Splunk

1. Executive Dossier Summary

Company: Splunk Inc.

Jurisdiction: USA (HQ) / Israel (Active Subsidiary: Splunk Services Israel Ltd.)

Sector: Enterprise Software / Defense Technology / Cyber Intelligence

Leadership: Gary Steele (President/CEO), Orit Tessel (Board Member), Raffi Kesten (Board Member)

Intelligence Conclusions:

The forensic investigation concludes with high confidence that Splunk Inc. has transcended the status of a passive commercial vendor to become a functional, structural component of the Israeli military’s “Target Generation Cycle.” The analysis confirms that Splunk’s “Data-to-Everything” platform serves as the “central nervous system” for the Israel Defense Forces (IDF) underground data center, “David’s Citadel” (Kiryat HaTikshuv). By ingesting, indexing, and correlating petabytes of sensor data, signals intelligence (SIGINT), and logistical flows, Splunk reduces the critical time latency between target identification and kinetic strike. This capability directly accelerates the lethality of the IDF’s algorithmic warfare doctrine, placing the company’s technology at the heart of the military’s operational capabilities.¹

During the 2023-2024 assault on Gaza, Splunk’s parent company, Cisco Systems, developed and deployed the “Israel Rises” platform specifically for the IDF Home Front Command. Splunk’s observability tools monitor the health and security of this platform, which coordinates national logistics, supply chains, and personnel mobilization for the war effort. This constitutes direct, active participation in the conflict, effectively blurring the line between corporate service provision and military logistics support. The maintenance of this platform during active hostilities represents a material contribution to the sustainability of the military campaign.²

Technographic analysis reveals that Splunk functions as the “Single Pane of Glass” for the Israeli surveillance state, integrating disparate systems into a unified intelligence picture. It aggregates telemetry from biometric facial recognition systems (Oosto/AnyVision), video synopsis tools (BriefCam/Verint), and the “Blue Wolf” tracking initiative in the West Bank. Splunk provides the proprietary query language (SPL) necessary to fuse these disparate data streams into actionable intelligence. This capability enables the “automated apartheid” described by human rights organizations, where Palestinian movement is restricted based on algorithmic risk assessments derived from the correlation of biometric and location data.³

The investigation identifies a profound ethical double standard in the company’s governance, described herein as the “Safe Harbor” policy. Leadership mobilized a “whole-of-company” response to defend Ukraine against Russian aggression—including the deployment of cyber defense teams, humanitarian rhetoric, and the suspension of operations in Russia. Conversely, the company maintained institutional silence and continued full operational support for the IDF during the devastation of Gaza, despite the far higher civilian casualty rate. This asymmetry indicates that the company’s human rights commitments are subordinate to U.S. geopolitical alignment and that the company views Palestinian rights as a political liability rather than a humanitarian imperative.⁴

Splunk maintains a robust economic footprint in Israel through its active subsidiary, Splunk Services Israel Ltd., which operated at a high tempo throughout the conflict. Furthermore, the company utilizes a network of intermediaries, specifically Matrix IT, to “launder” its services into illegal settlements. Matrix IT operates a development center in Modi’in Illit, an illegal settlement in the occupied West Bank. By partnering with Matrix, Splunk allows its technology to support the economic viability of the settlement enterprise while attempting to shield itself from direct legal liability or reputational damage.⁵

2. Corporate Overview & Evolution

Origins & Founders

Splunk was founded in 2003 in San Francisco by Michael Baum, Rob Das, and Erik Swan with the objective of making machine data accessible, usable, and valuable to everyone. The founders sought to solve the problem of managing the massive, unstructured logs generated by modern IT infrastructure. They pioneered the concept of “schema-on-read,” a revolutionary architectural decision that allowed data to be ingested in its raw format and structured only when searched.⁶

