Snyk

Key Findings

• Economic: Snyk was founded across Tel Aviv and London, maintained a listed Tel Aviv office, and acquired Tel Aviv-founded application-security companies Enso Security in 2023 and Helios in 2024; public estimates of both purchase prices conflict, and June 2026 reporting that the Israel development centre was eliminated makes the continuing scale of the Israeli operation unresolved.^{1, 2, 3, 4, 5}
• Political: The only documented company action tied directly to the October 2023 conflict was keeping the Tel Aviv office available for employee safety; no equivalent corporate policy statement, named donation, or mobilization for an Israeli state or military body was identified.^{6, 7}
• Not found: No public evidence identified of Snyk contracts or deployments for Israeli military, intelligence, surveillance, or state-cloud bodies, or of operations in Israeli settlements or occupied territories; Snyk was also not identified in the reviewed OHCHR settlement-business materials.^{8, 9, 10}

Target Profile

Key Facts:

• Snyk was founded in 2015 by Guy Podjarny, Assaf Hefetz, and Danny Grander.¹
• The founders are reported as veterans of Israeli military cyber or intelligence units; the audits treat those biographies as prior individual histories, not corporate conduct by Snyk.^{1, 16}
• Snyk’s December 2022 financing was led by a Qatari, not Israeli, sovereign wealth fund.^{11, 12}
• Snyk remains private; the audits found no SEC public-offering filing or Israeli state ownership.¹⁷

Executive Summary

Snyk is a privately held developer-security software company founded in 2015 across Tel Aviv and London and operationally headquartered in Boston and London. Its products scan source code, open-source dependencies, containers, and infrastructure-as-code for vulnerabilities. The documented Israel nexus is principally corporate and economic: Israeli founder origins, a Tel Aviv engineering footprint, and the acquisition of two Tel Aviv-founded application-security businesses, Enso Security and Helios.^{1, 2, 3, 4}

The strongest verified vector is economic. Enso was acquired in June 2023 and Helios in January 2024, bringing Israeli-founded teams and technology into Snyk. Public valuations are not consistent: Enso was described in contemporaneous reporting as a transaction worth roughly $45–50 million or more than $50 million, while a secondary financial source cited $32.7 million; Helios was described as worth tens of millions of dollars, while that same secondary source cited $2.9 million. The audits mark both discrepancies unresolved, so this dossier does not select a definitive price.^{3, 4, 18, 19} Snyk’s live offices listing continued to show Tel Aviv, but June 2026 reporting said the company laid off the Israel development centre’s roughly 90 employees. The evidence therefore supports a historical and recently active Israeli R&D footprint, while the extent of any continuing operation after the layoffs remains unresolved.^{2, 5}

The political record is limited. After the October 2023 outbreak of war, then-CEO Peter McKay said employee wellbeing was the company’s primary concern and that the Tel Aviv office remained open so local staff could use company resources to stay safe.⁶ The audits characterize this as employee welfare, not defence cooperation or political alignment. They identified no standalone Snyk policy on Israel/Palestine, no corporate donation to the IDF or named state-aligned organization, no conflict-related product or logistics support, and no Israel-focused lobbying or anti-BDS activity.^{7, 20} No public evidence identified of operations in the West Bank, East Jerusalem, the Golan Heights, or Israeli settlements.^{9, 10}

The evidence does not support a military or digital-state nexus. No public evidence identified of an Israeli defence, intelligence, policing, surveillance, or state-cloud contract; weapons, tactical products, offensive cyber tooling, biometric technology, Project Nimbus participation, or supply to an Israeli defence prime.^{8, 21} Snyk does have a civilian technology-alliance integration with Israeli-founded, US-headquartered SentinelOne, but the documented function connects container vulnerability scanning with commercial cloud-workload runtime protection; no Israeli state end user or defence deployment is identified.^{22, 23} On the fixed, human-vetted V4 assessment, the economic record drives BRS 555, Tier C (High), while Military and Digital remain zero.

