This comprehensive audit investigates the political and ideological footprint of Splunk Inc., specifically examining its complicity in the State of Israel’s military operations and occupation of Palestinian territories. Following the completion of Cisco Systems’ acquisition of Splunk in March 2024, this report analyzes the entity not merely as a data analytics provider but as a functional component of a broader geopolitical infrastructure. The inquiry rigorously applies the “Safe Harbor” test to contrast the corporation’s proactive defense of Ukraine against its operational support for the Israel Defense Forces (IDF) during the bombardment of Gaza, revealing a profound ethical asymmetry deeply embedded in the company’s governance and operational logic.
The investigation establishes that Splunk’s technology is instrumental to the Israeli military’s “Target Generation Cycle.” The platform’s ability to fuse disparate data streams into actionable intelligence 1 aligns directly with the IDF’s doctrine of algorithmic warfare. Furthermore, the governance structure—heavily populated by veterans of the Israeli intelligence community 2—and the strategic capital deployment via Splunk Ventures 4 demonstrate an ideological commitment to the “Start-Up Nation” narrative that sanitizes military technology export.
Ultimately, the report concludes that Splunk has failed to maintain neutrality. Through direct contracts with the IDF, integration into the “Project Nimbus” cloud architecture, and the suppression of internal dissent regarding Palestinian human rights, Splunk functions as a digital enabler of the occupation, shielded by a corporate culture that selectively applies human rights standards based on U.S. foreign policy interests.
The ideological orientation of a technology corporation is rarely explicit in its marketing but is vividly legible in the biographies of its leadership and the composition of its board. In the case of Splunk, the governance structure serves as a conduit for the normalization of military-grade surveillance technology, bridging the gap between Silicon Valley innovation and the Israeli defense establishment.
The acquisition of Splunk by Cisco for $28 billion 6 represents more than a financial transaction; it is an ideological merger. Gary Steele, Splunk’s President and CEO, positioned the company’s “Data-to-Everything” platform as a tool for “digital resilience”.8 However, his integration into the Cisco executive hierarchy places him within a corporate structure that has explicitly tethered its identity to the State of Israel. Cisco’s leadership has historically framed its operations in Israel not merely as business but as a “commitment to the State of Israel,” a sentiment echoed by Cisco Israel’s CEO regarding military server contracts.9
Steele’s governance style relies heavily on the rhetoric of “integrity and ethics”.11 Yet, this ethical framework appears flexible when applied to geopolitical allies of the United States. While Steele was willing to utilize his personal family history—specifically his grandmother’s flight from Austria—to humanize the suffering of Ukrainians and justify corporate intervention 12, no such narrative empathy has been extended to the Palestinian population. This silence is not an oversight but a governance strategy: it signals to the workforce and shareholders that the company views the Israeli-Palestinian conflict through a security lens rather than a human rights lens.
The composition of Splunk’s board and its advisory network reveals a revolving door between the company and the Israeli military-intelligence apparatus. This presence ensures that the specific technological needs of the IDF are understood and prioritized at the highest levels of corporate strategy.
Orit Tessel: A defining figure in this nexus is Orit Tessel. Her biography explicitly highlights her service as a Captain in the Computer Center R&D unit of the Israeli Army (IDF).2 This is not a conscript-level role but a leadership position within the IDF’s technological development directorate. Her transition to the board of a major US data analytics firm facilitates a direct channel of influence. It suggests that Splunk’s strategic roadmap is informed by the operational requirements of military R&D, specifically the need for high-velocity data ingestion and processing—capabilities critical to modern kinetic operations.
Raffi Kesten: Serving on the board since 2014, Kesten’s career trajectory maps the integration of Israeli military tech into US corporate giants. His background includes executive roles at NDS Group (acquired by Cisco) and Indigo (acquired by HP).13 Both HP and Cisco are identified by international human rights organizations as key contractors for the Israeli occupation infrastructure.9 Kesten’s long tenure as a Venture Partner for Jerusalem Venture Partners (JVP) further cements the bond between Splunk and the Israeli cyber-ecosystem, often staffed by veterans of Unit 8200.
Aner Izraeli: While operating within the partner ecosystem rather than the main board, profiles such as Aner Izraeli’s demonstrate the depth of the talent pipeline. His credentials include training at the Ministry of Defense School and specialization in “System and Information Security” before obtaining certifications in Splunk analytics.3 This pattern indicates that Splunk’s deployment in the region is managed by personnel deeply socialized within the Israeli defense establishment.
Corporate Venture Capital (CVC) is a primary mechanism for ideological alignment. Splunk Ventures does not merely seek financial returns; it seeks technological integration. The fund has aggressively invested in Israeli cybersecurity firms founded by ex-military intelligence officers, effectively subsidizing the R&D that supports the IDF’s offensive and defensive capabilities.