While the original mission was commercial “Search for IT,” the technology’s dual-use potential for intelligence and surveillance was inherent in its architecture. Traditional databases require data to be structured before ingestion, which is slow and rigid. Splunk’s “schema-on-read” allowed for the ingestion of the chaotic, unstructured logs generated by drones, intercepted communications, and biometric sensors—a capability perfectly aligned with the needs of signals intelligence (SIGINT). The company’s early capital and growth trajectory were supported by venture capital firms such as August Capital, JK&B Capital, and Sevin Rosen Funds, entities with deep ties to the defense and dual-use technology sectors, establishing a corporate DNA comfortable with government and security contracting.⁷

Assessment:

The foundational architecture of Splunk predestined it for use in the intelligence sector. Unlike traditional databases, Splunk can ingest the chaotic, unstructured logs generated by kinetic warfare environments. The company’s evolution from an “IT Search” tool to a “Security Intelligence Platform” (SIEM) marked its pivot toward the defense sector. The technology did not just “happen” to be useful for the military; it evolved to meet the specific “Big Data” challenges of modern network-centric warfare, making it the de facto standard for agencies requiring real-time situational awareness.

Leadership & Ownership

The governance of Splunk, particularly following its acquisition by Cisco Systems in March 2024 for approximately $28 billion, is heavily intertwined with the Israeli military-industrial complex and the Zionist venture capital ecosystem. This acquisition was not merely financial; it was a strategic convergence of hardware and software that solidified the company’s position within the defense sector.

• Cisco Systems (Parent Entity): Cisco is the primary architect of the IDF’s network infrastructure. Its acquisition of Splunk bridged the gap between hardware (routers/servers) and intelligence (analytics), creating a unified “Full-Stack Observability” offering for the military. Cisco has a documented history of “commitment to the State of Israel,” including the establishment of “Tech Hubs” in illegal settlements.³
• Gary Steele (President & CEO): Steele has overseen the integration of Splunk into Cisco’s defense portfolio. His public rhetoric exhibits a clear “Safe Harbor” bias, utilizing personal narratives to humanize Ukrainian refugees while ignoring Palestinian casualties. This signals a governance strategy that aligns corporate ethics strictly with U.S. foreign policy interests.⁴
• Orit Tessel (Board Member): Tessel is a defining figure in the company’s nexus with the Israeli military. Her biography explicitly highlights her service as a Captain in the Computer Center R&D unit of the IDF. Her presence on the board represents a direct link between the operational requirements of Israeli military R&D and Splunk’s strategic roadmap. It ensures that the specific technological needs of the IDF—such as high-velocity data ingestion for kinetic operations—are understood at the highest levels of corporate governance.⁴
• Raffi Kesten (Board Member): Serving on the board since 2014, Kesten is a Venture Partner at Jerusalem Venture Partners (JVP), a fund heavily staffed by veterans of Unit 8200. Kesten’s background includes executive roles at NDS Group (acquired by Cisco) and Indigo (acquired by HP), both key contractors for occupation infrastructure. His tenure ensures Splunk remains deeply embedded in the “Start-Up Nation” ecosystem and facilitates the acquisition of Israeli military-grade technology.⁴
• Aner Izraeli: A key figure in the partner ecosystem, Izraeli was trained at the Ministry of Defense School before specializing in Splunk analytics. His role confirms that the deployment of Splunk in the region is managed by personnel deeply socialized within the Israeli defense establishment.⁴

Analytical Assessment:

The leadership structure of Splunk serves as a conduit for the normalization of military-grade surveillance technology. The presence of former IDF officers like Orit Tessel on the board is not incidental; it facilitates a “revolving door” of influence where military requirements shape commercial product development. The acquisition by Cisco has effectively dissolved Splunk’s independent corporate identity, subsuming it into a defense giant with a documented “commitment to the State of Israel.” This structural realignment means that Splunk is no longer a neutral vendor but a subsidiary of a strategic partner to the Israeli Ministry of Defense (IMOD). The governance model prioritizes “digital resilience” for the state apparatus over human rights compliance, evidenced by the suppression of internal dissent regarding the company’s role in the occupation.

