Audit Phase: V-DIG (Digital Forensics / Technographic Audit)
Target: Costco Wholesale Corporation (NASDAQ: COST)
Audit Date: 2026-05-01
Auditor Note: All findings are drawn exclusively from the research memo. Claims are coded: [CONFIRMED] = corroborated by public records; [PLAUSIBLE-UNVERIFIED] = consistent with known public information but not independently confirmed; [DISCARDED] = claim from prior draft cannot be verified and is excluded. No scores, tiers, or scoring conclusions are assigned.
Four Israeli-origin cybersecurity vendors are commonly deployed across U.S. Fortune 500 retail and financial services enterprises. Their vendor identities are well-documented, but no named Costco relationship has been confirmed for any of them in public-facing corporate disclosures, vendor case studies, or regulatory filings.
Wiz, Inc. was founded in 2020 by Assaf Rappaport, Ami Luttwak, Yinon Costica, and Roy Reznik — all Israeli nationals, alumni of Israeli Military Intelligence Unit 8200, and former leaders of Microsoft’s Israel-based cloud security group following Microsoft’s 2015 acquisition of their earlier company, Adallom 6. Wiz became the dominant Cloud Native Application Protection Platform (CNAPP) vendor in the U.S. enterprise market by 2023–2024 6. No public disclosure by Costco or Wiz naming a Costco–Wiz relationship has been identified. Wiz does not list Costco as a named customer on its public customer pages per training-data knowledge. No public evidence identified of a Costco–Wiz deployment. [DISCARDED — prior draft claim unverifiable]
CyberArk Software Ltd. is an Israeli-founded company with its primary R&D centre in Petach Tikva, Israel, and U.S. headquarters in Newton, Massachusetts 7. CyberArk is a leading Privileged Access Management (PAM) vendor with wide enterprise adoption across U.S. retail and financial services 7. No publicly accessible CyberArk case study naming Costco has been confirmed in training data. No public evidence identified of a Costco–CyberArk deployment. [DISCARDED — prior draft claim unverifiable]
SentinelOne, Inc. was co-founded by Tomer Weingarten (Israeli national) and maintains its primary R&D operations in Tel Aviv 9. It is a leading Endpoint Detection and Response (EDR)/Extended Detection and Response (XDR) platform 9. SentinelOne tool references are common in enterprise cybersecurity job descriptions at major U.S. retailers, which is consistent with — but does not confirm — a Costco deployment 9. No specific archived Costco job posting naming SentinelOne has been independently confirmed. [PLAUSIBLE-UNVERIFIED]
Check Point Software Technologies was founded by Gil Shwed and is headquartered in Tel Aviv, Israel 8. Check Point is a long-established global leader in network security, firewalls, and intrusion prevention 8. No public disclosure by Costco or Check Point naming a specific Costco–Check Point relationship has been confirmed in training data. No public evidence identified. [DISCARDED — prior draft claim unverifiable]
Palo Alto Networks was co-founded by Israeli national Nir Zuk (formerly of Check Point). No evidence of a specific Costco–Palo Alto Networks relationship has been identified. No public evidence identified.
Costco’s FY2024 Annual Report (Form 10-K) discloses cybersecurity risk generically, referencing “our information technology systems” and third-party service providers, but does not name specific security vendors 1. This is standard practice for large U.S. retailers. The 10-K Risk Factors section acknowledges reliance on third-party technology platforms and references cybersecurity risks arising from vendor relationships, but provides no vendor-specific detail sufficient to independently confirm any Israeli-origin software dependency 1. The net effect is that the technology stack cannot be reliably mapped from public filings alone; the evidence gaps identified in the research memo require live-web investigation to resolve.
Microsoft Dynamics 365: Trade press has referenced a Costco migration to Microsoft Dynamics 365 for finance functions in the 2022–2024 period. [PLAUSIBLE-UNVERIFIED — trade press references exist but no formal press release or filing has been independently confirmed].
