Audit Phase: V-DIG
Entities in Scope: The Coca-Cola Company (TCCC); Coca-Cola Europacific Partners (CCEP); Coca-Cola HBC (CCHBC); Central Bottling Company (CBC / Coca-Cola Israel)
Research Date: 2026-05-01
Two major Coca-Cola system bottlers are confirmed, vendor-documented CyberArk customers.
Coca-Cola Europacific Partners (CCEP): CyberArk published a named case study describing CCEP’s enterprise-wide deployment of CyberArk for privileged access management. CCEP Deputy CISO Mukesh Kapadia is quoted directly, characterising CyberArk as “critical for mitigating risk” and confirming it provides visibility into “how every privileged account is being used” across the organisation.1 The framing of this deployment — authored by the Deputy CISO and foregrounding enterprise-wide coverage — indicates core infrastructure integration rather than a peripheral pilot.
Coca-Cola HBC (CCHBC): CyberArk issued a press release confirming that Coca-Cola HBC selected CyberArk for identity security.2 The nature and scope of the deployment are not detailed in available public materials.
CyberArk is an Israeli-founded company with significant R&D operations in Israel, co-headquartered in Newton, MA.18 Both deployments represent ongoing, operational relationships with Israeli-origin security technology embedded at privileged-access layers of enterprise infrastructure.
Trax, an Israeli-founded company with R&D operations in Israel, is documented as a retail execution partner for Coca-Cola Amatil (now Coca-Cola Europacific Partners, following the 2021 merger). A published case study describes Coca-Cola Amatil’s deployment of Trax’s computer vision platform for retail shelf analytics and field force execution optimisation, with a cited outcome of a 1.5% market share increase over five months.3 Trax’s own product pages confirm the shelf-execution analytics offering underpinning this deployment.16
Wiz is an Israeli-founded cloud security company (Cloud-Native Application Protection Platform). Its four co-founders — Assaf Rappaport, Yinon Costica, Roy Reznik, and Ami Luttwak — are documented alumni of Israeli military intelligence Unit 8200.1025
In August 2021, Wiz researchers discovered and disclosed the ChaosDB vulnerability (CVE-2021-33762) in Microsoft Azure’s Cosmos DB service. Secondary reporting confirmed that approximately 3,300 Azure Cosmos DB customers were notified by Microsoft of potential exposure, with multiple sources noting the affected population included Fortune 500 companies.131426 The prior research document asserts that Wiz explicitly named Coca-Cola as an affected customer. This specific claim — that Coca-Cola was named in Wiz’s primary disclosure — is not independently confirmable from the secondary sources available; Wiz’s disclosure listed categories of affected customer types rather than a published named roster. The ChaosDB incident itself is verified; Coca-Cola’s specific naming in Wiz’s primary disclosure remains unverified pending direct access to Wiz’s original publication.
Check Point Software Technologies is an Israeli-founded company; founder Gil Shwed is a documented Unit 8200 alumnus.18 In 2024, Check Point and Wiz announced a strategic partnership to deliver integrated cloud network security.1112
The prior research document asserted a Coca-Cola / Check Point customer relationship. No public evidence has been identified to support this claim in the cited sources or in available training knowledge. The cited Check Point–Wiz partnership articles1112 describe the inter-vendor partnership only and do not reference Coca-Cola as a customer of either party in this context. The prior document’s claim appears to be an inference from industry norms rather than a documented relationship. No public evidence identified of a named Coca-Cola / Check Point contractual relationship.
Claroty is an Israeli-origin industrial cybersecurity company incubated by Team8, a venture group founded by Nadav Zafrir, a former commander of Unit 8200. Claroty secured a $140 million funding round in 2021.17 The prior research document asserted that CCEP is a named public reference customer for Claroty. This claim is not confirmed in Claroty’s published press releases or funding announcements, and training knowledge does not independently identify CCEP in Claroty’s customer reference materials.1727 No public evidence identified of a named CCEP / Claroty contractual relationship from primary sources.
The prior research document asserts CBC uses SAP ERP on Microsoft Azure infrastructure. SAP is a German company. Microsoft Azure is a US company with a significant commercial footprint in Israel, including a local Azure region. The claim that CBC uses Azure infrastructure is commercially plausible but is sourced from materials of uncertain or dated provenance.33 Verification status: Partially supported by general commercial context; the specific CBC–Azure data infrastructure relationship is unverified from primary corporate disclosures.
No public evidence has been identified of systems integrators (e.g., Accenture, IBM, Deloitte) mandating or deploying Israeli-origin technology as part of documented TCCC enterprise transformation programmes. No integrator-mediated Israeli-origin technology relationship is established in available sources.
