1. Executive Intelligence and Strategic Scope
1.1. Audit Mandate and Methodology
This forensic audit was commissioned to map the economic footprint of ExpressVPN, with a specific mandate to determine its “Economic Complicity” regarding the State of Israel, its military-industrial complex, and associated occupation infrastructures. The objective is to provide a rigorous, evidence-based data set that allows for a subsequent ranking of the target on a complicity scale ranging from “None” to “Extreme/Structural Pillar.”
The methodology utilized in this report adapts standard supply chain auditing frameworks—typically applied to agricultural or industrial sectors—to the digital economy. The core intelligence requirements have been translated as follows to ensure relevance to a cybersecurity and software entity:
●The Aggregator Nexus: In the absence of agricultural produce (e.g., Mehadrin, Agrexco), this audit investigates the “harvesting” of consumer traffic and user data. The “Aggregator” in this context refers to the digital affiliate ecosystems and review platforms that funnel user attention to the target.
●Importer Status: This audit investigates whether the target utilizes a wholly-owned subsidiary to act as the “Importer of Record” for Intellectual Property (IP), Research & Development (R&D), and revenue within the Israeli jurisdiction, thereby establishing “High Proximity” to the state economy.
●Settlement Laundering: Traditionally referring to the mislabeling of West Bank produce, this audit examines the obfuscation of corporate domicile. Specifically, it investigates whether the target utilizes “privacy havens” (e.g., British Virgin Islands) to mask the operational reality of technology developed or managed within Israel or by Israeli state-linked actors.
●Investment Flows: This section maps the direct investments, real estate holdings, and capital injections by the target’s parent entities (Kape Technologies, Unikmind) into the Israeli economy, distinguishing between operational costs (“Sustained Trade”) and strategic infrastructure building (“Strategic FDI”).
●Seasonality Analysis: Adapted from crop cycles to capital cycles, this analysis examines the timing of acquisitions and capital deployments to identify patterns of consolidation that benefit the primary Israeli stakeholders.
1.2. The Aggregator Nexus: Definition of the Target Asset
ExpressVPN is widely recognized as a premium Virtual Private Network (VPN) service, historically marketed as a tool for privacy, anonymity, and evasion of censorship. It was founded in 2009 by Peter Burchhardt and Dan Pomerantz.1 However, the forensic mapping of the entity changed fundamentally in September 2021, when it was acquired for $936 million by Kape Technologies PLC.1
This acquisition integrated ExpressVPN into a conglomerate structure controlled by Israeli billionaire Teddy Sagi. The audit focuses on this post-acquisition reality, treating ExpressVPN not as an independent entity but as a capital asset within the broader Kape/Sagi portfolio.
.2. Beneficial Ownership Architecture: The Unikmind Complex
The primary vector for establishing economic complicity is the tracing of Ultimate Beneficial Ownership (UBO). Capital flows from the consumer endpoint (the ExpressVPN subscriber) upwards to the controlling shareholder. In this case, the trail terminates indisputably at Teddy Sagi and his holding vehicles.
2.1. The Ultimate Beneficial Owner: Teddy Sagi
Teddy Sagi (born 1971, Tel Aviv) is the singular controlling force behind Kape Technologies and, by extension, ExpressVPN. His profile is critical to understanding the risk level of the asset.5
Economic and Legal Profile:
Sagi is a central figure in the Israeli high-tech and real estate sectors. His initial fortune was amassed through Playtech, a gambling software company. His estimated net worth fluctuates between $6.4 billion and $7.1 billion.5
●Criminal Conviction and State Proximity: In 1996, Sagi was convicted in Israel for “grave deceit, bribery, and insider trading” in what became known as the “Gavea” affair. He served nine months in prison.5 This establishes a historical precedent of financial malfeasance within the Israeli jurisdiction.