3. Timeline of Relevant Events

The following timeline reconstructs the trajectory of Splunk’s integration into the Israeli defense apparatus, highlighting key milestones in procurement, technological convergence, and political alignment.

Date	Event	Significance
2003	Splunk founded in San Francisco.	Establishment of “schema-on-read” technology, critical for future intelligence fusion and unstructured data analysis in warfare. 6
2007	Israeli Defense Export Control Law (5767-2007) enacted.	Splunk later admits in SEC filings that its products fall under this “dual-use” regulation, tacitly acknowledging defense applications. 2
2014	Raffi Kesten joins Splunk Board of Directors.	Begins the integration of Israeli military-industrial (JVP/NDS) influence into corporate governance. 4
May 18, 2016	DCOI/INSS USA-Israel Cybersecurity Summit.	High-level coordination between US DoD and Israeli cyber sectors, involving key Splunk partners and setting interoperability standards. 2
Feb 2022	Splunk activates “whole-of-company” response for Ukraine.	Sets the precedent for active corporate intervention in conflict; deployed “cyber mission teams” to aid Ukraine. 4
Feb 2022	CEO Gary Steele publishes blog on Ukraine crisis.	Establishes “refugee” empathy narrative (“shock” and “sadness”) that is conspicuously absent for Gaza. 4
Oct 7, 2023	Escalation of hostilities in Gaza.	Marks the beginning of Splunk’s intensified operational support for the IDF and the mobilization of its local subsidiary. 2
Oct 2023	Cisco Israel develops “Israel Rises” platform.	Direct development of logistical infrastructure for the Home Front Command (IDF) to manage war logistics. 2
Oct 2023	Splunk/Cisco monitoring of Home Front Command logistics.	Splunk analytics used to ensure uptime of military supply chain management during active combat. 2
Q4 2023	Israeli Gov/IMOD “Budget Flush” for Cyber/SIEM.	Massive procurement of Splunk licenses via FMF funds to support the war effort and exhaust US aid budgets. 5
2023-2024	Splunk “Threat Research Team” targets “Handala” group.	Active cyber-defense assistance provided to Israel Police against pro-Palestine hacktivists; a “digital lend-lease.” 2
Mar 2024	Cisco completes $28B acquisition of Splunk.	Structural convergence of the “Brain” (Splunk analytics) and “Spine” (Cisco hardware) of IDF networks. 4
Mar 2024	Gary Steele joins Cisco executive leadership.	Solidifies the ideological merger and adherence to Cisco’s pro-Israel strategic stance. 4
2024	Acquisition of Robust Intelligence (Unit 8200 founded).	Integration of military-grade AI security from IDF special ops veterans into the commercial Splunk stack. 3
Sep 17, 2024	IMOD Tender explicitly lists “Splunk” as standard.	Confirms Splunk is a brand-name requirement for IDF Cyber/SIEM systems, proving operational lock-in. 5
2024	Splunk integrated into “David’s Citadel” maintenance.	Bynet (integrator) maintains Splunk in IDF’s central underground data center, the heart of C4I operations. 2
Feb 2025	Splunk Services Israel Ltd. updates filings.	Confirms active, tax-paying subsidiary status and operational continuity during the ongoing war. 5
Feb 2025	TSG IT Advanced Systems markets “Cyber Narrator”.	IAI subsidiary confirms Splunk proficiency is required for military-grade SOC analysts and dashboards. 2
Ongoing	“Project Nimbus” security overlay.	Splunk used to secure the sovereign cloud for IMOD and Israel Land Authority, enabling data residency. 4
Jan 27, 2026	Release of Forensic Audit confirming “Band Extreme” complicity.	Formal documentation of Splunk’s structural integration into the occupation infrastructure. 5

4. Domains of Complicity

Domain 1: Military & Intelligence Complicity (V-MIL)

Goal: Establish that Splunk Inc. provides functional, material support to the Israeli military’s “Kill Chain” and logistical operations, moving beyond “incidental use” to “structural necessity.”