Trax’s deployed technology uses computer vision to analyse retail shelf imagery for execution compliance, share-of-shelf, and competitive monitoring. The Coca-Cola Amatil deployment is operational-scale, involving field force optimisation across retail accounts.316 Trax is Israeli-founded with Israel-based R&D.
Trigo is an Israeli company providing autonomous store technology using ceiling-mounted camera arrays and computer vision for “just walk out” checkout experiences. Trigo’s documented retail partners include Tesco (UK), REWE (Germany), and Aldi (US trials).2231 The prior research document claimed Costa Coffee (a TCCC subsidiary) is pursuing Trigo as a potential partner. No public announcement, press release, or news report of a Costa Coffee / Trigo partnership or pilot has been identified. This claim is explicitly an industry-trend inference in the prior document and is unverified. Trigo’s existence, Israeli origin, and retail deployments with third-party retailers are verified.222331
No public evidence has been identified of TCCC, CCEP, CCHBC, or CBC directly deploying facial recognition or biometric identification technologies, whether from Israeli-origin vendors (BriefCam, AnyVision/Oosto) or otherwise. No public evidence identified.
No public evidence has been identified of TCCC or bottling entities deploying Israeli-origin predictive policing, sentiment analysis, social media monitoring, or workforce surveillance tools. No public evidence identified.
No public evidence has been identified of Israeli-origin surveillance technologies reaching TCCC indirectly via managed service bundles, beyond the direct relationships documented above. No public evidence identified.
No public evidence has been identified that TCCC, CCEP, CCHBC, or CBC operates, leases, or co-locates dedicated data centre infrastructure within Israel. The annual reports of TCCC,19 CCEP,20 and CCHBC21 do not disclose Israel-specific infrastructure arrangements in publicly available summaries. No public evidence identified.
Project Nimbus is a verified $1.2 billion Israeli government cloud contract awarded to Google Cloud and Amazon Web Services in 2021, with Microsoft Azure operating a parallel commercial cloud region in Israel.15 TCCC and its principal bottling entities are not parties to Project Nimbus. The prior research document advanced a co-tenancy argument: that CBC, as a hypothesised Microsoft Azure customer in Israel, uses infrastructure shared with Project Nimbus workloads. This is an inferential co-tenancy argument, not a documented contractual or procurement relationship. No public evidence identified that TCCC or any bottler is a participant in, contractor to, or named supplier under Project Nimbus.
No public evidence has been identified that TCCC provides services marketed or contracted to ensure digital sovereignty or infrastructure resilience for Israeli state institutions or military bodies. No public evidence identified.
No public evidence has been identified of contracts, partnerships, or service agreements between TCCC, CCEP, CCHBC, or CBC and the Israeli Ministry of Defence, the Israel Defense Forces, or Israeli intelligence agencies. Review of TCCC annual reports,19 CCEP annual reports,20 CCHBC annual reports,21 and NGO research databases415 did not surface any such relationship. No public evidence identified.
No public evidence has been identified that commercially available TCCC technologies have been reported as deployed for military, intelligence, or law enforcement surveillance within Israel or the occupied Palestinian territories. No public evidence identified.
TCCC is a beverage manufacturer with no documented cyber-offensive capability. No public evidence identified. This sub-domain is not applicable.
No public evidence has been identified of TCCC, CCEP, CCHBC, or CBC providing AI or machine learning systems to Israeli state or military entities. No public evidence identified.
No public evidence has been identified of TCCC contributing training data, model development resources, or AI research partnerships to Israeli state, military, or dual-use AI programmes. No public evidence identified.
TCCC’s Trax deployment at Coca-Cola Amatil involves computer vision and machine learning for retail shelf analysis.316 This is a commercial retail analytics application with no documented defence, security, or autonomous decision-making application beyond shelf compliance. No connection to lethal autonomous systems has been identified or is plausible for a beverage company. No public evidence identified of any connection to autonomous weapons or lethal decision systems.
TCCC launched “The Bridge” commercialisation programme in Tel Aviv in 2014, explicitly designed to identify and pilot Israeli startups for integration into TCCC’s global commercial operations.8 Marketing Dive documented the programme’s launch and stated intent. PitchBook lists The Bridge as an investor entity with a portfolio of startups, predominantly Israeli-founded.9 The programme represents a structured, institutionalised technology scouting and co-development pipeline between TCCC and the Israeli startup ecosystem.
Documented Bridge Portfolio Companies:
Bringg: Israeli-founded logistics orchestration platform (Tel Aviv). CEO Raanan Cohen has given on-record interviews describing Coca-Cola as an early customer and validator of the Bringg platform.29 PitchBook lists Bringg in The Bridge portfolio.9 The Bringg relationship — as a Bridge portfolio company and Coca-Cola customer — is consistent across multiple independent sources.