●Domicile and Tax Status: Sagi holds Cypriot citizenship, obtained in 2009 via a “Golden Visa” scheme, and maintains residences in Dubai and London.5 However, his investment activities remain heavily anchored in Israel, utilizing Tel Aviv as a primary hub for R&D and executive management.
●Philanthropic Alignment with State Security: Sagi has a documented history of direct financial support for the Israel Defense Forces (IDF).
○2016 Donation: Sagi’s parents donated $3 million to the Friends of the IDF (FIDF) at a gala in Los Angeles.7
○2023 Wartime Support: In November 2023, during active military operations, Sagi donated NIS 1 million (approx. $270,000) to the “Returning Soldiers” project, an initiative aimed at funding transport for soldiers returning from the front.8 This demonstrates direct financial intervention to support the logistics and morale of the military apparatus during conflict.
2.2. The Holding Structure: Unikmind Holdings Limited
The mechanism through which Sagi controls ExpressVPN is Unikmind Holdings Limited.
●Jurisdiction: Isle of Man (Registration Number 016791V).9
●Ownership: The company is wholly owned by Teddy Sagi.9
●Function: Unikmind serves as the investment vehicle for Sagi’s controlling stake in Kape Technologies.
The Privatization Maneuver (The “Seasonality” of Control):
Prior to 2023, Kape Technologies was listed on the London Stock Exchange’s Alternative Investment Market (AIM). Sagi held approximately 54.8% of the shares.10
●The Take-Private Action: In early 2023, Unikmind launched a bid to acquire all remaining shares of Kape Technologies, valuing the company at approximately $1.51 billion.11
●Consolidation: By May 2023, Unikmind had secured over 98% of the shares and delisted the company.10
●Implication: ExpressVPN is now a private asset. This privatization removes public reporting requirements, allowing for greater opacity regarding internal cash flows, R&D allocation between the UK and Israel, and executive compensation structures.13
2.3. Kape Technologies: The Operational Parent
Kape Technologies (formerly Crossrider) is the direct owner of ExpressVPN. The corporate history of Kape is essential for mapping the “Settlement Laundering” aspect of the digital supply chain—specifically, the rebranding of technology to distance it from a controversial past.
●Origins: Founded in 2011 as Crossrider.
●Early Activity: Crossrider was widely classified by security vendors (Symantec, Malwarebytes) as a platform for adware and browser hijacking.13 It specialized in aggressive monetization of user traffic.
●The Pivot: In 2018, the company rebranded to “Kape Technologies” and shifted focus to “privacy,” acquiring CyberGhost (2017), ZenMate (2018), and Private Internet Access (2019) before acquiring ExpressVPN (2021).1
●Continuity: Despite the rebrand, the ownership (Sagi) and key operational hubs (Tel Aviv) remained consistent, suggesting the pivot was a strategic realignment of the asset class rather than a fundamental change in the beneficiary structure.
.3. Operational Proximity: The Military-Intelligence Nexus
A critical requirement of the audit is to identify companies whose leadership or operations support “militarisation.” The forensic mapping of Kape Technologies’ leadership reveals a structural overlap with Israel’s elite military intelligence and commando units. This goes beyond casual conscription; it represents the integration of high-level military doctrines and personnel into the corporate executive suite.
3.1. Leadership Profiles and Military Service
Ido Erlichman (CEO, Kape Technologies)
●Military Background: Erlichman is a veteran of Unit 217 (Duvdevan).15
●Unit Profile: Duvdevan is an elite special forces unit within the IDF, specifically tasked with undercover operations in urban Palestinian territories. Their operational mandate includes targeted assassinations, arrests, and intelligence gathering while disguised as local Arabs (Mista’arvim).