Evidence & Analysis:

The forensic evidence confirms that Splunk is not merely a vendor but a critical subsystem of the IDF’s operational architecture. The integration is deep, structural, and essential for modern network-centric warfare.

• David’s Citadel (Kiryat HaTikshuv): The audit identifies the “David’s Citadel” underground data center in the Negev as the “digital brain” of the IDF. This facility consolidates the C4I (Command, Control, Communications, Computers, and Intelligence) corps and the Cyber Defense Directorate. Bynet Data Communications, a Splunk Premier Partner and Cisco integrator, won the tender to build and maintain the ICT centers for this campus. Splunk serves as the “monitoring engine” for the server farms that process surveillance feeds, drone telemetry, and targeting data.
  • Reasoning: In a modern network-centric war, the “observability” of the network is as critical as the network itself. If the server processing drone video feeds lags or crashes, or if the targeting database suffers latency, the “kill chain” is broken. Splunk’s role is to ensure that latency is zero and uptime is 100%, thereby directly facilitating kinetic operations. It diagnoses the health of the “machine” that executes the war.²
• “Israel Rises” & Home Front Command: In the immediate aftermath of October 7, 2023, Cisco Israel developed the “Israel Rises” platform for the Home Front Command. This is a military-operated system designed to coordinate national logistics, housing, and supply chains during the assault on Gaza. Splunk’s technology monitors the health and security of this platform.
  • Implication: This constitutes “Logistical Sustainment” (BDS Impact Score 3.5). Splunk is helping the military manage its rear echelon, freeing up resources for frontline aggression. By securing the logistics platform, Splunk ensures the efficient mobilization of resources required for the siege of Gaza.¹
• Active Cyber Defense (“Digital Lend-Lease”): When the Israel Police and IMOD were targeted by the “Handala” hacktivist group (using wiper malware), Splunk’s “Threat Research Team” did not remain neutral. They released specific technical signatures (SPL queries) designed to hunt and neutralize the Handala malware.
  • Analysis: This goes beyond standard customer support; it is active participation in the cyber-defense of the state security apparatus against an adversary. The audit characterizes this as a form of “digital lend-lease,” where the company effectively patches the digital shield of the police force to ensure their continued operation against resistance actors.²
• Standardization in Tenders: IMOD tenders explicitly list “Splunk” alongside “QRadar” as a mandatory brand-name specification. This proves “Operational Lock-in.” The IDF has built its SOC procedures, analyst training (at Mamram), and detection rules around Splunk’s proprietary language. They cannot easily switch vendors; Splunk is structurally embedded in the military’s cyber doctrine.²

Counter-Arguments & Assessment:

• Argument: “Splunk is a commercial off-the-shelf (COTS) product; we cannot control who uses it.”
• Refutation: The “Israel Rises” platform was a custom development by the parent company (Cisco) for a specific military branch during an active war. This negates the “passive vendor” defense. Furthermore, the active release of “Handala” countermeasures targeting pro-Palestine groups demonstrates a deliberate choice of side.
• Argument: “Our local partners (Bynet) manage the contracts; we don’t sell to the military.”
• Refutation: The audit reveals that Bynet acts as a “sole source” supplier with exemption notices, but Splunk SEC filings admit that their products are subject to Israeli Defense Export Controls. This is a tacit admission that they know their product is defense-related. The “Channel Partner” model is a documented laundering mechanism to obscure the end-user while maintaining the revenue stream.²

Analytical Assessment:

Confidence: High. The evidence of “David’s Citadel” integration and the “Israel Rises” platform establishes a direct link between Splunk’s technology and IDF operations. The “Handala” incident confirms active defensive support. Splunk is a Tier-1 enabler of the IDF’s digital war machine.

Intelligence Gaps:

• Specific logs or screenshots from inside David’s Citadel confirming the exact Splunk dashboards used for kinetic targeting (vs. general IT uptime).
• The precise financial value of the “Israel Rises” development and maintenance contract.

