BDS-1000 Dossier: Splunk Inc.

Key Findings

• Military: The IDF publicly acknowledged Splunk as a data-extraction supplier, with an Israeli military statement describing “an extensive range of agreements with suppliers in the field of data extraction, including the Splunk Company, for the benefit of improving the operational effectiveness of the IDF” - a relationship reached through the Israeli integrator EMET Computing rather than a disclosed direct Splunk-corporate contract.¹
• Digital/Economic: Splunk Ventures took a strategic minority stake in Tel Aviv cloud-security firm Ermetic in March 2022 (later acquired by Tenable), and Splunk’s SIEM platform is used by Israel’s Ministry of Energy to monitor SCADA/OT systems protecting national power-grid infrastructure.²³
• Political: Since Cisco Systems completed its ~$28 billion acquisition of Splunk in March 2024, Splunk sits inside a parent company that BDS Movement targets by name over networking, computing and cybersecurity supply to the Israeli military and Ministry of Defense, and for which Who Profits maintains a dedicated corporate profile.⁴⁵
• Not found: No direct Splunk-corporate contract with the IDF, no Splunk integration into any named weapons system, and no Israeli-founded company among Splunk’s roughly twenty acquisitions were identified; Splunk itself carries no Who Profits database entry and appears on no BDS boycott list.¹⁶⁷⁸

Target Profile

Key Facts:

• Founded 2003 in San Francisco by Michael Baum, Rob Das and Erik Swan.¹⁰
• Splunk Services Israel Ltd. incorporated 16 June 2019 (ICA 516040250), Hamelacha 32, Netanya; active filings continue through January 2026.¹¹¹²
• Cisco Systems completed its acquisition of Splunk on 18 March 2024 (~$28bn, $157/share); Splunk ceased to be an independent public company.⁹
• US Department of Defense designated Splunk Enterprise a Core Enterprise Technology in March 2021 (10-year, $833m ceiling, Carahsoft-administered) - a US, not Israeli, defence relationship.¹³

Executive Summary

Splunk Inc. is a US-founded enterprise software company whose core product - a security-information-and-event-management (SIEM) and data-analytics platform - ingests and analyses machine-generated data at scale for network, endpoint, and infrastructure monitoring. Since 18 March 2024 it has operated as a wholly-owned business unit of Cisco Systems, following an all-cash acquisition valued at roughly $28 billion.⁹ Splunk’s documented Israel/Palestine nexus is real but comparatively narrow and largely indirect: it consists of a commercial footprint inside Israel (a wholly-owned local subsidiary, a customer base built through a local reseller, and one confirmed government customer), a single confirmed venture investment in an Israeli company, and - since the 2024 acquisition - corporate embedding inside a parent, Cisco, whose own Israel-Palestine record is extensive and independently documented.

The strongest documented vectors are, first, an Israeli Ministry of Defense acknowledgment that the IDF is “one of Splunk’s major clients in Israel,” using Splunk software for “data extraction” via the local integrator EMET Computing - a reseller-mediated, IDF-sourced confirmation rather than a disclosed Splunk-corporate contract.¹ Second, Splunk maintains a wholly-owned Israeli subsidiary, Splunk Services Israel Ltd. (Netanya, incorporated June 2019), and Splunk/Cisco job postings include a dedicated “Regional Sales Manager, MOD” role explicitly targeting Israeli Ministry of Defense accounts, indicating active, ongoing commercial pursuit of Israeli defence-sector business.¹¹¹⁴ Third, Splunk’s platform is confirmed in use by Israel’s Ministry of Energy to monitor SCADA/OT systems protecting national power-grid critical infrastructure, and Splunk Ventures made a strategic minority investment in the Tel Aviv cybersecurity firm Ermetic in March 2022 (subsequently acquired by Tenable).³² Fourth, and now dominant in scale, Splunk’s 2024 absorption into Cisco places it inside a corporate parent with an extensive, independently documented history of direct Israeli military and Ministry of Defense supply - including a 2013 communications contract, a 2017 Foreign-Military-Sales-funded server tender, hardware underpinning the “David’s Citadel” military data center, and technology-hub deployments in West Bank settlements and the occupied Golan Heights - none of which is a Splunk-brand act but all of which now sits above Splunk in its corporate structure.¹⁵¹⁶