Blue Yonder Group, Inc. (formerly JDA Software) is a supply chain and warehouse management software provider headquartered in Scottsdale, Arizona, acquired by Panasonic Corporation (Japan) in 2021 10. Blue Yonder acquired the German AI/ML company Blue Yonder GmbH in 2018 10. Blue Yonder is a common enterprise Warehouse Management System (WMS) vendor in large U.S. retail, and trade press has referenced Costco in this context, but no formal confirmed Costco–Blue Yonder case study or press release has been independently verified in training data 10. Blue Yonder is not an Israeli-origin company 10. [PLAUSIBLE-UNVERIFIED]
Publicis Sapient is a global digital transformation consultancy (subsidiary of Publicis Groupe, France) with documented activity in large-scale U.S. retail digital transformation engagements 17. No specific Publicis Sapient–Costco engagement has been confirmed through a publicly disclosed press release, case study, or corporate filing in training data 17. [PLAUSIBLE-UNVERIFIED — prior draft claim unverifiable to required standard]
Costco deployed tablet-based membership verification kiosks at warehouse entrances beginning in approximately 2023–2024. The system displays the member’s photo on a tablet for visual comparison by a Costco employee 3. Costco has publicly stated it does not use facial recognition technology in this system 3. The specific hardware or software vendor for these kiosks has not been publicly disclosed by Costco. No Israeli-origin hardware or software vendor has been identified as supplying the kiosk system. No public evidence identified linking this deployment to Israeli-origin technology vendors. The prior draft’s characterisation of the kiosks as “surveillance-ready” for future facial recognition capability is a speculative inference, not a verified finding, and is excluded. [DISCARDED — speculative]
No verified relationship between Costco and any Israeli-origin computer vision or facial recognition vendor — including Trigo, AnyVision/Oosto, BriefCam, or Trax — has been identified in training data. No public evidence identified.
Amnesty International published a significant 2023 report documenting Israeli use of automated facial recognition systems, including “Blue Wolf,” against Palestinians in the occupied West Bank 15. That report does not mention Costco and contains no finding relevant to Costco’s own technology procurement.
Costco has been referenced in press coverage as using Automatic License Plate Recognition (ALPR) technology at some locations for parking management and gas station operations. [PLAUSIBLE-UNVERIFIED — referenced in press coverage; Costco has not made detailed public disclosures on this]. The specific ALPR vendor(s) are not publicly disclosed. Neither a Verint (Israeli-origin) nor a Genetec (Canadian-origin) relationship with Costco has been confirmed in training data. No public evidence identified linking Costco’s ALPR deployment to Israeli-origin vendors specifically.
Trade press has referenced Costco running “Scan & Go” self-checkout pilots 3. The technology vendor(s) underpinning these pilots are not publicly confirmed. No Israeli-origin vendor has been identified in connection with this programme. No public evidence identified.
No verified use of Israeli-origin predictive policing, social media monitoring, or workforce surveillance tools by Costco has been identified. No public evidence identified (source classes checked: corporate filings, NGO reports, trade press, privacy regulatory filings).
No evidence that Costco operates, leases, or co-locates data centre infrastructure within Israel has been identified. Costco does not operate an Israeli e-commerce storefront or subsidiary that would require Israeli data residency. No public evidence identified.
Project Nimbus is the $1.2 billion cloud infrastructure contract awarded in 2021 to Google Cloud and Amazon Web Services to provide sovereign cloud services to the Israeli government and military 1. Costco is a U.S.-headquartered retailer with no known participation in Project Nimbus or any Israeli state-backed cloud programme. No public evidence identified of any Costco relationship with Project Nimbus.