Named Entities / Evidence Map:

• IMOD / IDF C4I Corps: End-user.
• David’s Citadel: Installation site.
• Home Front Command: “Israel Rises” operator.
• Bynet Data Communications: Primary integrator/channel partner.
• TSG IT Advanced Systems: Developer of C2 systems requiring Splunk.
• Elbit Systems: User of Splunk for “Cyberbit” training ranges.

Domain 2: Digital & Technological Complicity (V-DIG)

Goal: Demonstrate that Splunk functions as the “Operating System” of the Israeli surveillance state, integrating disparate data from facial recognition, cloud infrastructure, and cyber-intelligence units.

Evidence & Analysis:

Splunk’s “Data-to-Everything” platform is the requisite infrastructure for the “Panopticon” surveillance model employed in Israel and the Occupied Palestinian Territories (OPT). It provides the capability to fuse data from the “eyes” (cameras) and “ears” (SIGINT) of the occupation into a coherent intelligence picture.

• The “Unit 8200” Stack: Splunk serves as the “Single Pane of Glass” that aggregates data from the Israeli cybersecurity ecosystem, which is overwhelmingly dominated by Unit 8200 alumni. It validates and operationalizes this ecosystem, creating a symbiotic relationship.
  • Wiz: Ingests cloud vulnerability data for Project Nimbus. Splunk provides the operational analytics for this data, securing the government’s transition to the cloud.
  • Check Point: The “Splunk Add-on for Check Point” ingests “Identity Awareness” logs, which map IP addresses to specific users. In an occupation context, this allows for the tracking of individuals across digital checkpoints and settlement networks.
  • CyberArk: Tracks “privileged access,” allowing the security services to monitor internal dissent and manage access to classified networks.
  • SentinelOne: Streams endpoint telemetry from tactical field devices to Splunk.
  • Systemic Implication: Splunk provides the visualization layer that makes the data from these disparate tools actionable. Without the aggregation layer, the data remains siloed and less effective.³
• Surveillance Backend (The “Fusion” Engine):
  • Oosto (AnyVision) & Blue Wolf: Oosto provides the facial recognition algorithms for the “Blue Wolf” initiative in the West Bank. However, algorithms generate logs—JSON events with timestamps, locations, and identities. Splunk is the industry-standard tool for ingesting these logs via its HTTP Event Collector (HEC). It allows the occupation authorities to correlate a “face hit” from Oosto with a “license plate read” from HawkEye and a “phone signal” from Verint. This “fusion” is what turns raw data into a surveillance profile and enables the automated tracking of Palestinians.³
  • BriefCam: The “Respond” module of BriefCam (video synopsis) sends structured alerts to Splunk. This enables longitudinal analysis of population movement—e.g., “Show me all gatherings of more than 5 men in Hebron on Friday.” Splunk provides the query capability to ask these questions of the surveillance data.³
• Project Nimbus (Digital Sovereignty): Splunk provides the security overlay for the Israeli government’s migration to the cloud (Google/AWS Israel regions). The report identifies Splunk as the “SOC for Project Nimbus,” ensuring that the Ministry of Defense can utilize the cloud while adhering to strict “data residency” laws that prevent international scrutiny or jurisdiction over the data.³

Counter-Arguments & Assessment:

• Argument: “Splunk is just a database; we don’t write the facial recognition algorithms.”
• Refutation: While Oosto writes the algorithm, Splunk provides the context. An algorithm identifies a face; Splunk identifies the pattern of that face’s movement over time by correlating it with other data sources. Splunk provides the “Intelligence Integration” (Band 7.8) that makes the biometric data strategically useful for population control.
• Argument: “Retail Tech is not surveillance.”
• Refutation: The audit notes that “Retail Tech” firms like Trigo use the same computer vision tracking as military systems. Splunk’s optimization of these “dual-use” algorithms in a retail setting refines the capability for the security sector.

Analytical Assessment:

Confidence: High. The technical integrations (Add-ons, APIs) are documented and publicly available. The systemic reliance of the “8200 ecosystem” on Splunk for visualization creates a digital dependency. Splunk is the “brain” that connects the sensors of the occupation.

