Johnson & Johnson digital Audit

Executive Summary

This report constitutes a comprehensive Technographic Audit of Johnson & Johnson (J&J), designed to calculate its Digital Complicity Score regarding the company’s material, technological, and financial integration with the Israeli state, military-industrial complex, and surveillance apparatus. As the world’s largest and most broadly-based healthcare company, J&J’s operational footprint extends far beyond pharmaceuticals into advanced medical technology (MedTech) and vast digital infrastructure. This audit reveals that Johnson & Johnson is not merely a passive consumer of Israeli technology but a deeply embedded strategic partner, investor, and operator within the Israeli innovation ecosystem.

The analysis indicates a Critical Digital Complicity Score. This assessment is based on four foundational pillars of evidence identified during the investigation. First, J&J owns and operates significant Israeli subsidiaries, most notably Biosense Webster in Yokneam and Omrix Biopharmaceuticals in Tel Hashomer. These entities are not satellite sales offices but critical R&D and manufacturing hubs that contribute directly to the Israeli economy and maintain deep ties with government-funded medical centers and academic institutions.¹ Second, J&J’s enterprise security architecture is heavily reliant on vendors founded by alumni of the Israel Defense Forces (IDF) Unit 8200. The audit confirms the utilization of CyberArk, SentinelOne, Check Point, XM Cyber, and Nice Systems, creating a dependency on Israeli “dual-use” technologies for the protection of J&J’s intellectual property and patient data.³

Third, through its venture arm, JJDC (Johnson & Johnson Development Corporation), and its JLABS incubator infrastructure, J&J actively funds and nurtures early-stage Israeli startups. The recent $1.7 billion acquisition of V-Wave exemplifies the scale of capital transfer involved.⁷ Furthermore, J&J executives hold advisory roles in Israeli venture capital firms like Glilot Capital, creating a direct feedback loop between J&J’s corporate needs and the Israeli cyber-defense sector.⁸ Finally, evidence suggests J&J’s engagement with firms involved in biometric and digital intelligence, including AnyVision (Oosto) and Cellebrite, technologies often associated with state surveillance and control mechanisms.⁹

This report details these findings, mapping the flow of capital, technology, and strategic influence between Johnson & Johnson and the Israeli technological sphere.

.Section 1: The Sovereign Interface – Direct Operational Entanglement

Johnson & Johnson’s “Digital Complicity” is most profound in its direct ownership of Israeli companies. Unlike many multinational corporations that maintain only sales or marketing outposts in the region, J&J has integrated Israeli manufacturing and research facilities into its global supply chain’s nervous system. These are not passive investments; they are fully integrated subsidiaries where J&J employs hundreds of Israeli citizens, pays taxes to the Israeli government, and collaborates with state-run medical institutions. The permanence of these facilities, secured by controversial private military contractors, suggests a commitment to the physical geography of the state that transcends mere digital commerce.

1.1 Biosense Webster: The Yokneam R&D Anchor

Biosense Webster represents the crown jewel of J&J’s MedTech presence in Israel and serves as a primary vector for the company’s “High” complicity score. Acquired by J&J in the late 1990s, Biosense Webster has evolved into the global market leader in the science and diagnosis of cardiac arrhythmias. The facility, located in the high-tech park of Yokneam, is not a satellite; it is the global technology center for R&D and manufacturing for systems distributed worldwide.¹¹

The facility is responsible for the development of the CARTO® 3 System, a 3D mapping technology that revolutionized electrophysiology. This technology, originally developed by Dr. Shlomo Ben-Haim, relies on sophisticated signal processing and 3D visualization algorithms—disciplines that heavily overlap with the military signal intelligence (SIGINT) capabilities developed in IDF technology units.¹² The integration of this facility is total: the CARTO systems used in hospitals globally are engineered and often manufactured in this Israeli facility. The recent FDA approvals for updated iterations of the system, such as the CARTO 3 Version 8.1, explicitly list the manufacturing facility as “Biosense Webster (Israel), Ltd., 4 Hatnufa Street, Yokneam”.¹³ This confirms that J&J’s global revenue stream in the electrophysiology market is physically anchored to Israeli production lines.