Several claims that might be expected in a dossier of this kind are explicitly not supported by the audits. No public evidence was identified of a direct Splunk-corporate procurement contract with the IDF (the relationship is IDF-acknowledged but reseller-mediated); no evidence confirms Splunk software integration into any named weapons platform such as Elbit’s Fire Weaver or the IDF’s TZAYAD system, despite press speculation to that effect; no Israeli-founded or Israeli-domiciled company appears among Splunk’s roughly twenty corporate acquisitions; Splunk carries no entry in the Who Profits database and appears on no BDS boycott list; and neither Splunk nor Cisco is named in the UN OHCHR “Database of Business Enterprises” or in the body of UN Special Rapporteur Francesca Albanese’s 2025 report on the Palestinian occupation economy, which does name other technology firms.^6781718 No Splunk-specific corporate statement on the Israel-Palestine conflict, and no Splunk-specific (pre-acquisition) employee action or controversy on the subject, was identified - a notable contrast with Splunk’s own 2022 public statement on the Russia-Ukraine war.¹⁹

The resulting BDS-1000 V4 score is BRS 736, Tier B (Severe), driven principally by Political (7.71) and Economic (7.43). This reflects a documented, multi-year direct commercial and subsidiary presence in Israel (reaching into the defence-sales pipeline) combined with the post-2024 political exposure of sitting inside Cisco’s extensively documented military-supply and settlement-technology relationship - while Military (6.43) and Digital (6.50) score lower, reflecting that Splunk’s own military and technology nexus is reseller-mediated, unconfirmed at the weapons-integration level, and limited to one venture investment rather than direct Israeli R&D or acquisitions.

Timeline of Relevant Events

Corporate Overview

Splunk Inc. was an independent, San-Francisco-founded, NASDAQ-listed (SPLK) enterprise software company until 18 March 2024, when it became a wholly-owned subsidiary of Cisco Systems following an all-cash acquisition of roughly $28 billion.⁹¹⁰ Its core commercial products - Splunk Enterprise, Splunk Cloud Platform, Enterprise Security, SOAR and UEBA - are self-developed in the United States; no public evidence identifies any Splunk product as Israeli-developed or Israeli-originated.

Splunk’s Israeli footprint runs through two distinct channels. First, a reseller/integrator relationship: before establishing its own subsidiary, Splunk’s Israeli go-to-market relied on EMET Computing (EMET Group), a local value-added reseller, through which the IDF became a confirmed customer.¹ Second, direct corporate presence: Splunk Services Israel Ltd. (ICA 516040250), incorporated 16 June 2019 in Netanya, is a wholly-owned operational subsidiary whose public job postings indicate a sales/sales-engineering function; the subsidiary remains active, with filings updated as recently as January 2026, and continues under Cisco ownership post-acquisition.¹¹¹²

Across roughly eighteen to twenty-two corporate acquisitions between 2013 and 2026, no Israeli-founded or Israeli-domiciled company was identified in Splunk’s history; acquired companies are predominantly US-incorporated (e.g., Caspida and Phantom Cyber, both Palo Alto, California), with occasional non-Israeli international exceptions (Plumbr, Estonia; BugSense, Greece).⁶²² Separately, Splunk Ventures - the corporate venture arm - made a minority strategic investment in Ermetic, a genuinely Israeli-domiciled (Tel Aviv) cloud-security company, in March 2022; Ermetic was later acquired by Tenable, not Splunk.²²¹ No franchise, joint-venture, or licensing relationship with an Israeli defence prime (Elbit Systems, Rafael, Israel Aerospace Industries) was identified in any Splunk marketing material, case study, or public filing.