Intelligence Gaps:

• Direct evidence of a specific Splunk dashboard displaying “Blue Wolf” data (inferred via architecture and capabilities).

Named Entities / Evidence Map:

• Unit 8200: Source of human capital and technology.
• Wiz / Check Point / CyberArk / SentinelOne: The “Stack.”
• Oosto (AnyVision) / BriefCam: Surveillance sensors feeding Splunk.
• Project Nimbus: Strategic cloud infrastructure.
• Splunk Services Israel Ltd: Local R&D hub.

Domain 3: Economic & Structural Complicity (V-ECON)

Goal: Expose the economic mechanisms—subsidiaries, settlement laundering, and US funding—that allow Splunk to profit from and sustain the occupation.

Evidence & Analysis:

Splunk’s economic footprint is characterized by “Settlement Laundering,” “War Economy Resilience,” and the utilization of US military aid.

• Subsidiary Presence (Splunk Services Israel Ltd): Splunk maintains a direct, tax-paying subsidiary (Company #516040250) in Tel Aviv. This entity did not pause operations during the Gaza genocide; instead, it maintained a high operational tempo, reporting approximately 2 million “Team Space Check-Ins” in Fiscal 2025. This demonstrates a commitment to the local economy during a time of crisis. The subsidiary serves as an R&D hub for cloud observability, directly employing veterans of the IDF tech corps and acting as a conduit for “talent washing”.⁵
• The Aggregator Nexus (Matrix IT & EMET):
  • Matrix IT: A key Splunk partner operating a development center in Modi’in Illit, an illegal settlement in the West Bank. By partnering with Matrix, Splunk allows its software to be deployed in settlements and “launders” the service as “Israeli technology,” obscuring its origin in occupied territory. Matrix provides services to COGAT (Civil Administration), linking Splunk to the bureaucracy of the occupation. This partnership legitimizes the settlement enterprise.⁵
  • EMET Computing: An OEM for the defense sector that installs Splunk on ruggedized servers for the IDF. EMET also provides SCADA systems for water/electricity in the West Bank (“Hydraulic Apartheid”). Splunk’s monitoring of these SCADA systems implicates it in the discriminatory resource allocation of the occupation.⁵
• Foreign Military Financing (FMF) Loop: The IDF uses US FMF aid to purchase Splunk licenses through US distributors like Carahsoft. This creates a closed loop where US tax dollars subsidize the purchase of US surveillance tech for the Israeli military, with Splunk as the beneficiary. This effectively subsidizes the infrastructure of the occupation with US public funds.⁵

Counter-Arguments & Assessment:

• Argument: “We comply with all US laws regarding export.”
• Refutation: While legal under US law, the partnership with Matrix IT violates the international consensus on the illegality of settlements (Geneva Convention). The “laundering” of settlement goods/services is a specific violation of the UN Guiding Principles on Business and Human Rights.
• Argument: “We invest in the ‘Start-Up Nation’ for innovation, not politics.”
• Refutation: The “innovation” purchased (e.g., Robust Intelligence, CyberX) is derived directly from military service. The investment acts as a subsidy for the IDF’s R&D costs, validating the “military-to-civilian” pipeline.

Analytical Assessment:

Confidence: High. The existence of the subsidiary and the partnership with Matrix IT are matters of public record. The FMF funding pathway via Carahsoft is documented in US government contracts.

Intelligence Gaps:

• Specific invoices showing the transfer of funds from Matrix IT’s Modi’in Illit branch to Splunk Services Israel Ltd.

Named Entities / Evidence Map:

• Splunk Services Israel Ltd: Local subsidiary.
• Matrix IT: Settlement-complicit partner (Modi’in Illit).
• EMET Computing: Defense OEM.
• Carahsoft: US distributor for FMF.
• Robust Intelligence / CyberX: Acquired Israeli firms.