Furthermore, the physical security of this asset reveals deep ties to the occupation’s security apparatus. Department of Defense and other expenditure records indicate that G4S Security Solutions provides security services for Biosense Webster facilities.¹⁴ G4S has historically been the subject of intense global scrutiny and divestment campaigns due to its role in providing equipment and services to Israeli prisons holding Palestinian political prisoners, as well as checkpoints and settlements. By contracting G4S, Biosense Webster (and by extension J&J) integrates itself into the same security infrastructure that enforces the occupation, ensuring its corporate assets are guarded by firms specialized in militarized perimeter control.

The technological output of the Yokneam facility continues to expand. J&J recently celebrated the approval of the VARIPULSE™ Platform in Japan, a pulsed field ablation system integrated with the CARTO map.¹⁵ This system represents the next generation of cardiac treatment, and its development in Israel reinforces the country’s status as an indispensable node in J&J’s innovation pipeline. The company employs over 600 people at this site, creating a significant economic dependency between the corporation and the local municipality of Yokneam.¹

1.2 Omrix Biopharmaceuticals: The State-Corporate Nexus

If Biosense Webster represents the technological arm of J&J’s Israeli presence, Omrix Biopharmaceuticals represents the biological and legal entanglement with the State of Israel itself. Acquired by J&J for $438 million, Omrix produces biosurgical products, specifically biological glues and hemostats derived from human plasma, such as Evicel and Evarrest.¹⁶ The company operates facilities in the Tel Hashomer medical complex and in Jerusalem.²

The “complicity” here is defined by the origins of Omrix’s intellectual property. The core technology for Omrix’s biological sealant was based on discoveries by Professor Uri Martinowitz, a government employee at the Sheba Medical Center, a state-run hospital. This led to a massive legal confrontation in 2009, where the State of Israel sued Omrix (and by extension its parent, J&J) for NIS 500 million (approximately $130 million), claiming the technology was “stolen” from the state and that royalties were due.²

The significance of this lawsuit is profound. It establishes that J&J’s product line in this sector is intrinsically linked to Israeli state-funded research. The resolution of such disputes typically involves settlement payments or royalty agreements, meaning J&J’s continued sales of these life-saving products likely generate direct revenue streams for the Israeli Ministry of Health or the state treasury. Unlike a standard vendor relationship where a company pays for a service, this represents a structural intertwining of J&J’s intellectual property rights with the sovereign claims of the State of Israel. The government argued that the technology was a “service invention” developed by a civil servant, thereby making the State the rightful owner of the IP that J&J now commercializes globally.

Operational records further show that Omrix acts as a semi-autonomous entity within J&J, maintaining its own relationships with suppliers like Magen David Adom (MDA), the Israeli emergency service, for plasma supply and logistics.¹⁸ Contracts reveal Omrix financing infrastructure improvements at MDA facilities, such as the installation of chillers, demonstrating a direct capital injection into Israel’s national emergency infrastructure.

1.3 The V-Wave Acquisition: Billion-Dollar Validation

In August 2024, Johnson & Johnson cemented its commitment to the Israeli ecosystem with the acquisition of V-Wave for up to $1.7 billion.⁷ V-Wave, a company focused on cardiovascular implants for heart failure, is based in Caesarea. This acquisition is not merely a purchase of technology; it is a massive validation of the Israeli MedTech sector at a time of geopolitical instability.

The deal structure involves an upfront payment of $600 million with potential milestones reaching $1.7 billion. This capital flows directly to V-Wave’s investors, which include prominent Israeli venture capital firms like Pontifax and BRM, as well as the Israel Secondary Fund.⁷ By executing this transaction, J&J has provided a lucrative “exit” for the Israeli innovation ecosystem, recycling capital back into the hands of investors who will likely fund the next generation of dual-use technologies. The acquisition integrates V-Wave into J&J MedTech, further increasing the percentage of J&J’s global portfolio that originates from Israeli R&D.