Since March 2024, Splunk’s corporate structure sits beneath Cisco Systems (NASDAQ: CSCO, San Jose, California), a US corporation with no documented Israeli state or sovereign-fund ownership. Cisco’s own, separately documented Israeli military-supply relationships, Israeli acquisitions, and settlement-zone technology deployments are attributed at the parent level in this dossier and are not treated as Splunk-brand acts, consistent with the underlying domain audits.⁴¹⁵¹⁶

Domain Summaries

Military: Military

Mechanism of Involvement

Splunk’s core product is dual-use enterprise software (SIEM/data-analytics), not a weapons system, munition, or piece of physical military hardware. The documented military-relevant channel is the IDF’s own acknowledgment - reported by the Israeli trade outlet Israel Defense in January 2019 - that “the IDF maintains an extensive range of agreements with suppliers in the field of data extraction, including the Splunk Company, for the benefit of improving the operational effectiveness of the IDF,” reached via the integrator EMET Computing rather than a disclosed direct Splunk-corporate contract.¹ The article speculated about relevance to IDF systems such as TZAYAD (Digital Land Army) and the Elbit-developed Fire Weaver fire-control system but did not assert that Splunk powers either.¹ Separately, and unrelated to Israel, the US Department of Defense designated Splunk Enterprise a Core Enterprise Technology in March 2021 ($833m ceiling, Carahsoft-administered, DISA Impact Level 5 authorization), and Splunk markets an “Aerospace & Defense” vertical naming Lockheed Martin, MITRE and SAIC as customers - all US entities, with no Israeli defence prime named.¹³²³ Splunk’s products are classified under US EAR as ECCN 5D002 (dual-use information-security software), exportable under license exception ENC.²⁴

Counter-Arguments and Evidence Limits

No public evidence identifies a direct Splunk-corporate contract with the IDF, a contract value, or a specific military unit; the confirmed relationship exists at the reseller/integrator tier (Splunk → EMET Computing → IDF). No Splunk-Elbit or Splunk-TZAYAD integration is confirmed anywhere in public sources - the Israel Defense article explicitly contextualises rather than asserts such integration.¹ No Israeli defence-prime supply relationship (Elbit, Rafael, IAI) is documented. Splunk carries no entry in the Who Profits database, and no BDS-movement boycott campaign names Splunk specifically, in contrast to the BDS campaign that explicitly targets Cisco, Splunk’s post-2024 parent.⁷⁸⁴ No export-enforcement action, ITAR violation, or sanction involving Splunk was identified.

Named Entities and Evidence Map

Israel Defense Forces (IDF) - acknowledged customer via reseller.¹ EMET Computing - Israeli integrator/reseller.¹ Splunk Services Israel Ltd. - Netanya subsidiary.¹¹ US Department of Defense / Carahsoft - direct US (non-Israeli) contracting.¹³ Lockheed Martin, MITRE, SAIC - named US aerospace/defence customers.²³ Cisco Systems (parent, since March 2024) - separate, extensively documented Israeli military-supplier relationships attributed at parent level, not to Splunk-brand.⁴¹⁵

