INDEX / DIRECTORY / CYBERARK / V-ECON

Cyberark V-ECON

ECONOMIC AUDIT UPDATED 2026-06-11
V-ECON Score 9.20 /10 B Cyberark — BDS-1000 635
V-ECON 9.20

Evidence-only forensic audit. Scoring happens downstream — see the main dossier for the composite assessment.

CyberArk — V-ECON Audit

Supply Chain & Sourcing Relationships

CyberArk is a software and cybersecurity services company whose principal inputs are human capital and cloud infrastructure rather than physical goods 12. No public evidence has been identified regarding commercial relationships with Israeli agricultural aggregators, produce exporters, or goods-based supply chain counterparties 34. No public evidence identified regarding importer of record structures, as CyberArk licenses software and provides cloud-delivered security services rather than importing physical goods 12. Seasonal sourcing patterns are not applicable to CyberArk’s software and SaaS business model. AWS launched an Israeli cloud infrastructure region in July 2023, and CyberArk’s use of AWS infrastructure in Israel is consistent with its platform architecture but is not separately disclosed as a supply chain relationship in public filings.

Product Origin, Labeling & Regulatory Compliance

No public evidence identified regarding settlement-origin products, as CyberArk produces software rather than physical goods 34. Country-of-origin labeling regulations governing physical goods have no application to this software vendor, as CyberArk’s products are licensed digitally with no physical labeling obligation 12. CyberArk’s SEC 20-F filings explicitly state that its products may be subject to the Israeli Defense Export Control Law, administered by the Israeli Ministry of Defense’s Defense Export Controls Agency (DECA) 12. CyberArk’s product documentation confirms that export restrictions for certain territories require Israeli Ministry of Defense approval 5. Israel in November 2025 repealed broad encryption controls, with export controls now focused on dual-use items under the Wassenaar Arrangement 6. No public DECA ruling or specific export license determination for CyberArk products has been identified in open-source records.

Glasgow Caledonian University (GCU): The GCU Students’ Association passed a motion calling for the university to end its CyberArk contract, citing the company’s alleged IDF connections 7. A £1,436,210 contract (2023-2026) for MFA/identity services was terminated after student activism 7. University of Aberdeen: Student newspaper reported on backlash against a CyberArk contract in November 2024, citing alleged IDF links as the basis for objection 8.

Investment, Capital & Financial Exposure

CyberArk is incorporated in Israel and has maintained its primary R&D and operational headquarters in Petach Tikva, Israel, since its founding in 1999 129. In May 2021, CyberArk inaugurated a dedicated R&D centre at the Gav-Yam Negev Tech Park in Beersheba, subsequently expanded in December 2021 101112. The investment represents a capital commitment to Israeli physical infrastructure in a government-designated technology zone. No capital investments by CyberArk in the West Bank, Gaza, or Golan Heights are documented in public filings or press sources 1234.

Petach Tikva serves as the global R&D centre and primary location since company founding 9. The Beersheba R&D Centre at Gav-Yam Negev Tech Park has been operational from May 2021 11 and is located within the government-sponsored CyberSpark national cyber ecosystem 12. No innovation labs, accelerator programmes, or operational facilities operated by CyberArk within occupied territories are documented.

Pre-acquisition, CyberArk had no parent company and was an independent publicly listed Israeli company on NASDAQ (ticker: CYBR) 2. Palo Alto Networks acquisition: CyberArk shareholders approved the acquisition by Palo Alto Networks in 2025, with the deal at approximately $25 billion in combined cash and stock consideration ($45.00 cash + 2.2005 PANW shares per CYBR share) 13. The transaction closed February 11, 2026, and CyberArk operates as a wholly-owned subsidiary of Palo Alto Networks 14. Athens Strategies Ltd. is the Israeli wholly-owned subsidiary of Palo Alto Networks used as the merger vehicle in the acquisition 15. Pre-acquisition, major institutional shareholders included large US-domiciled asset managers (BlackRock, Vanguard, T. Rowe Price, ARK Invest) 12. Founders Udi Mokady and Alon Cohen held shares, with specific percentages disclosed in 20-F filings 12. Jerusalem Venture Partners (JVP) held approximately 46% of CyberArk at IPO, and JVP founder Erel Margalit is a former Knesset member (Labor Party) 16. No evidence found linking JVP to defense-sector or settlement investment portfolios. No public evidence has been identified of CyberArk or Palo Alto Networks holding Israeli sovereign bonds or Israel-focused investment funds as disclosed portfolio positions in SEC filings 12.