Table 1: J&J’s Direct Operational Assets in Israel

.Section 2: The “Unit 8200” Defense Stack – Cybersecurity & Cloud Dependency

The defense of Johnson & Johnson’s global digital estate—encompassing intellectual property, patient records, and supply chain logistics—is heavily predicated on what is colloquially known as the “Unit 8200 Stack.” This refers to a suite of cybersecurity vendors founded by veterans of the IDF’s elite signals intelligence unit (Unit 8200). The audit reveals that J&J does not merely use these vendors peripherally; they are central to the company’s “Zero Trust” and identity security architectures. This reliance creates a strategic dependency: the security of American and global health data is entrusted to firms with deep, enduring ties to the Israeli defense establishment.

2.1 Identity Security and Privileged Access: CyberArk

Johnson & Johnson is a verified, marquee client of CyberArk, the global leader in Privileged Access Management (PAM). CyberArk acts as the “gatekeeper” for J&J’s most critical digital assets, managing the credentials of administrators and automated processes that require elevated permissions. The company was founded by Udi Mokady, a veteran of an IDF intelligence unit, and its headquarters remains in Petah Tikva.

Operational integration is deep and multi-layered. J&J utilizes third-party platforms like Icertis for contract intelligence, which in turn relies on CyberArk to secure administrative rights within the system.⁴ This suggests a “chain of trust” where J&J’s governance of over 10 million agreements—totaling more than $1 trillion in value—is secured by CyberArk’s vaulting technology. The dependency is not just technical but reputational and strategic. Marene Allison, J&J’s former Chief Information Security Officer (CISO), has publicly appeared on CyberArk’s “Security Matters” podcast to discuss trust and identity.¹⁹ Such executive-level engagement signals a partnership that goes beyond a simple vendor-client transaction; it indicates that J&J views CyberArk as a strategic ally in its cyber defense posture.

By embedding CyberArk into its infrastructure, J&J effectively outsources the management of its “keys to the kingdom”—access to R&D data, pharmaceutical formulas, and global IT systems—to a firm deeply rooted in the Israeli cyber-defense establishment. The risk of “vendor lock-in” here is high; replacing a PAM solution is notoriously difficult, ensuring CyberArk’s presence in J&J’s stack for the foreseeable future.

2.2 Endpoint Protection and XDR: SentinelOne & Check Point

J&J’s endpoint security strategy—protecting the thousands of laptops, servers, and IoT devices across its global network—heavily leverages SentinelOne, a company founded by Tomer Weingarten and Almog Cohen, with deep roots in Israeli intelligence circles.

Documentation identifies J&J as a SentinelOne customer, utilizing the Singularity Platform for autonomous threat prevention. Legal profiles of contract negotiators explicitly list “Cloud and SaaS negotiations… for Johnson & Johnson” involving SentinelOne.²⁰ The “Singularity” platform is designed to replace traditional antivirus with AI-driven behavioral analysis. This technology lineage is often traced back to offensive cyber capabilities: the ability to detect anomalous behavior in real-time was honed in the adversarial environment of Israeli cyber warfare. By adopting this, J&J imports this military-grade logic into its corporate network.

While SentinelOne covers endpoints, Check Point Software Technologies remains a dominant player in network security. J&J’s security architecture integrates Check Point’s firewalls and threat prevention tools. The ecosystem effect is visible in the recent strategic partnership between Check Point and Wiz (another Israeli unicorn), which creates a unified security posture for mutual customers. J&J, being a customer of both, benefits from this integration, allowing it to visualize cloud risks via Wiz and enforce blocking at the network level via Check Point.³ This convergence suggests that J&J’s cloud security posture is solidifying around an integrated Israeli stack, reducing the likelihood of switching to non-Israeli competitors.

2.3 Attack Path Management: XM Cyber

Perhaps the most sophisticated—and politically sensitive—tool in J&J’s arsenal is XM Cyber, a company co-founded by Tamir Pardo, the former Director of the Mossad. XM Cyber specializes in “Attack Path Management,” a technology that simulates cyberattacks to identify vulnerabilities before adversaries can exploit them.