Digital: Digital

Mechanism of Involvement

Splunk’s flagship technology is, by design, a large-scale data-aggregation, indexing and search platform with integrated User and Entity Behaviour Analytics (UEBA) - enabling real-time behavioural monitoring, anomaly detection and insider-threat identification, a class of capability that is surveillance-adjacent by design.²⁵ Splunk maintains a wholly-owned Israeli subsidiary, Splunk Services Israel Ltd. (Netanya, incorporated June 2019), confirmed in SEC subsidiary-schedule filings for fiscal years 2022 and 2023.¹¹²⁶²⁷ Splunk Ventures made a strategic minority investment in Tel Aviv-based cloud-security firm Ermetic in March 2022 (subsequently acquired by Tenable in 2023 for roughly $265–350 million) - the only confirmed Israeli-domiciled company across Splunk’s identified acquisition and investment record.²²¹ Israel’s Ministry of Energy is a confirmed Splunk customer, using Splunk Enterprise with machine learning as a centralised SIEM to monitor SCADA/OT environments protecting national power-grid critical infrastructure.³ Splunk exhibited at Cybertech Tel Aviv 2020 and maintains an active, Splunk-branded Israel Splunk User Group.²⁰²⁸

Counter-Arguments and Evidence Limits

Across roughly eighteen to twenty-two Splunk acquisitions, none was Israeli-founded or Israeli-domiciled (specifically checked: Caspida and Phantom Cyber, both Palo Alto, California; Plumbr, Estonia; BugSense, Greece).⁶²² Splunk Cloud Platform lets customers choose a data-storage region among AWS, Azure or Google Cloud, but no Israel-specific Splunk Cloud region or sovereign-cloud participation was identified.²⁹ No public evidence identifies Splunk supplying biometric products, retail-surveillance products, or any purpose-built surveillance system to Israeli entities beyond its general-purpose data platform. No civil-society organisation or regulator was identified as having published a specific investigation into Splunk’s Israel operations or its use by the IDF.

Named Entities and Evidence Map

Splunk Services Israel Ltd. - Netanya subsidiary, sales/services function.¹¹¹² Ermetic (Tel Aviv) - Splunk Ventures strategic investment, later acquired by Tenable.²²¹ Israeli Ministry of Energy - confirmed SIEM/SCADA customer.³ Israel Splunk User Group - community/marketing channel.²⁸ Cisco Systems (parent) - separate Israel R&D presence and Israeli acquisitions (e.g., Kenna Security, Leaba Semiconductor), attributed at parent level and not merged into Splunk-brand product lines as of the audits’ compilation.

Economic: Economic

Mechanism of Involvement

Splunk is a software-only platform company with no hardware manufacturing or physical-goods supply chain; its Israeli economic footprint runs through direct capital deployment (the wholly-owned Splunk Services Israel Ltd. subsidiary, incorporated June 2019 in Netanya) and, before that, a reseller relationship with the Israeli integrator EMET Computing, which built an estimated 200 Israeli clients including the IDF by January 2019.¹¹¹ Splunk/Cisco job postings include a dedicated “Regional Sales Manager, MOD” role explicitly targeting Israeli Ministry of Defense accounts, alongside a general “Regional Sales Manager, Israel” role - signalling active, ongoing commercial pursuit of Israeli defence-sector contracts at the Splunk-corporate sales level.¹⁴ Splunk has also hosted a Splunk Leadership Forum in Tel Aviv and exhibited at Cybertech Global Tel Aviv 2020.³⁰²⁰ Since 18 March 2024, Splunk Inc. is wholly owned by Cisco Systems ($28 billion all-cash acquisition); Israeli-customer revenue, including any IDF-linked contracts, is consolidated upward into Cisco’s US-parent financials, with no Israel-segment financial disclosure identified in either Splunk’s pre-acquisition SEC filings or Cisco’s post-acquisition filings.⁹

Counter-Arguments and Evidence Limits

No Israeli sovereign fund, institutional investor, or state entity is documented as a material shareholder of either Splunk Inc. (pre-acquisition, NASDAQ: SPLK) or Cisco Systems.⁹ No Israeli-founded or Israeli-domiciled company was identified among Splunk’s roughly twenty corporate acquisitions.⁶²² The pre-2019 Israeli customer relationship ran through an independent third-party reseller (EMET Computing), not direct Splunk-corporate supply-chain sourcing, and no evidence indicates EMET or any Israeli channel partner contributes to Splunk’s product development.¹ No disaggregated Israel-specific revenue, profit, or tax figures are publicly disclosed for the subsidiary at any point in the record reviewed.

