INDEX / DIRECTORY / CADBURY / V-DIG

Cadbury V-DIG

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-05-18
V-DIG Score 1.24 /10 E Cadbury — BDS-1000 196
V-DIG 1.24

Evidence-only forensic audit. Scoring happens downstream — see the main dossier for the composite assessment.

V-DIG Domain Audit: Cadbury (Mondelēz International)

Audit Phase: V-DIG Target Entity: Cadbury, a brand of Mondelēz International, Inc. Date: 2026-05-01 Methodology: All findings are drawn exclusively from the research memo above. No independent research has been conducted. Factual claims unsupported by the memo are excluded. Verification flags from the memo are preserved throughout. No scores, tiers, or BRS values are assigned.

Enterprise Technology Stack & Vendor Relationships

CyberArk — Privileged Access Management

Mondelēz International operates CyberArk as its primary Privileged Access Management (PAM) platform across its global workforce of approximately 90,000 employees.12 The deployment is confirmed by multiple official Mondelēz career postings advertising for IAM CyberArk Engineers responsible for planning, engineering, and operating the global PAM programme.13

Specific CyberArk components confirmed in active use include CyberArk Vault, Privilege Cloud (PAS), Endpoint Privilege Manager (EPM), custom Central Policy Manager (CPM) plugins, and Privileged Session Manager (PSM) connectors — each listed explicitly in official Mondelēz job specifications.13 The Director of Identity and Access Management role at Mondelēz, reporting directly to the CISO, is documented as overseeing CyberArk alongside Active Directory, Azure AD, SSO, MFA, Certificate Management, and SAP GRC tooling.2

The deployment is enterprise-critical in scale, spanning global Active Directory, HR onboarding automation, and cloud provisioning workflows — not a peripheral or pilot function.12 CyberArk was founded in Israel in 1999 and maintains dual headquarters in Newton, MA and Petah Tikva, Israel; its founders and early leadership have backgrounds in Israeli technology and security sectors. This is confirmed corporate history.

CrowdStrike — Endpoint and Identity Security

Mondelēz International deployed CrowdStrike Falcon, specifically the Falcon Identity Protection module, as confirmed in a CrowdStrike-published case study.4 The case study documents that Mondelēz replaced fragmented legacy security tooling with CrowdStrike’s AI-native platform to stop lateral movement, password spraying, and Kerberoasting across its Active Directory environment, reducing detection time to under 15 minutes following deployment.4

CrowdStrike is an American company headquartered in Austin, TX. It acquired the Israeli browser-security startup Seraphic Security in 2024, which is a verifiable acquisition, but CrowdStrike itself does not originate from Israeli military intelligence. No “Unit 8200 stack” characterisation is supportable as a primary descriptor of this relationship.

Wiz — Cloud Security (CNAPP)

Mondelēz International career postings for senior cybersecurity roles explicitly list Wiz.io as a required operational platform for managing cloud vulnerability strategies, network security posture, and compliance operations, alongside Forcepoint ONE.5 The listing is for an active cloud security management role, indicating operational deployment rather than evaluation.5

Wiz was co-founded in 2020 by Assaf Rappaport, Ami Luttwak, Yinon Costica, and Roy Reznik — all former members of Israeli military intelligence Unit 8200 and previously of Microsoft following the acquisition of their prior company Adallom. This is confirmed corporate history. CyberArk and Wiz have a formal documented technology integration partnership announced in 2023, designed to manage privileged cloud identities across multi-cloud environments.6 Check Point and Wiz announced a deeper strategic partnership in 2024.7

Claroty — OT/ICS/Cyber-Physical Security

[PARTIALLY VERIFIED — no primary source confirmed]

The prior research identified industry reports and vendor materials citing Mondelēz as a Claroty customer, noting that the NotPetya attack — which struck Mondelēz directly — is publicly cited by Claroty as a primary market driver for FMCG OT security adoption.89 However, a specific named Mondelēz–Claroty contract, press release, or vendor case study could not be independently confirmed from a primary source. The secondary sourcing originates from an aggregator blog rather than a primary corporate disclosure. Claroty was established by Team8, an Israeli cybersecurity company-building platform populated by former Israeli military intelligence and Unit 8200 alumni — confirmed corporate history.