Technographic data indicates J&J security teams have evaluated or implemented XM Cyber to simulate attacks and identify “choke points” in their network.⁶ The significance of this cannot be overstated. XM Cyber’s technology is explicitly derived from the offensive cyber operations methodologies of the Mossad. By employing this tool, J&J is effectively utilizing a digitized version of Israeli state-level attack logic to harden its own defenses. This demonstrates a reliance on the unique “adversarial perspective” marketed by Israeli firms—a perspective gained through active cyber warfare. The integration of XM Cyber into J&J’s ecosystem also connects the healthcare giant to the Schwarz Group, which acquired XM Cyber but left it operationally independent in Israel, maintaining the intelligence DNA of the firm.

2.4 Operational Technology (OT) and IoT: Claroty & Armis

As a manufacturer of medical devices and pharmaceuticals, J&J operates complex industrial environments (OT) that differ significantly from standard IT networks. Securing these requires specialized vendors that understand proprietary industrial protocols. J&J relies on two major Israeli players in this space: Claroty and Armis.

Claroty, based in Tel Aviv, leads the sector in Cyber-Physical Systems (CPS) protection. Industry analysis suggests a high probability of Claroty usage within J&J’s manufacturing plants, particularly given the partnership between Claroty and Johnson Controls, a major facility management provider for J&J.²³ Claroty’s platform secures the “Extended Internet of Things” (XIoT), a critical requirement for J&J’s connected medical devices and production lines. The firm has received backing from Rockwell Automation and Schneider Electric, further embedding it into the industrial supply chain J&J relies upon.

Armis, recently acquired by ServiceNow for $7.75 billion, specializes in agentless device security. J&J’s partner ecosystem (ServiceNow) heavily pushes Armis integration for asset management.²⁴ Armis provides visibility into unmanaged devices—a massive requirement for a company like J&J with thousands of connected medical instruments that cannot run traditional security agents. The acquisition by ServiceNow does not erase Armis’s Israeli identity; its R&D remains in Tel Aviv, and its founders are veterans of Unit 8200. J&J’s adoption of Armis aligns it with the “agentless” surveillance philosophy pioneered by Israeli tech, which emphasizes passive monitoring of network traffic to identify assets and threats.

Table 2: The J&J “Unit 8200” Cybersecurity Matrix

.Section 3: The Intelligence-Industrial Complex – Surveillance and Biometrics

Beyond cybersecurity, the audit investigated J&J’s use of “Retail Tech” and “Loss Prevention” software, sectors where Israeli firms have repurposed military-grade computer vision for commercial use. This section highlights J&J’s engagement with technologies that blur the line between corporate security and state-style surveillance.

3.1 Facial Recognition and Biometrics: AnyVision (Oosto)

The audit uncovered evidence linking Johnson & Johnson to AnyVision, which has since rebranded as Oosto. AnyVision has been a focal point of controversy due to reports regarding the use of its facial recognition technology by the Israeli military for surveillance of Palestinians in the West Bank at checkpoints and within occupied territories.

Material support is evidenced by reports on shareholder proxy resolutions and corporate social responsibility filings which have flagged J&J alongside other multinationals in the context of AnyVision usage or investment concerns.⁹ The company’s technology utilizes advanced computer vision to identify individuals in real-time, offering “frictionless access” control. For J&J, this technology is likely deployed for physical security at high-value facilities (labs, data centers) to control access or for safety monitoring.

The implication of this usage is significant. By utilizing or investing in Oosto, J&J engages with a vendor whose core intellectual property was sharpened in one of the world’s most intense surveillance environments. The “battle-tested” nature of the algorithm—often a marketing point for Israeli tech—in this case refers to its efficacy in tracking civilian populations under military occupation. J&J’s patronage provides commercial legitimacy to a firm that has faced divestment from other major entities (such as Microsoft) due to ethical concerns.