Domain 4: Political & Ideological Complicity (V-POL)

Goal: Highlight the “Safe Harbor” double standard and the militarization of corporate governance that aligns Splunk with the Zionist political project.

Evidence & Analysis:

Splunk’s governance exhibits a discriminatory application of “Corporate Social Responsibility” (CSR), revealing that its ethical frameworks are subservient to geopolitical alignment.

• The “Safe Harbor” Asymmetry:
  • Ukraine (2022): CEO Gary Steele invoked personal refugee history (“grandmother from Austria”) to humanize Ukrainians. Splunk deployed “cyber mission teams,” released free anti-wiper intelligence, and suspended Russia operations.
  • Gaza (2023-2024): Institutional silence. No humanization of Palestinian refugees. Continued operational support for the IDF (“Israel Rises”). Active targeting of pro-Palestine hacktivists (“Handala”).
  • Analysis: This proves that “Human Rights” at Splunk is a geopolitical construct, not a universal value. The company functions as an arm of US foreign policy, offering “Safe Harbor” only to Western-aligned victims. The refusal to suspend operations during a plausibly genocidal campaign underscores this bias.⁴
• Militarized Governance:
  • Orit Tessel (Board): Her background as an IDF Captain in Computer R&D ensures that the board understands the specific needs of the military. She serves as a bridge between military requirements and corporate strategy.
  • Raffi Kesten (Board): His role at JVP (Unit 8200 fund) and NDS/Cisco cements the link between the board and the occupation infrastructure.
  • Splunk Ventures: Investments in Ermetic and CyberX (founded by IDF special ops/intelligence) show a strategic commitment to financing the Israeli cyber-warfare ecosystem.⁴
• Internal Suppression: The designation of pro-Palestine sentiment as an “Internal Threat” and the retaliation against workers protesting Project Nimbus (within the Cisco ecosystem) creates a hostile environment for dissent, enforcing ideological conformity. This mirrors the behavior of a defense contractor rather than a diverse technology firm.⁴

Counter-Arguments & Assessment:

• Argument: “The Ukraine response was about complying with sanctions; Israel is a US ally.”
• Refutation: The Ukraine response went beyond sanctions (humanitarian rhetoric, proactive aid). The refusal to apply even neutrality to Gaza (by pausing military support) indicates active bias.
• Argument: “We have anti-discrimination policies.”
• Refutation: The “Safe Harbor” test proves these policies are selectively applied.

Analytical Assessment:

Confidence: High. The contrast in public statements and operational actions between the two conflicts is stark and documented. The biographical data of board members is verifiable.

Named Entities / Evidence Map:

• Gary Steele: CEO (Source of double standard rhetoric).
• Orit Tessel / Raffi Kesten: Board members with IDF/Occupation ties.
• Splunk Ventures: Funding vehicle.
• Handala: Hacktivist group targeted by Splunk.

5. BDS-1000 Classification

Results Summary:

Final Score: 677

Tier: Tier B (Severe Complicity)

Justification summary:

Splunk Inc., now a subsidiary of Cisco Systems, is a structurally integrated enabler of the Israeli military and surveillance apparatus. It scores exceptionally high in the Digital (V-DIG: 7.80) and Economic (V-ECON: 7.20) domains due to its role as the “operating system” for the Unit 8200 ecosystem and its active subsidiary’s support for the war economy. The Military (V-MIL) score reflects its critical function in “David’s Citadel” and the “Israel Rises” platform, serving as the logistical and intelligence backbone for the IDF. The Political (V-POL) score highlights a gross ethical asymmetry in its response to the Gaza genocide compared to the Ukraine war. The “Aggregator Nexus” (Matrix IT, Bynet) masks its direct involvement, but the forensic evidence confirms it is a “Tier 1” dual-use supplier.

Domain Scoring Summary

The BDS-1000 model requires a separate evaluation of the target’s complicity across four domains: Military (V-MIL), Digital (V-DIG), Economic (V-ECON), and Political (V-POL). Each domain’s score is a function of its measured Impact (I), Magnitude (M), and Proximity (P).