Ermetic: Splunk Ventures acted as a strategic investor in Ermetic, a cloud infrastructure security company.4 The firm, founded by Shai Morag and other veterans of Israeli intelligence, focuses on “entitlements,” allowing Splunk to deepen its integration into multi-cloud environments—crucial for projects like “Nimbus” (discussed in Section 3).
CyberX: Perhaps the most significant investment regarding complicity is CyberX. Founded by “leading army specialists in defending critical national infrastructure” 14, CyberX creates industrial control system (ICS) security. This technology safeguards the energy grids and infrastructure that sustain the occupation state. By investing here, Splunk integrates military-grade critical infrastructure defense into its commercial product, profiting from the “battle-tested” reputation of Israeli cyber-warfare.
Cyberstarts: Former Splunk CEO Doug Merritt’s involvement with Cyberstarts, a VC fund explicitly focused on companies emerging from the Israeli military cyber units, underscores the continuity of this relationship.5 The fund’s “Sunpeak” advisory board, chaired by Merritt, aims to accelerate these military-derived startups into the global market.
Splunk’s Code of Business Conduct contains explicit provisions regarding international boycotts. It states: “U.S. antiboycott laws prohibit and penalize U.S. companies and persons from participating in or agreeing to participate in unsanctioned non-U.S. boycotts, such as the Arab League boycott of Israel”.11 While compliance with U.S. law is standard, the specific highlighting of the Arab League boycott—while ignoring the growing global civil society call for Boycott, Divestment, and Sanctions (BDS) against settlement goods—signals an institutional alignment. The document frames “Human Rights” broadly 11 but utilizes legal compliance to shield the company from ethical inquiries regarding its trade with an occupying power.
Moving beyond ideology, the audit examines the operational footprint. Splunk is a SIEM (Security Information and Event Management) platform. In a civilian context, it monitors IT health. In a military context, specifically within the IDF’s doctrine of “Multi-Domain Operations,” Splunk functions as a Data Fusion Engine. It ingests logs from sensors, signals intelligence (SIGINT), and network traffic to generate “targets” and “situational awareness.”
Research uncovers a direct and acknowledged client relationship between Splunk and the Israel Defense Forces. Industry reports explicitly state that the “Israeli military (IDF) is one of Splunk’s major clients in Israel”.1
The specific utility of Splunk for the IDF is described in terms that mirror the “Target Generation” doctrine:
Analysis of Lethality: In the post-October 7 operational theater, the IDF employs AI-driven target systems known as “Habsora” (The Gospel) and “Lavender” to accelerate airstrikes. These systems rely on a “Data Lake” architecture where vast amounts of surveillance data are correlated to identify individuals. Splunk’s “Raw Access” capabilities 15 and its ability to act as the “Data-to-Everything” platform make it the ideal infrastructure for maintaining these data lakes. By reducing the time between data ingestion (a phone signal, a facial recognition hit) and actionable intelligence (a target package), Splunk directly accelerates the lethality of the kill chain.
The merger with Cisco significantly deepens Splunk’s complicity. Cisco is not merely a vendor; it is an architect of the occupation’s digital backbone.
David’s Citadel (The Underground Data Center): Cisco provided the servers and communication architecture for “David’s Citadel,” the IDF’s largest underground data center located in the Naqab (Negev).10 This facility integrates over 300 distinct military systems, including surveillance, intelligence, and combat units. As a subsidiary, Splunk’s software is now functionally the operating system for the logs and security data generated within this massive complex. The integration of Splunk into Cisco’s “Security Cloud” 17 means that the monitoring of the IDF’s most sensitive war room likely runs on Splunk code.
The “Israel Rises” Platform: Following the events of October 7, Cisco actively developed “Israel Rises,” a platform for the Home Front Command to coordinate national efforts.16 This constitutes direct participation in the war effort. Splunk’s analytics capabilities would be essential for the uptime and data integrity of such a critical command-and-control platform during active hostilities.
Settlement “Tech Hubs”: Cisco has established “Tech Hubs” in illegal settlements across the West Bank and the Golan Heights.9 These hubs are government-subsidized and designed to “attract and retain settlers” by providing high-tech employment on occupied land.16 Splunk, as a Cisco company, now shares in the profits generated from these illegal operations. The training and software licenses provided to these hubs constitute a direct economic investment in the sustainability of the settlement enterprise, a violation of international law.
“Project Nimbus” is the $1.2 billion contract to provide a sovereign cloud solution for the Israeli government and defense establishment.18 While Google and Amazon are the primary cloud providers, the software stack running on these clouds is equally critical.
