for target identification, autonomous tracking, logistics optimization or other named military applications.^{1, 10} no public evidence identified of Palo Alto Networks providing autonomous target-generation or lethality systems; purpose-built kinetic targeting would in any event fall outside Digital under the domain boundary supplied for this audit.^{1, 10}

Technology Ecosystem & R&D Footprint

Palo Alto Networks has maintained an Israeli R&D presence since its 2014 acquisition of Cyvera [pre-2020].³ The company’s present Israel careers page says the center is its largest outside Silicon Valley and develops next-generation security products including Cortex XSIAM.¹ Its locations page identifies Tel Aviv R&D, endpoint security, behavioral analytics, support and sales functions.²

The acquisition history shows repeated incorporation of Israeli cyber technology into Palo Alto Networks’ core platforms. Cyvera added endpoint zero-day prevention in 2014 [pre-2020]; LightCyber added machine-learning behavioral analytics in 2017 [pre-2020]; Bridgecrew added developer-first infrastructure-as-code security in 2021; Cider Security added software-supply-chain and application security in 2022; Dig Security added data-security-posture management in 2023; Talon Cyber Security added enterprise-browser security in 2023; and CyberArk added identity security when the acquisition completed in February 2026.^{3, 4, 5, 6, 7, 8, 9}

Palo Alto Networks’ own strategic-acquisitions overview also records Secdo, Demisto, Twistlock, PureSec and other acquisitions that contributed endpoint, SOAR, container and cloud-native capabilities to the company’s platforms.¹⁰ The source reviewed does not by itself establish that every acquired company was Israeli-domiciled, so nationality is not assigned here unless separately supported.¹⁰

No public evidence identified of a significant current patent-licensing or co-development agreement between Palo Alto Networks and Technion, Hebrew University, Weizmann Institute or another named Israeli research institution in the sources reviewed.^{1, 10}

Civil Society Scrutiny & Regulatory History

No public evidence identified in the retained final-source set of a settlement-specific Palo Alto Networks contract or deployment.¹² Who Profits’ Malam Team profile is relevant because it lists Palo Alto Networks as a partner of an Israeli systems integrator that Who Profits associates with occupation-related technology activity.¹² The same profile lists multiple Israeli defense companies as Malam Team clients, but it does not state that Palo Alto Networks supplied those clients or that Palo Alto Networks products were used in settlements, checkpoints, the wall, military operations or population-control systems.¹²

No public evidence identified of Palo Alto Networks itself being the named subject of a major Amnesty International, Human Rights Watch, Access Now, Citizen Lab, B’Tselem or Al-Haq investigation concerning technology provision to Israeli state bodies or occupied-territory operations in the material reviewed.¹² no public evidence identified of a target-specific boycott/divestment campaign based on a documented Palo Alto Networks Israeli state or settlement technology contract.¹²

No public evidence identified of a regulator, court or export-control authority finding that Palo Alto Networks unlawfully supplied cybersecurity technology to Israeli state, military or settlement entities.^{13, 12} The reviewed record supports a substantial Israeli R&D, acquisition, cloud-region and commercial-customer footprint, but not a documented direct IDF/IMOD/Nimbus/settlement contract.^{1, 9, 16, 15, 23, 12}

Additive Expansion - Historical Israeli State-Security Cybersecurity Procurement

Ministry of Justice / LightCyber chronology. [pre-2020] Two official Israeli Government Procurement Administration records from 2016 describe a Ministry of Justice sole-source procurement of the LightCyber MAGNA information-security product. Those pages now render supplier company no. 514668920 under the later name Palo Alto Networks (Israel Analytics), but the procurement text names LightCyber and the engagement period began in June 2016, before Palo Alto Networks completed its LightCyber acquisition on 27 February 2017.^{24, 25, 4} The 2016 procurement is therefore historical LightCyber activity and is not treated as a Palo Alto Networks-controlled state-security relationship at award date.

Post-acquisition Ministry of Justice maintenance. [pre-2020] An official 22 November 2017 procurement notice records a sole-source maintenance engagement for Light Cyber Magna, with supplier company no. 514668920 rendered as Palo Alto Networks (Israel Analytics), a stated value of ₪161,792, and an engagement period from 13 November 2017 through 31 August 2019.²⁶ Because Palo Alto Networks had completed its acquisition of LightCyber in February 2017, this is post-acquisition cybersecurity provision by the Palo Alto group.^{4, 26} The source describes information-security software maintenance; it does not establish surveillance, targeting, intelligence collection, or kinetic use.

Israel Prison Service procurement aggregate. Open Budget’s company page for Palo Alto Networks (Israel Analytics), company no. 514668920, aggregates ₪904,563 of Israel Prison Service procurement described as an anomaly-detection system.²⁷ A dated primary Israel Prison Service award record for this aggregate was not surfaced in the bounded research. The award date is therefore unresolved, and the available record does not establish whether the underlying procurement occurred before or after Palo Alto Networks completed its acquisition of LightCyber on 27 February 2017.^{4, 27} The aggregate supports only the existence of an Israel Prison Service cybersecurity/anomaly-detection procurement associated with the later supplier identity; it does not establish biometric surveillance, population monitoring, targeting, intelligence exploitation, or any military or kinetic outcome.²⁷

These historical state-security cybersecurity items belong in Digital as digital/cyber provision. They do not by themselves establish the downstream operational use of the products beyond the procurement descriptions above.^{26, 27}