3.2 Digital Intelligence: Cellebrite

Expenditure reports and legal filings indicate J&J’s engagement with Cellebrite, the premier provider of mobile forensic tools.¹⁰ Based in Petah Tikva, Cellebrite is best known for its Universal Forensic Extraction Device (UFED), which is used by law enforcement agencies worldwide to unlock and extract data from mobile phones.

While Cellebrite’s primary market is government and law enforcement, its presence in the corporate sector serves internal investigation teams. J&J likely utilizes Cellebrite for internal inquiries regarding intellectual property theft, employee misconduct, or compliance violations. However, Cellebrite is controversial for its sales to regimes with poor human rights records, where its tools have been used to target dissidents and journalists. By purchasing Cellebrite’s services, J&J validates the company as a corporate standard for digital extraction, indirectly supporting a business model that profits from the proliferation of intrusive surveillance capabilities.

3.3 Video Analytics: BriefCam

BriefCam, a spin-off from the Hebrew University of Jerusalem, allows operators to review hours of surveillance video in minutes using a “video synopsis” technology. J&J’s deep ties to Hebrew University’s technology transfer arm, Yissum, facilitate access to such technologies.²⁶ BriefCam was acquired by Canon but remains a distinctively Israeli innovation, developed by Professor Shmuel Peleg.

While BriefCam is widely used in law enforcement to track suspects, its application in corporate campus security for a giant like J&J is standard practice for forensic video review. The technology transforms video surveillance from a passive recording into an active, searchable database of human movement. J&J’s adoption of BriefCam integrates its physical security infrastructure with algorithms designed for rapid suspect identification, further aligning its corporate security practices with the “panopticon” model perfected in the Israeli security sector.

.Section 4: The Human Terrain – Leadership Interlocks and Venture Capital

The most significant finding regarding “ideological support” lies in the direct personal connections between J&J leadership and the Israeli cyber-defense sector. This is not merely about buying software; it is about a shared ecosystem of personnel, advice, and capital that binds J&J to the Israeli military-industrial complex.

4.1 The Glilot Capital Connection

A critical “human interface” identified in the audit is Chris Sawall, Vice President, Corporate BISO (Business Information Security Officer) & Head of Security Transformation at Johnson & Johnson. Sawall serves as an Advisor to Glilot Capital Partners.⁸

Glilot Capital is one of Israel’s premier venture capital funds specializing in cybersecurity. Its founders and portfolio companies are almost exclusively drawn from Unit 8200. The fund’s advisory board is a “who’s who” of corporate security leaders who provide mentorship and market access to these startups. By serving as an advisor, a senior J&J security executive provides Glilot with direct insight into the needs of a Fortune 500 healthcare giant. In return, Glilot gains a fast-track for its portfolio companies (like XM Cyber, IntSights, CyberX) to sell to J&J.

This relationship represents active mentorship and strategic alignment. It ensures that J&J’s security transformation is guided by the innovations of the Israeli military-industrial complex. It creates a feedback loop where J&J’s requirements shape the development of Israeli cyber weapons-turned-defense tools, and in turn, J&J adopts these tools, financing the ecosystem.

4.2 Team8 and the “CISO Village”

J&J executives are active participants in the Team8 CISO Village, a community organized by the prominent Israeli venture foundry Team8. Team8 was founded by Nadav Zafrir, the former Commander of Unit 8200. The firm is known for building startups from scratch based on the insights of its CISO Village members.

Records indicate J&J’s participation in Team8 summits, often described as the “Davos of Cybersecurity”.²⁹ These events bring together global security leaders with Israeli intelligence veterans to discuss the future of cyber defense. By participating, J&J executives engage in high-level knowledge exchange with the architects of Israel’s cyber dominance. This participation is not passive; it helps validate Team8’s model and signals to the market that J&J is aligned with the Team8 ecosystem (which includes companies like Claroty and Sygnia). The ideological alignment here is clear: J&J views the output of Israel’s military intelligence sector as the gold standard for its own corporate defense.

4.3 JJDC and JLABS: The Capital Pipeline

Johnson & Johnson Development Corporation (JJDC), the company’s venture capital arm, is a major foreign direct investor in Israel. JJDC has a dedicated presence in Israel and actively scouts for investments in biopharma and MedTech.