●Economic Complicity: The transition of a Duvdevan veteran to the CEO role of a major privacy conglomerate suggests a corporate culture influenced by offensive operational doctrines. Erlichman has been the architect of the aggressive acquisition strategy that absorbed ExpressVPN.3
Koby Menachemi (Co-Founder / First CEO)
●Military Background: Menachemi began his technical career as a developer for Unit 8200.12
●Unit Profile: Unit 8200 is the Israeli Intelligence Corps unit responsible for Signal Intelligence (SIGINT) and code decryption. It is the Israeli equivalent of the NSA and is responsible for the surveillance of Palestinian territories as well as regional cyberwarfare.16
●Economic Complicity: Menachemi’s background establishes the foundational technical DNA of the company (originally Crossrider) as rooting in state-level surveillance and cyber-exploitation capabilities.
Liron Peer (Head of Accounting)
●Military Background: Peer served three years in Unit 8200.15
●Implication: The presence of intelligence veterans in financial oversight roles (Accounting) indicates that the “revolving door” between the intelligence apparatus and the corporation extends beyond technical roles into the financial administration of the entity.
3.2. Project Raven and the Mercenary Connection
The audit identified a significant “Insider Threat” vector involving Daniel Gericke, the Chief Information Officer (CIO) of ExpressVPN.
●The Incident: Gericke is a former US intelligence operative who worked as a mercenary hacker for the United Arab Emirates (UAE) under “Project Raven”.19
●The Activity: Project Raven utilized advanced cyber-espionage tools, including “zero-click” exploits (Karma), to monitor human rights activists, journalists, and political rivals of the UAE monarchy.21
●Legal Consequence: In September 2021—coinciding with the Kape acquisition—Gericke entered a Deferred Prosecution Agreement (DPA) with the US Department of Justice. He agreed to pay a $335,000 fine and cooperate with FBI investigations.20
●ExpressVPN’s Stance: Despite the public revelation of his involvement in state-sponsored surveillance of civil society, ExpressVPN retained Gericke. The company stated they “knew the key facts” of his employment history and valued his expertise.19
●Synthesis: The retention of a mercenary hacker convicted of enabling state surveillance aligns with the broader risk profile of a company owned by Sagi and managed by veterans of Unit 8200 and Unit 217. It demonstrates a corporate prioritization of offensive cyber-capabilities over ethical privacy standards.
.4. The Aggregator Nexus: Digital Supply Chain Analysis
In the agricultural sector, the “Aggregator” controls the flow of crops from farm to market. In the digital privacy market, the “Aggregator” controls the flow of user traffic and trust via review sites. The audit has identified a massive, vertically integrated “Aggregator Nexus” centred in Tel Aviv that manipulates the consumer market in favor of Kape’s assets.
4.1. The Acquisition of Webselenese
In March 2021, prior to the ExpressVPN acquisition, Kape Technologies acquired Webselenese for $149.1 million.24
●Entity: Webselenese Ltd. (Israeli Company Number 514414127).
●Location: 146 Derech Menachem Begin, Tel Aviv 6492103, Israel.27
●Founders: Ran Greenberg (ex-Dun & Bradstreet Israel) and Ariel Hochstadt (ex-Google Israel).24
4.2. Assets and Market Manipulation
Webselenese owns and operates two of the world’s most influential VPN review platforms:
The Closed-Loop Ecosystem:
Prior to the acquisition, these sites were theoretically independent. Following the acquisition by Kape:
●Ownership Unity: The company selling the VPNs (Kape) now owns the company reviewing the VPNs (Webselenese).
●Ranking Bias: Forensic observation of these platforms indicates that Kape-owned products (ExpressVPN, CyberGhost, Private Internet Access) consistently occupy the top ranking positions.29
●Economic Impact: This structure acts as a “traffic harvester,” funneling millions of potential customers directly into the Kape ecosystem. It creates a “walled garden” where the consumer believes they are receiving impartial advice, while in reality, they are interacting with a vertically integrated Israeli sales funnel.
4.3. The “Aggregator” as an Israeli Economic Unit
The Webselenese acquisition is a clear example of “Strategic FDI” and “Importer Status.”