Armis — IoT/Asset Visibility

[NOT INDEPENDENTLY VERIFIED — discarded]

The prior report cited Mondelēz as an Armis customer. The cited source — reporting on ServiceNow’s acquisition talks for Armis at approximately $7.75 billion10 — does not name Mondelēz as a customer. A secondary aggregator source11 likewise does not independently confirm the relationship. This claim is not carried forward. Armis was founded in Israel and is now headquartered in San Francisco; its Israeli origins are confirmed corporate history.1011

Verint — Workforce Management and Contact Centre Analytics

[PARTIALLY VERIFIED — indirect corroboration only; primary Mondelēz–Verint contract not confirmed from named source]

Job postings for Mondelēz Forecasting Analyst roles reference management of WFM platform queues and intraday behavioural pattern monitoring consistent with Verint WFM deployment. However, the specific sourcing for one cited listing was found to link to a Monzo Bank posting rather than a Mondelēz posting, compromising that citation. Mondelēz’s documented partnership with Orange Business Services for omnichannel customer experience12 provides indirect corroboration — Orange has used Verint as a contact centre analytics platform — but triangulation through Orange to attribute Verint directly to Mondelēz contact centre operations remains indirect and unconfirmed from a primary named source. Verint Systems is headquartered in Melville, NY with core R&D in Israel; its origins in telecom intelligence/SIGINT interception technology are documented corporate history.

Procurement & Systems Integrators

Mondelēz engaged Accenture for its data-driven digital transformation, including AI integration, digital roadmap development, and strengthening its “digital core,” confirmed by an Accenture case study and joint press releases.131415 A strategic alliance with Publicis Groupe (specifically Publicis Sapient) for AI-powered marketing capabilities was announced in 2024, confirmed by a joint press release and multiple trade publications.131617 Publicis Sapient holds a documented Global Strategic Collaboration Agreement with AWS, leveraging AWS AI/ML for enterprise modernisation.18 No public evidence identified of these integrators specifically mandating or deploying named Israeli-origin cybersecurity tools on Mondelēz’s behalf beyond what is documented under direct vendor relationships above.

Mondelēz maintains a formal vendor cyber risk management portal that sets cybersecurity expectations for its supply chain and third-party vendors.19 Annual financial disclosures are publicly accessible via SEC EDGAR.20

Surveillance, Biometrics & Retail Technology

Trax Retail — Computer Vision for Retail Execution

[DATE FLAG — primary source is pre-2020; ongoing relationship status unconfirmed]

Mondelēz International’s relationship with Trax Retail is confirmed by the POI Retail Execution Summit documentation (2016), which lists Mondelēz as utilising Trax’s image recognition platform for retail execution, shelf-space compliance, and product mix management.2122 Whether this relationship is ongoing has not been confirmed by a post-2020 primary source in the available research. Trax was founded in Singapore in 2010 by Joel Bar-El and Dror Feldman with significant Israel-based R&D and engineering operations; a characterisation as purely “Israeli-origin” requires nuance given its Singapore incorporation.

Trigo — Frictionless Checkout and Loss Prevention

[UNVERIFIED from primary source — single secondary trade newsletter citation only]

The prior research report cites a single trade publication, Express Checkout newsletter issue #9,23 as the basis for a claim that Mondelēz was testing Trigo’s frictionless checkout technology at a corporate campus store in New Jersey. No Mondelēz or Trigo press release and no major press outlet has independently confirmed this trial. The claim is noted as plausible given Trigo’s documented FMCG pilots but is not confirmed from a primary source.