Operational Presence & Market Activity

Global and operational headquarters is Newton, Massachusetts, USA (US legal address for SEC purposes) 2. Primary R&D and Israeli headquarters is located in Petach Tikva, Israel—the founding and ongoing primary operational base, confirmed as current 9. The Beersheba R&D Centre at Gav-Yam Negev Tech Park has been operational from May 2021 11 and is confirmed present as of 2024 filings. No offices, warehouses, or operational locations in the West Bank, Gaza, or Golan Heights are documented 23.

CyberArk employs approximately 8,000–9,000 employees globally as of 2024, with Israel hosting the largest single-country concentration of employees as the primary R&D and engineering base 14. Approximately 25% of the workforce (~1,000 of ~4,000) was based in Israel pre-acquisition 14. Following the outbreak of conflict on October 7, 2023, CyberArk publicly acknowledged that employees were called to military reserve duty, and CRN reported that CyberArk maintained operational continuity despite the personnel mobilisation. Post-acquisition, approximately 700 employees (10% of global workforce) were notified of layoffs 14.

CyberArk does not characterise Israel as an export market in its filings, as Israel is its home jurisdiction and primary R&D base 12. In investor materials and annual reports, Israel is referenced as the location of core engineering, product development, and executive leadership—not as a revenue-generating sales territory. No Israel-specific revenue figure is attributed in public disclosures. Israeli government or military contracts, if any, are aggregated into regional revenue figures and are not separately identified.

Corporate Structure & Foundational Ties

CyberArk was founded in 1999 in Israel by two co-founders with documented IDF service backgrounds 17. Co-founder Alon Nisim Cohen served in Mamram—the IDF’s Center for Computing and Information Systems 17. Co-founder Udi (Ehud) Mokady (former CEO, Executive Chairman post-acquisition) served in Unit 8200, the IDF’s signals intelligence and cyber unit 1718. Both founders’ IDF service is confirmed in public sources 17. The company was originally incorporated in Israel under Israeli corporate law 12.

Legal domicile is Israel (incorporated under Israeli law) 12. The US operational address is Newton, Massachusetts (used for SEC correspondence and US legal purposes) 2. CyberArk operates a dual-headquarters structure common to Israeli technology companies listed on US exchanges 12. Post-acquisition by Palo Alto Networks (closed February 2026), CyberArk operates as a subsidiary, with Athens Strategies Ltd. as the Israeli merger vehicle 15.

No state ownership stake in CyberArk is documented 12. No government board appointees are documented in CyberArk’s board composition disclosures in 20-F filings 2. Israeli Defense Export Control Law: CyberArk’s 20-F filings explicitly disclose that its products may be subject to the Israeli Defense Export Control Law administered by DECA, creating a confirmed, company-disclosed regulatory dependency 12. This means certain CyberArk product exports require approval from the Israeli Ministry of Defense. CyberArk’s Beersheba R&D centre is geographically co-located with the Israel National Cyber Directorate (INCD), Ben-Gurion University, and IDF C4I Corps facilities 101112. No formal Israeli government critical national infrastructure designation for CyberArk has been identified in public sources. No golden shares, founder shares, or charter restrictions structurally tying CyberArk to Israeli state policy objectives are identified in SEC filings 12.

Profit Repatriation & Economic Contribution

CyberArk does not separately disclose Israeli-market revenue in its public filings, as geographic revenue is reported in broad regional categories—Americas; Europe, Middle East & Africa (EMEA); Asia-Pacific—in 20-F filings 2. Reported consolidated financials: Full Year 2024 total revenue was $923.0 million, up approximately 32% year-over-year, with Q4 2024 revenue of $314.4 million, up 41% year-over-year 2. The Americas represents the largest revenue segment, and EMEA (which includes Israel) is the second largest 2.

Pre-acquisition, CyberArk was incorporated in Israel, with its Israeli subsidiary entities generating R&D expenditure and associated income in Israel 1. Israeli operations were structured to benefit from Preferred Enterprise tax incentives on qualifying IP income under Israeli law 1. Under this structure, profits generated globally by CyberArk’s international subsidiaries flowed upward to the Israeli parent entity, contributing to Israeli corporate tax receipts. Post-acquisition, following the close of the Palo Alto Networks acquisition (February 2026), ongoing profit flows from CyberArk’s global operations—including its Israeli R&D operations—will revert to flowing to Palo Alto Networks as the US-domiciled parent, representing a structural shift in profit repatriation from Israel-to-global to Israel-to-US. The acquisition generated an estimated $2 billion (NIS 6.7 billion) in one-time capital gains tax revenue for the Israeli Treasury from gains realised by CyberArk shareholders and employees, based on 25-30% estimated Israeli ownership 19.