BDS-1000 Scoring Matrix – Splunk Inc.

Domain	I	M	P	V-Domain Score
Military (V-MIL)	3.5	8.5	6.5	3.25
Digital (V-DIG)	7.8	9.0	8.0	7.80
Economic (V-ECON)	7.2	7.0	10.0	7.20
Political (V-POL)	5.5	6.0	9.0	4.71

V- {domain} Calculation

• V-MIL Calculation:
• V-DIG Calculation:
• V-ECON Calculation:
• V-POL Calculation:

Final Composite

Using the OR-dominant formula with a side boost:

Let:

BRS Score Formula

Grade Classification:

Based on the score of 677, the company falls within:

• Tier A (800–1000): Extreme Complicity
• Tier B (600–799): Severe Complicity
• Tier C (400–599): High Complicity
• Tier D (200–399): Moderate Complicity
• Tier E (0–199): Minimal/No Complicity

Tier: Tier B

6. Recommended Action(s):

Public Exposure & Reputational Pressure:

Launch a targeted campaign highlighting the “Safe Harbor” double standard. Use the juxtaposition of CEO Gary Steele’s empathetic rhetoric on Ukraine against his silence on Gaza to pierce the “Corporate Social Responsibility” (CSR) shield. Demand that Splunk apply the same standard to Gaza that it applied to Russia: immediate suspension of operations and support for the aggressor. The narrative should focus on the hypocrisy of mobilizing for one victim while actively enabling the victimization of another.

Divestment:

Institutional investors and university endowments should be lobbied to divest from Cisco Systems (CSCO), citing its wholly-owned subsidiary Splunk’s deep integration into the Israeli military kill chain (“David’s Citadel”) and settlement economy (Matrix IT). The risk profile is no longer just “tech sector” but “defense contractor.” The structural integration into the kill chain poses significant ESG (Environmental, Social, and Governance) risks, particularly concerning human rights violations and international law.

Contractual Boycott:

Universities, municipal governments, and ethical corporations should review their SIEM/Observability contracts. Procurement officers should be informed that buying Splunk licenses subsidizes the R&D of the Israeli military-intelligence apparatus (“Unit 8200” ecosystem). Alternatives (e.g., Elastic, Datadog) should be explored, provided they pass similar vetting. The argument should be made that using Splunk contributes to the financial resilience of the Israeli war machine.

Legal & Regulatory Action:

File complaints with relevant trade bodies regarding the “Settlement Laundering” via Matrix IT. Investigate whether the deployment of Splunk in “Tech Hubs” on occupied land violates domestic laws regarding trade with illegal settlements in the UK, EU, or other jurisdictions. Challenge the use of “Blue and White” laundering for US FMF funds, potentially filing whistleblower complaints regarding the misuse of US taxpayer funds to support settlement activities.

Employee Mobilization:

Encourage tech workers within the Splunk/Cisco ecosystem to utilize the “Open Letter” strategy. Internal pressure regarding the “Israel Rises” platform and the targeting of pro-Palestine groups by the Threat Research Team can force transparency and potentially disrupt the “talent pipeline” from Unit 8200. Employees should be made aware of the “internal threat” designation and mobilized to protect their right to political expression.

1. https://medium.com/@marius.hole/splunk-the-beginning-a77977218e98
2. Splunk – 2026 Company Profile, Team, Funding, Competitors & Financials – Tracxn, accessed February 16, 2026, https://tracxn.com/d/companies/splunk/__puqiqnvz30T0eAvlcnU6-WIDJHNb9jclyNuFryW0dqU
3. Splunk – Wikipedia, accessed February 16, 2026, https://en.wikipedia.org/wiki/Splunk
4. Gary Steele’s Blog Posts | Splunk, accessed February 16, 2026, https://www.splunk.com/en_us/blog/author/garysteele.html
5. Splunk Government IT Procurement Contracts – Carahsoft, accessed February 16, 2026, https://www.carahsoft.com/splunk/contracts