Trigo was founded in 2017 in Tel Aviv, Israel by Daniel Gabay and Michael Gabay; its Israeli origin is confirmed. Trigo’s documented technology architecture uses ceiling-mounted camera arrays with AI to create a “Store Digital Twin,” tracking shopper-product interactions for automated checkout and loss-prevention functions, without persistent facial recognition per its own published privacy statements.2425

Facial Recognition, Named Biometrics, AnyVision/Oosto, BriefCam

No public evidence identified of Mondelēz or Cadbury deploying AnyVision/Oosto, BriefCam, or any other named Israeli-origin facial recognition or biometric identification technology. Source classes reviewed: corporate press releases, technology procurement announcements, NGO reports, trade press in the retail technology sector.

Predictive Analytics and Workforce Surveillance

No public evidence identified of Mondelēz deploying Israeli-origin predictive policing, social media monitoring, or workforce surveillance tools, beyond the partially verified Verint WFM deployment documented in the Enterprise Technology Stack section above.

Third-Party and Bundled Deployment

No public evidence identified of Israeli-origin surveillance or biometric technologies reaching Mondelēz indirectly via bundled enterprise suites or managed security services, beyond what is documented in this audit.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

AWS as Strategic Cloud Provider

Mondelēz International formally designated Amazon Web Services as its primary strategic cloud provider, confirmed by a named investor relations press release in 2023, which announced migration of critical workloads to AWS including its SAP RISE enterprise environment.2618 A $1.2 billion digital transformation programme running through approximately 2028, with AWS-hosted SAP RISE as the core ERP platform, is confirmed by IT Brew reporting from December 2025.27

Google Cloud Platform

Mondelēz uses Google Cloud Platform for data analytics, marketing analytics, and AI/ML workloads, confirmed by a Google Cloud case study naming Mondelēz and citing over 20 million personalised marketing assets created using GCP tools.28 The Mondelēz–Accenture–Publicis Groupe AI marketing partnership utilises AWS and GCP infrastructure through these integrators.1314

Project Nimbus — Context and Documented Scope

Project Nimbus is a confirmed $1.2 billion cloud infrastructure contract awarded by the Israeli government to Amazon Web Services and Google Cloud in April 2021.293031 The Israeli Ministry of Finance confirmed the contract selection in May 2021.31 The stated scope covers providing the Israeli government, defence establishment, and other state bodies with an “all-encompassing cloud solution” including AI, ML, and advanced analytics capabilities.2930

Google Cloud confirmed in its own blog post that it was selected to provide cloud services to transform the State of Israel.30 The +972 Magazine investigation (2021) and subsequent Guardian reporting (2025) document contractual clauses that reportedly: prohibit AWS and Google from restricting Israel’s use of cloud products; forbid service denial to any Israeli government entity including the military; and include a notification mechanism (“winking mechanism”) obliging the companies to secretly alert the Israeli government if foreign courts order data handover.3233 Employee protests under the “#NoTechForApartheid” campaign, involving Google workers objecting to Project Nimbus, were widely documented in 2021 and again in April 2024 following terminations of protesting employees.3435

Mondelēz’s Direct Role in Project Nimbus

Mondelēz does not operate, lease, or co-locate data centre infrastructure within Israel. No public evidence identified. Mondelēz is a consumer of AWS and GCP commercial cloud services; it is not a contracting party, subcontractor, or participating entity within the Project Nimbus Israeli government programme. No public evidence identified of Mondelēz providing services explicitly marketed or contracted to ensure digital sovereignty or infrastructure resilience for Israeli state institutions or military bodies.

The structural relevance of Project Nimbus to this audit is that Mondelēz’s two primary cloud providers — AWS and Google Cloud — hold active contractual obligations to the Israeli government and its defence establishment under the terms described above. Mondelēz’s use of these platforms is a commercial relationship with those providers, not a participation in or endorsement of their Israeli government contracts.

Data Residency

No public evidence identified of Mondelēz specifying data residency requirements within Israel or selecting cloud regions in ways that would route data through Israeli infrastructure. No public evidence identified of sovereign cloud participation agreements with Israeli state entities.

Defence, Intelligence & Security Sector Technology Relationships

Military and Intelligence Contracts

No public evidence identified of any contract, partnership, or service agreement between Mondelēz/Cadbury and the Israeli Ministry of Defence, the Israel Defense Forces, or Israeli intelligence agencies.