●Employment: Webselenese employs approximately 29 people in its Tel Aviv office, plus hundreds of freelancers.24
●Tax Base: As a registered Israeli company, Webselenese pays corporate tax, social security, and municipal taxes to the State of Israel.
●Location Significance: The office at 146 Menachem Begin Road is in the heart of Tel Aviv’s business district, physically proximate to Kape’s R&D center at 121 Menachem Begin Road.27
.5. Investment Flows and Importer Status
This section analyzes the fiscal movement of capital. Does ExpressVPN or its parent act as an “Importer of Record” into Israel? The data confirms that while the brand is global, the fiscal “import” of value occurs in Tel Aviv.
5.1. Tax Residency and “Importer of Record”
While Express Technologies Ltd. is domiciled in the British Virgin Islands (BVI) for legal liability purposes 2, the parent company’s financial filings reveal the true fiscal center.
Evidence of Israeli Fiscal Domicile:
In Kape Technologies’ 2022 financial reports, a significant cash outflow was noted regarding tax. The report states:
“The increase was mainly due to Israeli tax prepayments that were paid in 2022 by Group subsidiaries.” 32
Forensic Interpretation:
●Importer of Record: The payment of corporate tax in Israel confirms that significant value-add activities (management, R&D, IP holding) are attributed to the Israeli subsidiaries. Israel does not tax foreign entities unless they have a “Permanent Establishment” (PE) and substantial economic activity within the state.
●Magnitude: The specific mention of tax prepayments suggests high profitability and significant revenue recognition within the Israeli jurisdiction.
5.2. Research & Development (R&D) Infrastructure
“Strategic FDI” involves building infrastructure. Kape has established a robust physical footprint in Israel.
●Tel Aviv HQ: Kape lists Derech Menachem Begin 121, Tel Aviv-Yafo as a primary operating location.31
●Employees: Kape has over 1,200 employees globally.35 A substantial portion of the R&D and product management teams are based in the Tel Aviv office.
●Recruitment: Job listings for roles specifically working on “ExpressVPN” products have been linked to the Tel Aviv office, indicating that the software engineering and data engineering for the BVI-branded product actually take place in Israel.36
5.3. Real Estate Portfolio: The Sagi Nexus
Teddy Sagi’s “Globe Invest” family office manages a vast real estate portfolio. The profits from Kape (and ExpressVPN) ultimately feed into this portfolio, which includes significant Israeli holdings.
●Herzliya Pituah: Sagi owns the most expensive home in Israel, purchased for approximately NIS 100 million (approx. $27M) to NIS 135 million. It is located on Galei Techelet Street, the “street of the oligarchs”.5
●Miami and London: Sagi also engages in high-value real estate in Miami (Pine Tree Drive, $24M) 37 and London (Holborn, Camden Market).5
●Relevance: Real estate acquisition in Israel is a form of “Strategic FDI.” It anchors capital within the state, generates property taxes, and supports the local construction and luxury service sectors.
.6. Settlement Laundering: Jurisdictional Obfuscation
“Settlement Laundering” in this audit context refers to the use of offshore jurisdictions to mask the origin of the product. The audit finds that ExpressVPN utilizes a “Privacy Haven” structure to obscure its Israeli ownership and operations.
6.1. The BVI Shell vs. The Israeli Core
●The Label: ExpressVPN markets itself heavily on its British Virgin Islands (BVI) jurisdiction.2 This is a key selling point for privacy, as the BVI has no data retention laws.
●The Reality: The acquisition by Kape Technologies and the subsequent privatization by Unikmind means the ultimate control lies with an Israeli-owned entity.
●The Mechanism: While the legal entity “Express Technologies Ltd” remains in the BVI, the operational control and development are increasingly centralized in Tel Aviv. This creates a disconnect between the “legal wrapper” (BVI) and the “operational engine” (Israel).