Costco uses Microsoft Azure and Google Cloud Platform for portions of its enterprise workloads, consistent with large-scale U.S. enterprise cloud migration patterns. [PLAUSIBLE-UNVERIFIED — referenced in trade press but not formally confirmed in SEC filings]. The prior draft’s characterisation of this as creating a “Project Nimbus connection” is a logical inference — the same cloud providers host both commercial enterprise and Israeli government workloads in different physical regions and under distinct contractual frameworks. This does not constitute a documented relationship and is excluded from findings. [DISCARDED — speculative inference]
No evidence that Costco provides or has been contracted to provide data sovereignty services, infrastructure resilience, or cloud computing capacity to Israeli state institutions or military bodies has been identified. Costco is a retail corporation, not a cloud or technology services provider. No public evidence identified.
Costco is a retail and membership warehouse corporation. It is not a technology or defence contractor. No verified contracts, partnerships, or service agreements between Costco and the Israeli Ministry of Defence, Israel Defense Forces, Israeli intelligence agencies (including Unit 8200 alumni-led entities in an institutional capacity), or other Israeli state security bodies have been identified. No public evidence identified (source classes checked: Israeli government procurement records, U.S. export control databases, SEC filings, defence industry directories, NGO reports).
No instances have been identified in which Costco’s commercially available technology, products, or services have been reported, confirmed, or documented as being deployed for military, intelligence, or law enforcement surveillance applications within Israel or the occupied Palestinian territories. No public evidence identified.
Costco does not develop, sell, or license offensive cyber capabilities, zero-day exploit tools, or digital weapons systems. This is not within Costco’s business domain. No public evidence identified.
No verified provision of AI, machine learning, computer vision, or autonomous systems by Costco to Israeli state, military, or security bodies has been identified. No public evidence identified.
CEO Ron Vachris discussed AI-assisted prescription pricing tools for Costco pharmacies in public remarks in 2024. [PLAUSIBLE-UNVERIFIED — consistent with training data on Vachris public statements]. The specific vendor for this pricing AI is not publicly disclosed. No Israeli-origin vendor has been identified in connection with this system. No public evidence identified linking Costco’s pharmacy AI to Israeli vendors.
Hello Heart Ltd. is an Israeli-founded digital health company (founded in Tel Aviv; U.S. headquarters in Menlo Park, California) providing a Bluetooth blood pressure monitor paired with an AI-powered cardiovascular coaching application 5. The company’s AI and software development is conducted by an R&D team in Tel Aviv 5. Hello Heart publicly discloses HIPAA compliance for its U.S. data storage operations 5.
Hello Heart has announced partnerships with major U.S. employers and pharmacy benefit managers as distribution channels for its platform 5. A partnership between Navitus Health Solutions and Hello Heart is assessed as [PLAUSIBLE-UNVERIFIED]: consistent with known Hello Heart commercial activity and Navitus’s model of integrating digital therapeutics, but the specific announcement attributed to September 2025 in the prior draft cannot be confirmed to the required evidentiary standard from training data alone. If such a partnership exists and if Costco employees are covered by Navitus-administered benefits, it would represent a pathway by which Hello Heart’s Israeli-developed AI platform could be offered to Costco’s employee population. This inference is [PLAUSIBLE-UNVERIFIED] and requires live-web verification of the specific Navitus–Hello Heart announcement.
No publicly reported instances of Costco’s AI models being trained on or accessing civilian population data, intercepted communications, or surveillance-derived datasets from Israel or occupied territories have been identified. No public evidence identified.
No evidence that Costco operates R&D facilities, engineering offices, innovation labs, or accelerator programmes within Israel has been identified. Costco’s corporate structure does not include a known Israeli subsidiary or technology office. No public evidence identified (source classes checked: Israeli Companies Registrar, Costco corporate disclosures, LinkedIn company pages, trade press).
No acquisitions of Israeli-origin technology companies by Costco have been identified in training data. No public evidence identified. No strategic investments by Costco in Israeli technology startups or Israeli-focused venture funds have been identified. No public evidence identified.