Dual-Use Technology Provision

No public evidence identified of Mondelēz’s commercially deployed technology being reported as used for military, intelligence, or law enforcement surveillance purposes within Israel or the occupied Palestinian territories.

Offensive Cyber and Weapons Technology

No public evidence identified. Mondelēz is a consumer goods and food conglomerate with no known cybersecurity product development activity, offensive capability development, zero-day tools programme, or weapons systems involvement.

AI, Algorithmic & Autonomous Systems

AI-Powered Marketing and Enterprise Operations

Mondelēz, in partnership with Accenture and Publicis Groupe, has developed AI-powered marketing capabilities confirmed as operational from 2024.1314161715 These include personalised asset generation at scale — more than 20 million marketing assets created via GCP AI/ML tools28 — and AI-driven consumer targeting and media optimisation.1317 The Accenture case study frames this as “Total Enterprise Reinvention,” covering demand forecasting, supply chain optimisation, and marketing efficiency across the business.1415

AI/ML Provision to Israeli State Bodies

No public evidence identified of Mondelēz/Cadbury providing AI, ML, computer vision, or autonomous decision-support systems to Israeli state, military, or security bodies.

Training Data and Model Development

No public evidence identified of Mondelēz AI models being trained on or having access to surveillance-derived datasets from Israel or the occupied Palestinian territories.

Autonomous Systems and Lethality

No public evidence identified. This category is not applicable to Mondelēz’s business domain.

Technology Ecosystem & R&D Footprint

”The Kitchen” Incubator — Israeli FoodTech Ecosystem Partnership

In 2019, Mondelēz International, through its SnackFutures innovation hub, entered a formal strategic collaboration with The Kitchen, described as Israel’s first FoodTech-focused incubator, confirmed by Mondelēz’s own investor relations press release.36 The press release states the collaboration gives Mondelēz “unparalleled access and visibility to one of the world’s leading food-tech ecosystems” and provides The Kitchen’s portfolio companies with access to Mondelēz’s global Technical Centres, pilot plants, and R&D expertise.36

The Kitchen was established in 2015 under the Israel Innovation Authority — a statutory agency of the Israeli state — and is operated and owned by the Strauss Group, one of Israel’s largest food and beverage companies.363738

The Strauss Group’s reported adoption of specific IDF brigades (Golani and Givati) and provision of material support to IDF units is a claim that circulates in BDS and NGO advocacy materials, including a submission to the UN Special Rapporteur on Occupied Palestinian Territories.39 This is documented as a civil society finding (see Civil Society Scrutiny section); it has not been independently adjudicated by a legal or regulatory body. Strauss has not publicly denied historical support programmes for IDF soldiers in available reporting.

SnackFutures Seed Investment — Torr

Mondelēz’s SnackFutures made a seed investment in Torr, an Israeli food-tech startup associated with The Kitchen incubator, confirmed by Mondelēz IR press release (2020).40 The technology domain is food product innovation (protein bar technology), not cybersecurity or surveillance.

CoLab Tech Accelerator — Israeli Startups

Mondelēz’s CoLab Tech Accelerator (second cohort, 2022) selected Kokomodo, described in the Mondelēz press release as an Israel-based company using cell-cultured technology to create climate-resilient cocoa, confirmed by an IR press release.41 Technology domain: agricultural food science. A further startup, Luminescent, was attributed as Israeli-origin in the prior report; this specific attribution is [NOT INDEPENDENTLY CONFIRMED AS ISRAELI-ORIGIN from primary source] — the primary press release text does not identify it as Israeli-domiciled in the available research.41

Direct Israeli R&D Operations

No public evidence identified of Mondelēz operating a dedicated R&D facility, engineering office, or innovation lab within Israel directly. The Kitchen collaboration provides access to the Israeli FoodTech ecosystem without direct facility operation.

Acquisitions of Israeli Technology Companies

No public evidence identified of Mondelēz acquiring an Israeli-origin technology company. Mondelēz’s publicly documented acquisitions (including Clif Bar, Ricolino, Give & Go) are in the food and confectionery domain, are not technology companies, and are not Israeli-domiciled.