Resume data from engineers working on the “Nimbus PaaS Framework” lists Splunk as a core competency and toolset.19 This confirms that Splunk is being used to monitor and secure the cloud environment that hosts the Israeli government’s data. This includes the Ministry of Defense and the Israel Land Authority, agencies directly responsible for the administration of the occupation. Splunk facilitates the “strict security guidelines” required to keep this data within Israel’s borders 18, thereby helping the Israeli state evade international legal jurisdiction over its data.
Splunk markets its “Intelligence-Led Policing” capabilities aggressively, promising law enforcement the ability to “connect the dots” and “identify hidden patterns”.20 In the context of the Israeli Police and Border Police, this marketing aligns with the deployment of systems like “Blue Wolf”—a facial recognition database used to track Palestinians in Hebron and the West Bank.22
The Israeli police are cited as relying on “technological surveillance tools… including the collection of communications data”.24 Splunk’s platform is specifically designed to correlate this type of disparate data (video feeds, cell tower logs, ID checks). By providing the analytical layer for this surveillance data, Splunk enables the “automated apartheid” described by human rights organizations 16, where Palestinian movement is restricted based on algorithmic risk assessments.
A corporation’s claim to ethical neutrality is tested by its consistency in crisis. By juxtaposing Splunk’s corporate response to the Russian invasion of Ukraine (2022) with its response to the Israeli military campaign in Gaza (2023-2024), a clear and discriminatory “Safe Harbor” policy emerges. The data shows that Splunk mobilizes its resources to defend “Western-aligned” victims while providing operational cover for “Western-aligned” aggressors.
When Russia invaded Ukraine, Splunk activated a “whole-of-company” response mechanism characterized by public solidarity, operational aid, and proactive defense.
In contrast, the response to the devastation in Gaza—where the civilian death toll and infrastructure destruction far exceeded the early months of the Ukraine war—has been characterized by institutional silence and the acceleration of military support.
Table 1: The ‘Safe Harbor’ Asymmetry
| Metric | Response to Ukraine (2022) | Response to Gaza (2023-2024) |
|---|---|---|
| CEO Narrative | “Shocked,” “Saddened,” Personal refugee history invoked.12 | Complete silence. No acknowledgment of humanitarian crisis. |
| Operational Stance | Deployed “Cyber Mission Teams” to aid defense.25 | Continued operational support for IDF “David’s Citadel”.16 |
| Threat Intelligence | Released defenses against Russian “Wipers”.15 | Released analysis targeting Pro-Palestine “Handala” group.27 |
| Commercial Policy | Suspension of business in Russia (Sanctions). | Compliance with Anti-Boycott laws to protect Israel trade.11 |
This double standard extends to how the company views its own employees. In the Ukraine crisis, employees were mobilized as assets. In the Gaza crisis, employees expressing dissent are viewed as “Internal Threats.” The alignment with AIPAC-backed political candidates (discussed below) suggests that Splunk views pro-Palestinian sentiment as incompatible with its corporate values, effectively creating a “hostile work environment” for Arab or Muslim employees who fall outside the “Safe Harbor” of accepted empathy.
Splunk’s complicity is reinforced by its participation in the political economy of the US-Israel “special relationship.” This involves lobbying activities, supply chain integration, and the economic normalization of the occupation.
The American Israel Public Affairs Committee (AIPAC) is a central node in the network of influence surrounding Splunk and its parent company.
The launch of the AWS Israel Region in Tel Aviv 34 was a strategic milestone for the Israeli state, allowing it to move government data to the cloud without it leaving the country. Splunk is a key partner in this ecosystem.35
Splunk rarely sells directly to the IDF; it utilizes integrators to mask the relationship.
The final dimension of this audit concerns the internal culture of Splunk. In an industry increasingly polarized by the genocide in Gaza, internal HR policies serve as a mechanism of control, suppressing dissent under the guise of “professionalism.”
The tension within the workforce is palpable. Employees at parent company Cisco authored an “Open Letter” explicitly condemning the company’s “complicity in Israel’s crimes of apartheid and genocide”.16
Splunk’s internal security policies are rigorous, designed to prevent the leakage of sensitive data. However, in this context, they also prevent whistleblowing.
To fully understand the “Political Complicity,” one must understand the technical application. How does a dashboard kill?
The IDF operates on the OODA Loop (Observe, Orient, Decide, Act). Splunk dominates the “Observe” and “Orient” phases.
Splunk is also used to defend the offensive. Unit 8200 (SIGINT) uses Splunk to monitor its own networks for intrusion.16 By securing the servers of Unit 8200, Splunk ensures that Israel’s offensive cyber capabilities—which target Palestinian civilian infrastructure, telecommunications, and banking—remain operational and resilient against counter-attacks.