CyberArk 20-F filings reference eligibility for “Preferred Technology Enterprise” (12% corporate tax on capital gains) and “Special Preferred Technology Enterprise” (6% rate) under Israeli law 1. CyberArk is characterised in Israeli business press and government communications as a flagship anchor company of the Israeli cybersecurity sector. The company’s establishment of its Beersheba R&D centre in the CyberSpark ecosystem—a government-initiated project explicitly designed to build a national cyber capital in the Negev region—is cited in official and semi-official communications as validation of the ecosystem’s strategy 1112. The $25 billion acquisition by Palo Alto Networks is described in Israeli financial press as one of the largest technology exits in Israeli history 19.

CyberArk CSR page lists ELIA (supporting visually impaired children in Israel) as a charitable recipient, plus US-based organizations (Cradles to Crayons, Dana-Farber, TUGG) 20. At IPO, CyberArk donated employee stock options to Tmura (The Israeli Public Service Venture Fund) that converted to approximately $750,000 for Israeli nonprofits upon lockup expiration 21. Tmura has distributed over $10 million to more than 100 nonprofits since 2002 22.

End Notes

Footnotes

  1. https://www.sec.gov/Archives/edgar/data/1598110/000117891320000737/cybr20f2019.htm ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15 ↩16 ↩17 ↩18 ↩19

  2. https://www.sec.gov/Archives/edgar/data/1598110/000117891325000811/zk2532806.htm ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15 ↩16 ↩17 ↩18 ↩19 ↩20 ↩21 ↩22 ↩23 ↩24

  3. https://www.whoprofits.org/companies/all ↩ ↩2 ↩3 ↩4

  4. https://dontbuyintooccupation.org/wp-content/uploads/2024/11/2024_DBIO-IV_Company-list.pdf ↩ ↩2 ↩3

  5. https://docs.cyberark.com/remote-access-on-prem/latest/en/content/resources/frontmatter/cc_restrictedaccess.htm ↩

  6. https://mod.gov.il/en/departments/defense-exports-control-agency-deca ↩

  7. https://www.gcustudents.co.uk/thestudentvoice/gcu-should-not-renew-the-contract-with-cyberark ↩ ↩2

  8. https://www.gaudie.co.uk/wpress/index.php/news/2024/11/20/uoa-faces-backlash-over-cyber-ssecurity-contract-with-idf-linked-firm ↩

  9. https://www.sec.gov/Archives/edgar/data/1598110/000110465926010015/tm264972d1_6k.htm ↩ ↩2 ↩3

  10. https://www.jpost.com/business-and-innovation/tech-and-start-ups/article-704323 ↩ ↩2

  11. https://www.calcalistech.com/ctech/articles/0,7340,L-3909007,00.html ↩ ↩2 ↩3 ↩4 ↩5

  12. https://americansforbgu.org/cyberark-opens-rd-center-beer-sheva-tech-park/ ↩ ↩2 ↩3 ↩4

  13. https://www.paloaltonetworks.com/company/press/2025/palo-alto-networks-announces-agreement-to-acquire-cyberark—the-identity-security-leader ↩

  14. https://en.globes.co.il/en/article-700-cyberark-employees-to-lose-jobs-after-25b-exit-1001535229 ↩ ↩2 ↩3 ↩4

  15. https://www.sec.gov/Archives/edgar/data/1327567/000119312525224204/d99065d424b3.htm ↩ ↩2

  16. https://en.wikipedia.org/wiki/Jerusalem_Venture_Partners ↩

  17. https://www.dropsitenews.com/p/israel-technology-palo-alto-networks-microsoft-unit-8200 ↩ ↩2 ↩3 ↩4

  18. https://palestiniangenocide.org/boycott/companies/cyberark ↩

  19. https://en.globes.co.il/en/article-cyberark-deal-worth-2b-to-israeli-state-coffers-1001517665 ↩ ↩2

  20. https://www.cyberark.com/community-social-responsibility ↩

  21. https://www.linkedin.com/posts/yadin-kaufmann-b208327_very-grateful-to-udi-mokady-and-his-colleagues-activity-7398050426966753280-WCcK ↩

  22. https://tmura.org/ ↩