No significant patent portfolios, licensing agreements, or co-development arrangements between Costco and Israeli-domiciled entities or Israeli research institutions (including Technion, Hebrew University, or Weizmann Institute) have been identified. No public evidence identified (source classes checked: USPTO patent database by assignee, Costco 10-K IP disclosures, academic partnership databases).
Sonova Group, a Swiss-headquartered hearing health technology company, manufactures Kirkland Signature branded hearing aids sold exclusively through Costco under a long-standing OEM agreement 16. This is a Swiss-origin manufacturing relationship. No Israeli-origin hardware or software component of the Kirkland Signature hearing aid product line has been identified. No public evidence identified of Israeli-origin technology in this product line.
Who Profits Research Center (an Israeli NGO) has documented Keter Group’s historical manufacturing operations in the Barkan Industrial Zone, an Israeli settlement industrial park located in the occupied West Bank 11. Keter Group manufactures outdoor furniture, storage products, and garden sheds — product categories sold through Costco 14. The civil society concern is that consumer purchasing of Keter products at Costco constitutes economic activity that benefits a settlement-based manufacturer 11.
Keter announced relocation plans from Barkan around 2020–2022 amid international commercial pressure 14. The extent to which Barkan operations have continued or fully ceased is not definitively confirmed in training data; current-status verification via Who Profits updates or corporate filings is required 11. Costco’s Supplier Code of Conduct establishes standards for suppliers but does not address occupied territory manufacturing locations specifically 18.
Who Profits and the BDS Movement have documented HP Inc.’s historical provision of biometric identification systems — referenced in advocacy materials as contributing to checkpoint infrastructure used in the occupied West Bank 12 13. Costco sells HP Inc. products including laptops and printers as a standard consumer electronics retailer 12. The characterisation of Costco’s retail HP sales as constituting “complicity” in occupation surveillance infrastructure is an advocacy position held by BDS-aligned organisations; it is not a regulatory or legal finding.
SodaStream International originally manufactured products at a facility in the Mishor Adumim industrial zone in the West Bank (pre-2015). Following international pressure, the company relocated its primary manufacturing to the Negev town of Rahat, Israel proper, in 2015, completing the transition by 2019 3. SodaStream is currently owned by PepsiCo. Current SodaStream manufacturing is located in Rahat, not in occupied territories. Costco stocks SodaStream products. [CONFIRMED — timeline well-documented].
Amnesty International’s 2023 report Automated Apartheid documents Israeli deployment of automated facial recognition systems including “Blue Wolf” against Palestinians in the occupied West Bank 15. The report does not mention Costco. No Amnesty International reporting has been identified that specifically concerns Costco’s technology procurement, digital infrastructure, or supply chain relationships with Israeli entities.
HRW has published reports on corporate activity in Israeli settlements and business and human rights concerns in the occupied territories 19. No HRW report specifically mentioning Costco and Israeli technology relationships has been identified. No public evidence identified of Costco-specific HRW reporting in this domain 19.
Costco has been referenced in general BDS consumer campaigns primarily regarding physical goods sold on its shelves — specifically SodaStream, Keter products, and HP products 13. No organised boycott or divestment campaign specifically targeting Costco’s technology procurement or digital infrastructure relationships with Israeli vendors has been identified in training data. No public evidence identified of a technology-focused BDS campaign directed at Costco specifically.
Costco has not issued public statements addressing BDS campaigns targeting specific products it stocks. The company’s standard practice is to treat product stocking as a commercial decision. [CONFIRMED — no public Costco statements on BDS identified in training data].
No regulatory inquiries, legal challenges, export control enforcement actions, sanctions-related investigations, or congressional scrutiny involving Costco’s technology sales or services to Israeli state entities have been identified. This absence is consistent with Costco’s role as a consumer retail corporation rather than a technology exporter or defence contractor. No public evidence identified (source classes checked: OFAC sanctions lists, BIS export enforcement records, SEC enforcement actions, Congressional records, EU regulatory actions).