Patent and IP Arrangements with Israeli Institutions

No public evidence identified of significant patent portfolios, licensing agreements, or co-development arrangements between Mondelēz and Israeli research institutions such as the Technion, Hebrew University, or Weizmann Institute.

Civil Society Scrutiny & Regulatory History

NGO and Academic Reports

The Just Peace Advocates submission to the UN Special Rapporteur on Occupied Palestinian Territories (May 2020) references the Strauss Group and its relationship with IDF units in the context of corporate actors in occupied territories.39 This document is an advocacy submission to a UN body; it is not a UN-issued finding or adjudicated determination. The “#NoTechForApartheid” campaign, documented by The Guardian and Al Jazeera, targeted Google and Amazon workers in relation to Project Nimbus.3435 These campaigns addressed the cloud providers directly; no NGO report, academic study, or UN report has been identified that specifically and primarily targets Mondelēz or Cadbury’s technology relationships with the Israeli state.

Boycott and Divestment Campaigns

Cadbury and Mondelēz have been subjects of consumer boycott calls within the BDS (Boycott, Divestment, Sanctions) movement, primarily on grounds related to the Mondelēz–Strauss Group connection through The Kitchen incubator and SnackFutures investment partnership.36403738 The BDS National Committee and associated campaigns have listed Cadbury among consumer brands targeted, citing the Strauss Group’s documented support for IDF soldiers and brigades as the primary grounds. These campaigns draw on NGO advocacy documents including the Just Peace Advocates UN submission.39

Mondelēz’s documented public response: No formal public statement specifically addressing BDS campaign claims about the Strauss/Kitchen relationship has been identified in major press or official corporate communications.

No regulatory inquiries, legal challenges, export control actions, or sanctions-related investigations involving Mondelēz’s technology sales or services to Israeli state entities have been identified. Source classes reviewed: SEC filings20, EU regulatory records, US Commerce Department export enforcement records, UN reports, and major press.

The Mondelēz International v. Zurich American Insurance litigation — arising from the 2017 NotPetya cyberattack — is noted for context only. It concerns insurance coverage for a cyberattack attributed to Russian state actors, not technology export or Israeli state-related regulatory action, and is outside the scope of this audit section.

End Notes

Footnotes

  1. https://www.mondelezinternational.com/careers/jobs/job/index.html?jobid=r-158430&jobtitle=iam+(cyberark)+engineer ↩ ↩2 ↩3 ↩4

  2. https://www.monster.com/job-openings/director-platform-line-manager-identity-access-management-east-hanover-nj–9228743a-4de8-4fdb-b305-0a25ce7f4fa4 ↩ ↩2 ↩3

  3. https://www.remoterocketship.com/company/mondelezinternational/jobs/iam-engineer-cyberark-india-remote/ ↩ ↩2

  4. https://www.crowdstrike.com/en-us/blog/inside-mondelez-identity-security-stategy/ ↩ ↩2

  5. https://www.mondelezinternational.com/careers/jobs/job/index.html?jobid=R-106486&jobtitle=Senior+Cybersecurity+Professional,+Vulnerability+Management ↩ ↩2

  6. https://www.cyberark.com/press/cyberark-and-wiz-team-up-to-provide-complete-visibility-and-control-for-cloud-created-identities/ ↩

  7. https://www.checkpoint.com/press-releases/check-point-enters-next-level-of-strategic-partnership-with-wiz-to-deliver-integrated-cnapp-and-cloud-network-security-solution/ ↩

  8. https://www.just-drinks.com/features/drinks-industry-faces-cybersecurity-challenges-from-smart-manufacturing/ ↩

  9. https://www.profoodworld.com/automation/security/article/21109420/how-kellogg-manages-cybersecurity-risks-in-manufacturing ↩

  10. https://www.cxtoday.com/security-privacy-compliance/servicenow-in-talks-to-buy-armis-for-7bn-in-next-phase-of-cx-driven-cybersecurity-consolidation/ ↩ ↩2