Timeline of Relevant Events

Corporate Overview

Snyk sells cloud-delivered application-security software to developer and enterprise customers. The audited product set comprises software-composition analysis, static application-security testing, container scanning, and infrastructure-as-code scanning. It is not a manufacturer, physical-goods importer, financial institution, retailer, logistics operator, or construction company.¹ Those business characteristics limit the relevance of physical sourcing, country-of-origin labeling, heavy machinery, retail, and settlement-franchise vectors.

The documented corporate entity is Snyk Limited, incorporated in England and Wales in July 2015. The company is privately held and venture-backed. The audits report Boston and London as its principal headquarters and identify offices including Tel Aviv, Ottawa, and Zurich.^{1, 2} They found no Israeli state ownership, government-appointed director, golden share, or charter provision connecting company governance to Israeli state policy. QIA’s leadership of the 2022 Series G is an inbound investment by Qatar’s sovereign wealth fund, not an Israeli state stake.^{11, 12}

The Israeli corporate footprint developed through the original Tel Aviv engineering hub and two acquisitions. Enso Security, founded in Tel Aviv in 2020, was absorbed into Snyk following its June 2023 acquisition. Helios, founded in Tel Aviv in 2021 and employing roughly 11 people across Israel and the United States before acquisition, was acquired in January 2024 and integrated into Snyk’s product organization.^{3, 4} The audits identify these as acquisitions, not continuing third-party suppliers, franchises, or independent settlement-linked entities. Snyk’s other listed acquisitions were non-Israeli.

Current scale requires qualification. A live third-party office listing continued to identify 28 HaArba’a Street, Tel Aviv-Yafo, while June 2026 reports said Snyk eliminated the entire roughly 90-person Israel development-centre staff as part of a wider restructuring and AI-security pivot.^{2, 5} The reports document a major contraction or discontinuation of Israel R&D, but do not resolve whether a legal entity, small residual office, non-R&D staff, or stale location listing remained afterward. This dossier therefore does not describe the historical development centre as unambiguously ongoing.

No franchise, dealer, retail, physical-distribution, or settlement subsidiary relationship was identified. The confirmed Israel location was in Tel Aviv within pre-Green-Line Israel; no public evidence identified of a Snyk office or operating facility in the West Bank, East Jerusalem, or the Golan Heights.⁹

Domain Summaries

Military: Military

Mechanism of Involvement

No qualifying military mechanism was verified. Snyk’s products are general-purpose defensive developer tools used to identify vulnerabilities in code, dependencies, containers, and cloud configurations.¹ No public evidence identified of a contract, tender, framework agreement, memorandum of understanding, or customer announcement involving Israel’s Ministry of Defense, the IDF, Israel Prison Service, Border Police, intelligence agencies, or another Israeli security body. The audits also found no SIBAT or comparable defence-export-directory listing; no supply to Elbit Systems, Israel Aerospace Industries, Rafael, or IMI/Elbit Land; and no role in munitions, strategic weapons platforms, logistics, base services, checkpoints, detention facilities, or military construction.⁸

The founders’ military biographies are relevant context but are not a Snyk military transaction. Podjarny, Hefetz, and Grander are reported as veterans of Unit 8200 or related Israeli military cyber functions, and acquired-company executive Eli Cohen previously served in Unit 8200.^{1, 16, 26} The audits expressly classify these as pre-Snyk or acquired-company personal histories rather than evidence that Snyk supplied the IDF or a defence prime.

Counter-Arguments and Evidence Limits

Snyk’s strongest defence is the civilian character of its business and the absence of a verified military customer, contract, accreditation, or deployment in the audited record. No tactical or military-grade version of its products was identified; no designed targeting or weapons-integration function was found; and no Israeli defence export licence, end-user certificate, enforcement action, or defence-related litigation was located. A general-purpose cybersecurity product could hypothetically be used by an unpublicized defence customer, but the audits supply no documentary basis for asserting that it is. Founder service histories cannot substitute for corporate evidence.

No public evidence identified that Snyk appears in the reviewed OHCHR business database, the named-company annex associated with the UN Special Rapporteur’s 2025 corporate report, PAX’s report on companies arming Israel, or the Who Profits company database.^{10, 27, 28, 29} These negative checks do not prove that no relationship can exist; they establish that the reviewed public sources did not document one.

