Thales Group DIGITAL

Request ID: 7cc104a4-cf90-4360-9c44-0bc21b4151e3 Research cut-off: 29 September 2026

Enterprise Technology Stack & Vendor Relationships

• Israeli-origin vendor relationships. Thales advertises customer-facing integrations between its authentication products and Check Point gateways; between its CipherTrust platform and CyberArk Conjur; and between SafeNet Trusted Access and Palo Alto Networks’ Prisma Access, GlobalProtect, firewalls and Cortex XSOAR. The Palo Alto announcement dates to 2022. These documents establish interoperability and commercial collaboration, not Thales’s own internal subscriptions or the deployment of those combinations by any named Israeli customer.^{1, 2, 3}
• Scale of dependency. No public evidence identified for the scale of Thales’s internal use of Check Point, CyberArk, Palo Alto Networks, Wiz, SentinelOne, Nice, Verint or Claroty. The cited integrations are offered to customers; an enterprise-wide Thales dependency cannot be derived from them.^{1, 2, 3}
• Procurement and integrators. Polimil currently describes itself as a Thales partner in Israel and offers identification-system installation and support. Who Profits described it as a representative of Thales, formerly Gemalto, in information valid through March 2022. Neither account identifies an internal Thales IT procurement programme or a mandated Israeli-origin software stack.^{4, 5}

Surveillance, Biometrics & Retail Technology

• Biometrics. [pre-2020] Thales acquired Gemalto in April 2019; Thales describes digital identity and biometrics among the combined businesses’ technologies. The 2019 acquisition remains reflected in its current corporate portfolio.^{6, 7} Polimil currently says it has implemented Civil Administration photo-capture and smart-card issuance projects. Who Profits attributes 2017–2020 Meitar biometric-card, printer and maintenance contracts to Polimil and separately identifies its Thales representative relationship. Those records do not name the Thales component, if any, in a Meitar delivery; the status of that particular work after 2020 is unknown.^{4, 5}
• Israel Police AFIS. A March 2024 Thales letter filed in Israel’s government procurement portal states that Thales DIS Israel was the current service provider for the Israel National Police AFIS and the exclusive Israeli service provider for maintenance and support of Thales DIS USA’s CABIS 6 products.⁸ An August 2024 police intent-to-contract notice names Thales DIS Israel Ltd (company no. 520040031) as the supplier for AFIS technology adaptation/capability preservation, with a stated NIS 60.5 million value and an end date of 31 December 2029; a January 2025 exemption notice records the same supplier, value and end date for AFIS upgrade and maintenance.^{9, 10} A 2025 Israel Police RFI says its criminal CAFIS 6 system is maintained by Thales, has been active since January 2014, and is used for fingerprint and palm-print processing, suspect identification, crime-scene evidence, biometric-ID matching and interfaces with police and external systems.¹¹ These records establish a direct Thales-group police biometrics and maintenance relationship; they do not by themselves establish deployment at a settlement/checkpoint, military/intelligence use, or use against a particular person.
• Predictive analytics and monitoring. Imperva, acquired by Thales in December 2023, currently markets Data Security Fabric for discovery, monitoring and analysis of access to sensitive data. No public evidence identified of Thales using Israeli-origin predictive-policing, sentiment, retail-tracking or workforce-surveillance products.^{12, 13}
• Third-party deployment. The Polimil material establishes a reseller/integrator channel and its Civil Administration projects, but does not establish that an identified Thales product was bundled into those projects. No public evidence identified for Trigo, BriefCam, AnyVision/Oosto or Trax deployment by Thales.^{4, 5}

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

• Israeli infrastructure and data route. As observed in September 2026, Imperva’s service-status page lists an operational Tel Aviv, Israel point of presence. Imperva describes its points of presence as data centres that distribute application traffic and provide security and CDN functions; its Cloud WAF is offered for web applications. This establishes a group-operated Israeli edge location capable of serving the relevant product traffic. Public material reviewed does not identify a particular customer’s route, the data retained there, the legal entity operating the site, or remote-access controls.^{14, 15, 16}
• Government cloud. Thales described Google Cloud security integrations in 2025 and launched Imperva for Google Cloud in April 2026. On 28 September 2026 it announced a further Google Cloud collaboration concerning protection of agentic AI workflows. These are product and partner announcements; no public evidence identified of Thales participation in Project Nimbus or a specific Israeli government cloud contract.^{17, 18, 19}
• Sovereignty services to Israeli bodies. Thales announced UK-hosted Luna Cloud HSM availability in September 2026. No public evidence identified of an equivalent Israeli state or military data-sovereignty contract.²⁰