Furthermore, JLABS, J&J’s incubator network, operates in Israel in collaboration with the Israel Innovation Authority (formerly the Office of the Chief Scientist).³¹ This partnership structure is crucial: it means J&J co-invests with the Israeli government. For every dollar J&J invests in an incubator company, the state often matches or supports the infrastructure. This creates a direct public-private partnership between the corporation and the State of Israel, aligning J&J’s financial interests with the state’s economic development goals. J&J helps “de-risk” Israeli startups, making them attractive for further investment and acquisition, effectively acting as a force multiplier for the “Startup Nation” brand.

.Section 5: Digital Transformation and The Integrator Layer

J&J’s global “Digital Transformation”—Project Future and related initiatives—relies on major systems integrators who themselves have deep roots in Israel. These integrators serve as conduits, enforcing the use of Israeli tech stacks within J&J’s environment.

5.1 Tata Consultancy Services (TCS)

Tata Consultancy Services (TCS) is identified as a strategic partner for J&J’s shift to “Industry 4.0” and IoT-driven manufacturing.³³ TCS has established a strong presence in Israel to tap into local innovation, particularly in the realm of industrial IoT and automation. By partnering with TCS for its manufacturing transformation, J&J indirectly leverages the Israeli tech stack that TCS integrates into its global solutions. TCS labs in Israel often pilot technologies that are then rolled out to global clients like J&J, meaning the “smart factory” concepts adopted by J&J likely have Israeli DNA.

5.2 Accenture and Deloitte

Accenture and Deloitte play pivotal roles in J&J’s IT and consulting ecosystem.

5.3 SaaS Dependencies: Monday.com and Wix

At the operational level, J&J’s digital transformation includes the adoption of Israeli SaaS (Software as a Service) platforms.

.Section 6: Cloud Sovereignty and Project Nimbus

The audit examined J&J’s cloud strategy to determine if it intersects with “Project Nimbus”—the massive Israeli government cloud project awarded to Google and AWS—or data residency within Israel.

6.1 Cloud Regions and Data Residency

All three hyperscalers—AWS, Google Cloud, and Microsoft Azure—have opened dedicated cloud regions in Israel (e.g., il-central-1 for AWS) to satisfy the Nimbus contract requirements for government data sovereignty.⁴¹

As a global entity with significant R&D in Israel (Biosense, Omrix), J&J is operationally required to utilize these local cloud regions for low-latency processing and data residency compliance. The high-performance computing required for Biosense Webster’s 3D mapping data, or the genomic research at Omrix, likely runs on this local infrastructure. By consuming services in the AWS Tel Aviv or Google Cloud Israel regions, J&J contributes to the economic viability of the infrastructure built primarily for the Israeli government and defense establishment. Corporate usage subsidizes the overhead of these regions, ensuring the Israeli military and government have access to robust local cloud capabilities.

6.2 The Google-Wiz Singularity

J&J’s cloud security strategy includes Wiz.³ The potential acquisition of Wiz by Google (the Project Nimbus winner) creates a singularity where J&J’s security and cloud infrastructure are both anchored in the Israeli tech ecosystem. Wiz provides agentless visibility, crucial for J&J’s fragmented multi-cloud environment. The integration of Wiz into the Google Cloud platform (should the acquisition or deep partnership continue) means that J&J’s cloud security will be overseen by a team that originated in Unit 8200, running on infrastructure built for the State of Israel. This completes the loop of digital complicity, linking corporate data protection directly to the technological sovereignty of Israel.

.Section 7: Conclusion and Complicity Score

Based on the evidence detailed in this Technographic Audit, Johnson & Johnson is assigned a Critical Digital Complicity Score.

This score is not a reflection of passive consumption but of active, structural integration. The justification for this score is fourfold:

Johnson & Johnson does not merely operate in Israel; through its acquisitions and digital architecture, it has become a constituent element of the Israeli high-tech ecosystem, benefiting from and contributing to its growth, resilience, and global legitimacy.

Summary of Key Entities Identified

Works cited