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

No qualifying Israeli state digital or surveillance mechanism was verified. The audits found no Snyk participation in Project Nimbus or another Israeli state-backed cloud programme; no Israeli ministry, military, intelligence, policing, or surveillance deployment; and no provision of facial recognition, biometrics, predictive policing, population analytics, offensive cyber capabilities, zero-day exploit tooling, or autonomous targeting systems.^{8, 21}

The one confirmed Israeli-ecosystem vendor relationship is a technology-alliance integration with SentinelOne, an Israeli-founded but US-headquartered cybersecurity company. The integration correlates Snyk Container’s build-time vulnerability findings with SentinelOne Singularity Cloud Workload Security runtime detections for commercial incident triage.^{22, 23} No start date was documented, and no Israeli state customer, mandate, or defence use is identified. The audits therefore record a civilian commercial integration without treating it as a state-security nexus.

Snyk offers regional hosting in the United States, Frankfurt, and Australia; its data-governance documentation did not list an Israel hosting region.³⁰ Its FedRAMP authorization, US Small Business Administration case study, and Carahsoft public-sector resale channels concern the United States government, not Israel.^{25, 31, 32}

Counter-Arguments and Evidence Limits

Snyk’s strongest defence is that its documented activity is defensive application security for general enterprise and developer markets. No public evidence identified of offensive capability, surveillance data access, Israeli state hosting, or deployment for kinetic or population-control purposes. FedRAMP and US public-sector sales show government-market capability, but they do not establish an Israeli government relationship.

The SentinelOne integration is a real commercial tie and should not be omitted, but Israeli origin alone does not turn a US-headquartered vendor alliance into Israeli state participation. Likewise, the founders’ Unit 8200 backgrounds and the company’s historical Tel Aviv engineering centre describe ecosystem and workforce origin; without a verified customer or use case, they are not evidence of state surveillance or military technology transfer. The Who Profits check had partial manual coverage in the digital audit, and an unsuccessful patent-assignee search was explicitly marked a methodology gap rather than proof of no patents.

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

The economic domain contains the dossier’s strongest verified nexus. Snyk originated with parallel Tel Aviv and London operations and maintained a documented Tel Aviv engineering presence.^{1, 2} It acquired Enso Security in June 2023 and Helios in January 2024, deploying corporate capital to acquire Tel Aviv-founded software businesses and integrate their teams and technology into Snyk.^{3, 4} Founder Podjarny’s reported personal investments in Israeli startups are separate from Snyk’s balance sheet and are not attributed to the company.

Transaction values remain unresolved. Contemporary reports described Enso at approximately $45–50 million or more than $50 million, while a secondary financial source gave $32.7 million.¹⁸ Helios was reported as a cash-and-stock deal worth tens of millions of dollars, while the secondary source gave $2.9 million.¹⁹ The existence and timing of the acquisitions are verified; the precise monetary scale is not.

The operational footprint also requires temporal mitigation. The live office listing supported a continuing Tel Aviv location, but June 2026 reporting described layoffs of roughly 90 employees as eliminating the Israel development centre.^{2, 5} Accordingly, the evidence supports substantial historical and recent economic activity, while the post-layoff scale is unresolved. No new Israeli acquisition or office opening after January 2024 was identified.

No public evidence identified of physical-goods sourcing, agricultural imports, Israel Bonds, Israeli sovereign-debt underwriting, direct lending, insurance, or disclosed Snyk holdings in Israeli companies or Israel-focused funds. The company’s disclosed funding base was non-Israeli, including QIA, Accel, venture investors, asset managers, and strategic investors.^{11, 12}

Counter-Arguments and Evidence Limits

Snyk can argue that its Israeli activity was ordinary civilian software R&D, employment, and M&A rather than settlement commerce or support for state policy. Its known Israeli location was Tel Aviv, not occupied territory, and the acquired products concerned application-security posture and runtime observability. The 2026 elimination of the development-centre workforce materially mitigates claims of a continuing R&D operation, even though the residual office or legal presence cannot be resolved from the supplied sources.