  11. https://www.landbase.com/blog/fastest-growing-industrial-iot-companies ↩ ↩2

  12. https://www.orange-business.com/en/business-needs/customer-experience/cognitive-omnichannel-customer-experience ↩

  13. https://newsroom.accenture.com/news/2024/mondelez-international-joins-forces-with-accenture-and-publicis-groupe-to-advance-ai-powered-marketing-capabilities ↩ ↩2 ↩3 ↩4 ↩5

  14. https://www.accenture.com/us-en/case-studies/consumer-goods-services/mondelez-data-ai-transformation ↩ ↩2 ↩3 ↩4

  15. https://www.accenture.com/content/dam/accenture/final/accenture-com/document/Accenture-Mondelez-International-Abridged-Transcript-FINAL.pdf ↩ ↩2 ↩3

  16. https://www.i-com.org/news/mondelz-accenture-and-publicis-groupe-team-up-to-drive-ai-innovation ↩ ↩2

  17. https://aimagazine.com/articles/mondelez-accenture-publicis-groupe-use-ai-for-marketing ↩ ↩2 ↩3

  18. https://aws.amazon.com/solutions/case-studies/mondelez-case-study/ ↩ ↩2

  19. https://www.mondelezinternational.com/procurement/vendor-cyber-risk-management/ ↩

  20. https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001418135&type=10-K&dateb=&owner=include&count=10 ↩ ↩2

  21. https://poinstitute.com/wp-content/uploads/2016/12/POI-Fall-2016-Booklet-v6.pdf ↩

  22. https://traxretail.com/blog/5-inventive-uses-computer-vision-retail/ ↩

  23. https://www.expresscheckout.co/p/express-checkout-issue-9 ↩

  24. https://massmarketretailers.com/trigo-retail-develops-computer-vision-ai-powered-loss-prevention-solution/ ↩

  25. https://www.trigoretail.com/pos-analytics-and-computer-vision-revolutionizing-retail-loss-prevention/ ↩

  26. https://ir.mondelezinternational.com/news-releases/news-release-details/mondelez-international-moves-amazon-web-services-advance-its ↩

  27. https://www.itbrew.com/stories/2025/12/15/inside-mondelez-international-s-digital-transformation-strategy ↩

  28. https://cloud.google.com/customers/mondelez ↩ ↩2

  29. https://en.wikipedia.org/wiki/Project_Nimbus ↩ ↩2

  30. https://cloud.google.com/blog/topics/inside-google-cloud/google-cloud-selected-to-provide-cloud-services-to-the-state-of-israel ↩ ↩2 ↩3

  31. https://www.gov.il/en/pages/press_24052021 ↩ ↩2

  32. https://www.972mag.com/project-nimbus-contract-google-amazon-israel/ ↩

  33. https://www.theguardian.com/us-news/2025/oct/29/google-amazon-israel-contract-secret-code ↩

  34. https://www.theguardian.com/commentisfree/2021/oct/12/google-amazon-workers-condemn-project-nimbus-israeli-military-contract ↩ ↩2

  35. https://www.aljazeera.com/news/2024/4/23/what-is-project-nimbus-and-why-are-google-workers-protesting-israel-deal ↩ ↩2

  36. https://ir.mondelezinternational.com/news-releases/news-release-details/mondelez-international-collaborate-israeli-foodtech-incubator/ ↩ ↩2 ↩3 ↩4

  37. https://www.foodbev.com/news/mondelēz-international-partners-with-israeli-incubator-the-kitchen ↩ ↩2

  38. https://www.fooddive.com/news/mondelez-invests-in-israeli-food-tech-incubator/553634/ ↩ ↩2

  39. https://www.justpeaceadvocates.ca/wp-content/uploads/2020/05/UAlberta-OHCHR-submission-1.pdf ↩ ↩2 ↩3

  40. https://ir.mondelezinternational.com/news-releases/news-release-details/mondelez-international-snackfutures-makes-seed-investment/ ↩ ↩2

  41. https://ir.mondelezinternational.com/news-releases/news-release-details/mondelez-international-selects-10-start-ups-participate-second ↩ ↩2