Named Entities and Evidence Map

Splunk Services Israel Ltd. (ICA 516040250, Netanya) - wholly-owned subsidiary, active filings through January 2026.¹¹¹² EMET Computing - reseller/integrator, pre-2019 IDF relationship.¹ Cisco Systems - parent since March 2024, consolidates Splunk’s global (including Israeli) revenue.⁹ Israeli Ministry of Defense - target of a dedicated Splunk/Cisco sales role.¹⁴

Political: Political

Mechanism of Involvement

No standalone public statement from Splunk Inc., as an independent company prior to 18 March 2024, addressing the Israel-Palestine conflict was identified - a notable contrast with Splunk’s own 5 March 2022 public blog post, “Cybersecurity and the Crisis in Ukraine,” addressing customer concerns about the Russia-Ukraine war.¹⁹ Since the Cisco acquisition, Splunk’s public communications posture is governed by its parent: Cisco CEO Chuck Robbins stated in October 2023 that Cisco teams “have been working day and night to ship our technology to Israel…at the request of the country,” and in March 2025 a Cisco executive characterised the Middle East conflict as “too hard, too painful, too divisive,” with Chief People, Policy & Purpose Officer Francine Katsoudas subsequently banning internal discussion of the conflict company-wide.³¹ Cisco itself has an extensively and independently documented direct military/Ministry-of-Defense supply history in Israel - including a 2013 communications-equipment contract, a 2017 Foreign-Military-Sales-funded server tender, hardware underpinning the “David’s Citadel” underground military data center, a 2020 Unified Communications rollout across Israeli military units, an October 2023 “Israel Rises” Home Front Command platform, and a November 2023 Webex sale via reseller Bynet - together with civil-society/press allegations, characterised in the audit as third-party attribution rather than confirmed primary disclosure, linking Cisco infrastructure to Israeli military AI-assisted targeting systems (“The Gospel,” “Lavender,” “Where’s Daddy?,” “Blue Wolf”).¹⁵³² Cisco also deployed technology hubs (“Klika”/Digital Hubs) in five West Bank settlements and two sites in the occupied Golan Heights, and entered a 2017 MOU with the Jerusalem Municipality for city-wide CCTV/communications infrastructure.¹⁶ Reported Cisco employee dissent includes the “Bridge to Humanity” group, a “WatermelonBot” divestment petition (~1,770 signatures, June–July 2024, later terminated by Cisco), December 2024 EEOC/NLRB/California Labor Commissioner complaints, a March 2025 employee termination and deletion of the B2H chat room, and an October 2025 public resignation citing Cisco’s Israel ties.³³ Cisco has also conducted restructuring affecting its Israeli operations as part of a broader global reduction, and Splunk itself announced a 7% workforce reduction following the acquisition announcement.

Counter-Arguments and Evidence Limits

Splunk Inc., prior to the March 2024 acquisition, generated no documented public statement, employee controversy, or advocacy record on the Israel-Palestine conflict of any kind - the entire political-exposure record identified in the audit is either (a) Splunk’s own civilian, energy-sector customer relationship and user-group/conference activity, or (b) attributable to its post-2024 parent, Cisco, and not to Splunk-brand conduct. Neither Splunk nor Cisco is named in the Wikipedia-compiled listing of the UN OHCHR “Database of Business Enterprises” (HRC resolutions 31/36/53/25) - a material negative finding given the extent of civil-society documentation of Cisco’s military-supplier relationship - nor in the body of UN Special Rapporteur Francesca Albanese’s 2025 report “From economy of occupation to economy of genocide” (A/HRC/59/23), which does name other technology firms (Microsoft, Alphabet, Palantir).¹⁷¹⁸ OpenSecrets records no reported federal lobbying activity or outside spending by Splunk Inc. for the 2022 election cycle, and no Splunk-specific PAC donations or Israel/Palestine-tied lobbying were identified.³⁴ Splunk’s own philanthropic program, Splunk Pledge, shows no identified Israel-specific direction in its published nonprofit-eligibility criteria.³⁵ Cisco’s characterisation of its Israel relationship as a “country” partnership request, rather than as commercial sales, cuts against a straightforward defence framing and is presented here as documented context rather than exculpation, per the underlying audit’s own caveats.