No country-level revenue, profit, tax, transfer-pricing, or Israel-specific headcount series is publicly disclosed. The audits therefore do not establish how much revenue Snyk earns in Israel, what taxes it pays there, or whether profit moves in a particular direction. They also found no Israeli government contract, state ownership, infrastructure designation, or designation of Snyk as a key Israeli employer. Snyk does not appear in the checked OHCHR, Who Profits, BDS Movement, or comparable authoritative settlement-business materials.^{10, 29, 33}

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

The documented political nexus is narrower than the economic one. In October 2023, McKay said the wellbeing of Israeli employees was Snyk’s primary concern and that the Tel Aviv office remained open for them to use company resources to remain safe.⁶ The audit characterizes that action as employee welfare. It did not identify a defence-cooperation statement, support for Israeli government policy, a named conflict-related donation, military leave subsidy, product credits, logistics, or infrastructure directed to state, military, or state-aligned bodies.^{7, 20}

Snyk is widely described by third-party trade press as Israeli-founded, and Startup Nation Central includes it in its company directory.^{16, 34} The audits treat those items as external origin-based or ecosystem classification, not a Snyk state partnership or a company marketing campaign based on military heritage. No public evidence identified of Snyk funding or governing Startup Nation Central, sponsoring a Brand Israel initiative, hosting Israeli officials, or accepting state honours.

No public evidence identified of settlement operations, Israel-focused corporate lobbying, anti-BDS advocacy, donations to the IDF, FIDF, JNF/KKL, reservist funds, or settlement organizations. No Snyk-specific employee-speech dispute, internal petition, walkout, OECD complaint, or legal action related to Israel/Palestine was identified.^{7, 9, 20}

Counter-Arguments and Evidence Limits

The company’s strongest defence is that the sole documented October 2023 act was provision of a safe workplace resource to employees, without a political declaration or material support to a belligerent. Its corporate channels contained no standalone Israel/Palestine policy comparable to Snyk’s detailed Ukraine response, which included a $100,000 donation and withdrawal from Russia and Belarus.^{7, 35, 36} The contrast documents the absence of a comparable public Israel/Gaza programme; it does not by itself prove an undisclosed position.

Third-party descriptions of Snyk as Israeli-founded and founder military biographies do not establish political advocacy. The audits found no evidence tying Snyk’s charter or mission to a state geopolitical objective and no Israeli state ownership or appointee. They also found no organized BDS Movement or No Tech for Apartheid campaign specifically targeting Snyk. One informal listicle included Snyk without a specific, corroborated allegation; the audits treated it as a low-evidentiary-value reference, not a formal campaign designation.³⁷

Named Entities and Evidence Map

Complicity Index Score (V4)

• V_MAX: 6.50 Avg_OTHERS: 0.81
• BRS Score: 555 Tier: C (High)

Economic supplies the V_MAX of 6.50, driven by the verified Tel Aviv operational history and acquisitions of Enso Security and Helios; the lower Political score reflects the narrower documented political record, while Military and Digital are zero. The resulting BRS 555, Tier C (High) applies the scale-free Impact × magnitude/proximity method on an evidence-only, human-vetted basis; these fixed V4 values are reproduced without alteration.

Methodology Note

• Evidence is limited to the four supplied domain audits. Every affirmative factual claim is tied to their cited record; an absence finding is stated as “No public evidence identified,” not as proof of impossibility.
• Impact (I) is scale-free and classifies the type of documented activity; magnitude (M) reflects its scale; proximity (P) reflects the directness of the company’s relationship to the activity.
• The temporal rule mitigates divested, exited, or discontinued operations. The reported June 2026 Israel R&D layoffs are therefore carried as a material qualification, while the residual office status remains unresolved.
• Entity attribution is direct: founder employment or military service, acquired-company histories, investor activity, and partner conduct are not imputed transitively to Snyk without evidence of a Snyk corporate act.
• A verified settlement operation would dual-count in Economic and Political. No public evidence identified of a Snyk operation in a settlement or occupied territory, so no such mechanism is asserted here.
• Conflicting acquisition-price estimates, partial database coverage, and audit-marked methodology gaps remain unresolved or are excluded; soft or informal allegations are not upgraded into findings.

End Notes