Cimagine: Israeli augmented reality startup. The prior document states Cimagine was incubated via The Bridge and subsequently acquired by Snap Inc. in December 2017. Snap’s acquisition of Cimagine Media is a publicly documented M&A event consistent with training knowledge.24 Cimagine is cited in reporting on Israeli startup activity at the 2019 Mind the Tech London event and prior TCCC tech partnerships.24
Market Beyond: Shopper intelligence platform. The prior document asserts Market Beyond was validated through The Bridge and that its advisory board included Pinhas Buchris — identified as a former Director General of the Israeli Ministry of Defence and former commander of Unit 8200.24 Buchris’s senior MoD and Unit 8200 roles are verifiable from his public profile and consistent with training knowledge. The specific claim that he served on Market Beyond’s advisory board and that Market Beyond participated in The Bridge is sourced from a single 2019 trade event article.24 Verification status: Buchris’s background is verifiable; his specific role at Market Beyond and Market Beyond’s Bridge participation require primary source confirmation.
DOV-E: Ultrasonic connectivity startup. The prior document asserts DOV-E founders are Unit 8200 veterans, cited to the same 2019 Calcalist event coverage.24 Verification status: Unverified from primary sources — this claim rests on a single secondary trade event article.
Mindset Ventures, an Israeli-Brazilian venture fund, lists portfolio companies consistent with the TCCC technology and beverage innovation space.30 No direct documented investment relationship between TCCC and Mindset Ventures has been identified in available sources.
The Central Bottling Company (CBC), TCCC’s Israeli franchise, formed a partnership with Brevel, an Israeli agri-food technology startup, in 2023 to develop algae-derived functional beverages and dairy alternatives.7 This relationship is within the food and beverage R&D space and documents CBC’s active participation in the Israeli startup ecosystem independent of TCCC’s Bridge programme.
No evidence has been identified that TCCC has directly acquired an Israeli-origin technology company. The Bridge operated as an accelerator and pilot programme, not a formal acquisition vehicle in documented cases. Cimagine was acquired by Snap Inc., not TCCC.24 No public evidence identified of strategic TCCC investments in Israeli venture capital funds.
No public evidence has been identified of patent portfolios, licensing agreements, or co-development arrangements between TCCC and Israeli research institutions (Technion, Hebrew University, Weizmann Institute). Review of TCCC’s ESG and sustainability reporting32 and annual filings19 did not surface any such arrangement. No public evidence identified.
Who Profits Research Center: Who Profits, an Israeli NGO researching corporate involvement in the occupation of Palestinian and Syrian territories, maintains a public corporate profile on The Central Bottling Company (CBC / Coca-Cola Israel).4 The profile documents CBC’s commercial operations and its presence in the Atarot Industrial Zone in occupied East Jerusalem. Who Profits classifies Atarot as a settlement industrial zone situated on confiscated Palestinian land.
PAX “Don’t Buy Into Occupation” (November 2025): PAX for Peace published its 2025 edition of the “Don’t Buy Into Occupation” report, which examines corporate presence in the occupied territories.15 The report is consistent with PAX’s periodic publication series on this subject. The specific content regarding TCCC or CBC in the 2025 edition was not independently confirmable in this research session.
Atarot Industrial Zone: CBC’s operation of distribution and cooling infrastructure in the Atarot Industrial Zone in occupied East Jerusalem is documented across multiple independent sources, including Who Profits4 and TBS News.6 Atarot is consistently classified by human rights organisations as a settlement industrial zone. This is the primary documented physical footprint of the Coca-Cola system in occupied Palestinian territory.
Tabor Winery: Tabor Winery is a documented subsidiary of CBC. Israeli wineries operating in the Golan Heights and parts of the West Bank operate under Israeli commercial law. The prior document claims Tabor sources grapes from occupied West Bank (Gush Etzion) and occupied Golan Heights. CBC’s ownership of Tabor Winery is consistent with training knowledge; the specific West Bank grape-sourcing claim would require primary production documentation to confirm.6 Verification status: Partially supported.
The prior document asserts CBC made a donation of 50,000 NIS (approximately $13,850) to Im Tirtzu in 2015, disclosed via the Israeli Corporations Authority, as reported by TBS News.6 Im Tirtzu is a documented Israeli right-wing extra-parliamentary movement. This claim rests on a single secondary source (TBS News) which itself cites Israeli regulatory disclosure records. Verification status: Single-source, secondary. Not independently confirmable from primary records in this session. Treat as unverified pending direct access to Israeli Corporations Authority filings.