Defence, Intelligence & Security Sector Technology Relationships

• Contracts. The Israel Police AFIS procurement and maintenance relationship is directly documented in government procurement records and Thales’s own March 2024 letter.^{8, 9, 10, 11} Polimil currently lists the Israel Defense Forces and Ministry of Defense among its customers and says it delivered military identification-tag production systems. It also lists Thales as a partner. These statements do not connect a particular Thales product or contract to those defence customers. No public evidence identified of a direct Thales general-purpose IT, hosting or analytics contract with the Israeli defence or intelligence services.⁴
• Dual use. Thales’s acquired Imperva portfolio includes web application protection, DDoS protection, API security and data security. Those are general-purpose digital products. No public evidence identified in the reviewed records of their use by Israeli military or intelligence bodies or at a named occupied-territory installation.¹³
• Offensive cyber and digital weapons. No public evidence identified of a Thales offensive-cyber or exploit product deployed by an Israeli state actor in the scope of this audit. Purpose-built kinetic targeting or weapons effects require separate Military treatment.

AI, Algorithmic & Autonomous Systems

• General-purpose AI. Thales’s 28 September 2026 Google Cloud announcement describes safeguards for agentic workflows, including prompt injection, data leakage and unauthorised actions. No Israeli state customer is identified in that announcement.¹⁹
• Training data. No public evidence identified that a Thales or Imperva model was trained on civilian or intercepted data from Israel or the occupied territories.
• Autonomous tracking and lethality. No public evidence identified of a general-purpose Thales AI platform provided to Israeli forces for these uses. Systems designed primarily to generate kinetic targeting decisions fall outside Digital.

Technology Ecosystem & R&D Footprint

• R&D footprint. A November 2025 CTech report on Imperva after integration into Thales’s cyber division describes continuing development and research activity in Israel and says Tal Tikotzki would lead the Israel development and innovation centre. Thales completed the Imperva acquisition in December 2023 and integrated it into its cyber portfolio from 2024. This supports an ongoing Israeli development operation, but does not establish a current Israeli headcount, each team’s code access, customer-data access or tax residence.^{21, 13}
• Acquisitions. Thales acquired US-based Imperva for an announced enterprise value of $3.6 billion, completing the purchase on 4 December 2023. Imperva retained Israeli development activity after the acquisition; the target was described by Thales as US-based, so the acquisition should not be recast as the purchase of an Israeli-domiciled parent.^{22, 13, 21}
• Intellectual property and principals. No reviewed source provided a reliable current breakdown linking Imperva patents to a named Israeli research institution. Dassault Aviation’s September 2026 organisation chart lists a 27% Thales holding. No public evidence identified of a relevant Israeli cyber or surveillance investment by Dassault Aviation or Thales chair and CEO Patrice Caine in the reviewed documents.²³

Civil Society Scrutiny & Regulatory History

• Investigations. Who Profits documents Polimil’s 2017–2020 Meitar work and separately names its Thales representative relationship; its page does not establish a Thales-made component in Meitar. AFSC’s Thales profile addresses other biometric and government contracting, principally outside Israel. No source reviewed identifies a Thales technology contract within an Israeli settlement.^{5, 24}
• Campaigns. The Association France Palestine Solidarité reported actions at two Thales sites near Orléans on 20 May 2025, distributing material alleging involvement in arming Israel. This documents an organised campaign and its stated grounds, not the truth of a specific Digital supply allegation. No documented company response to that action was identified.²⁵
• Regulatory or legal action. No public evidence identified of a regulator finding, export-control action or court decision specifically concerning Thales digital-technology sales to an Israeli state body.