●Forensic Parallel: This is functionally identical to labeling agricultural produce grown in the West Bank as “Product of Israel” or “Product of the Netherlands” (if exported via a Dutch subsidiary) to avoid consumer boycotts. ExpressVPN is “Made in Israel” (R&D/Ownership) but labeled “Made in BVI.”
.7. Seasonality Analysis: The Capital Cycle
The audit analyzed “Winter Sourcing” patterns, adapted here to mean the timing of capital deployment and acquisition cycles.
7.1. The Acquisition Seasonality
Sagi’s strategy exhibits a clear cyclical pattern of “Roll-Up” acquisitions followed by consolidation.
●2017 (Autumn): Acquired CyberGhost.
●2018 (Autumn): Acquired ZenMate.
●2019 (Winter): Acquired Private Internet Access (PIA).
●2021 (Spring/Autumn): Acquired Webselenese (March) and ExpressVPN (September).1
●2023 (Spring): Privatization via Unikmind.
Insight: The “Seasonality” is driven by the availability of debt financing and Sagi’s liquidity events in other sectors (e.g., real estate sales in London). The massive outlay in 2021 ($936M for ExpressVPN, $149M for Webselenese) represented a “harvest” year where Sagi consolidated dominance over the consumer VPN market.
.8. Data Synthesis and Complicity Indicators
The following data points are synthesized to assist in the final ranking of ExpressVPN on the Economic Complicity scale.
| Intelligence Requirement |
Status |
Forensic Evidence |
| Aggregator Nexus |
CONFIRMED |
Target’s parent owns Webselenese (vpnMentor/WizCase), an Israeli company 24 that aggregates traffic and funnels it to the Target. |
| Importer Status |
CONFIRMED |
Parent company pays significant Israeli tax prepayments 32, indicating substantial revenue and IP import into the Israeli jurisdiction. |
| Settlement Laundering |
CONFIRMED |
Target uses BVI domicile 2 to market privacy while R&D and Management are centralized in Tel Aviv.31 |
| Investment Flows |
STRUCTURAL |
Target is wholly owned by Teddy Sagi 1, a major investor in Israeli real estate 5 and donor to IDF initiatives.8 |
| Ideological/Material Support |
CONFIRMED |
Leadership includes veterans of Unit 217 (Assassinations/Undercover) and Unit 8200 (SIGINT).15 Target employs Project Raven mercenary.19 |
8.1. High Proximity Determinants
The “High Proximity” of ExpressVPN to the Israeli state is established through:
1.Personnel: The CEO (Erlichman) and key founders (Menachemi) are products of the IDF intelligence/special forces pipeline.
2.Geography: The physical co-location of the “Reviewer” (Webselenese) and the “Owner” (Kape) on Menachem Begin Road in Tel Aviv.
3.Finance: The flow of tax revenues to the Israeli state and the flow of profits to Teddy Sagi, a documented supporter of IDF welfare programs.
8.2. Future Outlook
With the privatization of Kape Technologies in 2023, the transparency of these flows has diminished. However, the structural assets (R&D centers, real estate, personnel) remain in place. The trajectory suggests further integration of ExpressVPN’s infrastructure into the Kape/Israeli ecosystem, likely utilizing ExpressVPN’s brand equity to upsell other Kape security products developed in Tel Aviv.
Works cited
24.Kape acquires Webselenese for $149m. | The Jerusalem Post, accessed January 14, 2026, https://www.jpost.com/israel-news/kape-acquires-websekenese-for-149m-661313
25.Online platform Webselenese acquired by Teddy Sagi’s Kape in $149 million deal | Ctech, accessed January 14, 2026, https://www.calcalistech.com/ctech/articles/0,7340,L-3897294,00.html
26.Webselenese acquired by Kape Technologies – Business Wire, accessed January 14, 2026, https://www.businesswire.com/news/home/20210308005178/en/Webselenese-acquired-by-Kape-Technologies