A Herzog Fox & Neeman law firm publication describes an Israeli Tax Authority ruling finding that TCCC exercises significant pricing influence over CBC, with implications for the arm’s length principle in transfer pricing.5 Transfer pricing disputes between multinational beverage companies and local bottling franchisees are well-documented in the tax literature. The specific ruling’s characterisation of TCCC’s control over CBC — with potential relevance to legal questions of corporate separateness — is partially supported by the existence of the Herzog publication.5 Verification status: Partially supported; direct access to the ruling itself would be required for full confirmation.
The BDS Movement lists Coca-Cola among companies targeted for boycott in connection with CBC’s operations in settlement territories, specifically CBC’s presence at Atarot and its longstanding status as the Israeli Coca-Cola franchise.36 Activist boycott lists maintained by civil society organisations also include Coca-Cola.3435 TCCC’s publicly recorded response to BDS targeting has been limited; the company’s standard position characterises CBC as an independent bottler. No prominent TCCC public statements specifically addressing BDS campaigns have been identified in training knowledge through April 2026.
No public evidence has been identified of regulatory inquiries, export control investigations, or sanctions-related proceedings involving TCCC’s technology exports, services, or supply chain in connection with Israeli state or military entities. The Israeli Tax Authority transfer pricing case5 is a civil tax dispute with no sanctions dimension. No public evidence identified.
https://www.cyberark.com/cs/coca-cola-europacific-partners-steps-closer-to-becoming-the-world-s-most-digitized-bottling-operation.pdf ↩
https://www.cyberark.com/press/coca-cola-hellenic-bottling-company-selects-cyberark-for-identity-security/ ↩
https://www.researchgate.net/publication/350994328_Coca-Cola_Amatil_Trax_Retail_Execution ↩↩↩
https://herzoglaw.co.il/en/news-and-insights/israeli-coca-cola-ruling-expands-the-arms-length-principle/ ↩↩↩
https://www.tbsnews.net/features/panorama/yes-coke-has-gaza-factory-its-israel-ties-run-much-deeper-874451 ↩↩↩
https://www.nutritionaloutlook.com/view/brevel-and-the-central-bottling-company-form-partnership-to-develop-algae-derived-functional-beverages-and-dairy-alternatives ↩
https://www.marketingdive.com/news/coke-forges-ahead-with-startup-ambitions-via-bridge-commercialization-progr/446124/ ↩
https://www.calcalistech.com/ctechnews/article/bjbmh00suc ↩
https://cybermagazine.com/cyber-security/how-check-point-and-wiz-are-unifying-cloud-network-security ↩↩
https://www.checkpoint.com/press-releases/check-point-software-technologies-and-wiz-enter-strategic-partnership-to-deliver-end-to-end-cloud-security/ ↩↩
https://www.upguard.com/news/microsoft-cosmos-db-database-flaw ↩
https://www.engadget.com/microsoft-azure-flaw-cloud-customers-data-vulnerable-114027306.html ↩
https://paxforpeace.nl/wp-content/uploads/sites/2/2025/11/DontBuyIntoOccupationV2025.pdf ↩↩↩
https://claroty.com/press-releases/claroty-secures-140-million-financial-round-establishing-leadership-position-in-hyper-growth-industrial-cybersecurity-market ↩↩
https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0000021344&type=10-K ↩↩↩
https://www.coca-colahbc.com/investors/results-reports/annual-report/ ↩↩
https://agfundernews.com/tesco-invests-in-frictionless-checkout-startup-trigo ↩↩
https://issuu.com/rtih/docs/rtih_iss_6_jun24_lo_res_0a2f6e451c30cd ↩
https://newmedia.calcalist.co.il/startups-london-2019/index.html ↩↩↩↩↩↩
https://www.wiz.io/about ↩
https://www.scworld.com/analysis/microsoft-azure-breach-of-customer-accounts-spotlights-devops-failures ↩
https://claroty.com/partners/technology-alliances ↩
https://www.gartner.com/reviews/market/network-firewalls/vendor/check-point-software-tech ↩
https://www.youtube.com/watch?v=o8icPQ01uds ↩
https://mindset.ventures/our-companies/ ↩
https://www.trigoretail.com/the-checklist-for-superior-frictionless-shopping/ ↩↩
https://www.coca-colacompany.com/content/dam/journey/us/en/reports/coca-cola-business-esg-summary-report-2022.pdf ↩
https://www.enterprisetimes.co.uk/2017/03/28/rimini-street-hurting-sap-oracle-israel/ ↩
https://boycott-israel.org/boycott.html ↩
https://www.westsurreypsc.org/boycott.html ↩
https://bdsmovement.net/get-involved/what-to-boycott ↩