Named Entities and Evidence Map

Cisco Systems (parent, since March 2024) - Chuck Robbins (CEO), Francine Katsoudas (Chief People, Policy & Purpose Officer).³¹ Bridge to Humanity / WatermelonBot - Cisco employee dissent group and tool.³³ Jerusalem Municipality - 2017 Smart City MOU (Cisco).¹⁶ Klika/Digital Hubs - West Bank settlement and Golan Heights technology-hub sites (Cisco).¹⁶ UN OHCHR - Database of Business Enterprises (neither Cisco nor Splunk listed).¹⁷ Francesca Albanese (UN Special Rapporteur) - A/HRC/59/23 report (Splunk/Cisco not named).¹⁸ OpenSecrets - Splunk Inc. lobbying-disclosure profile (no activity recorded).³⁴

BDS-1000 Score (V4)

• V_MAX: 7.71 Sum_OTHERS: 20.36
• BRS Score: 736 Tier: B (Severe)

V_MAX is set by Political (7.71), reflecting the political-exposure weight of Splunk’s post-2024 embedding inside Cisco’s extensively documented Israeli military-supply and settlement-technology record, compounded by an active, ongoing Splunk/Cisco sales push into the Israeli Ministry of Defense. Economic (7.43) is the second-highest driver, reflecting Splunk’s own direct and continuous economic presence in Israel - a wholly-owned subsidiary, a reseller-built customer base including the IDF, and defence-targeted sales roles - while the comparatively lower Military (6.43) and Digital (6.50) scores reflect that Splunk’s own military and technology nexus is reseller-mediated and limited to a single confirmed venture investment, with no confirmed weapons-system integration or Israeli acquisition. The score is produced by the fixed, human-vetted BDS-1000 V4 methodology: scale-free Impact (I) × magnitude (M) × proximity/directness (P) per domain, combined across the four domains via V_MAX and Sum_OTHERS into a Business Risk Score (BRS), placing Splunk in Tier B (Severe).

Methodology Note

• Scoring draws exclusively on the four domain audits (Military, Digital, Economic, Political) compiled via live web search; no claim in this dossier goes beyond what those audits documented.
• Impact (I) reflects the category/type of activity engaged in per domain; Magnitude (M) reflects its documented scale; Proximity (P) reflects directness of the entity’s link to Israeli military, occupation, or political-conflict activity - each scored per domain, then combined into a single V-Domain score.
• Temporal rule: divested, exited, or reseller-superseded operations are noted and mitigated in scoring rather than treated as current, ongoing conduct; where the audits marked a relationship as historical (e.g., the pre-2019 EMET Computing reseller phase) or exited (e.g., Ermetic’s sale to Tenable), that status is carried forward here.
• Entity attribution follows a no-transitive-guilt rule: acts and relationships documented at the Cisco-parent level (post-March 2024) are identified as such throughout this dossier and are not presented as Splunk-brand conduct, even where they affect the surrounding political-exposure picture.
• Where an operation functions as a documented settlement-linked deployment, it is eligible for dual-counting across Economic and Political per the fixed methodology; no such Splunk-brand (as opposed to Cisco-parent) settlement deployment was identified in the audits.
• “No public evidence identified” is used throughout, exactly as in the source audits, wherever a specific check (e.g., Israeli acquisitions, weapons-system integration, ITAR violations, OHCHR/Albanese-report naming) returned nothing.

End Notes