INDEX / DIRECTORY / SPLUNK

Splunk

Technology 146 CITED SOURCES UPDATED 2026-05-19
BDS-1000 Score 319 /1000 D Tier D — Moderate

BDS-1000 Dossier: Splunk Inc.


Target Profile

FieldDetail
Company NameSplunk Inc. (now Cisco Splunk)
Ticker / StatusSPLK (delisted March 2024); acquired by Cisco Systems
HeadquartersSan Francisco, California (US); incorporated Delaware
Israeli EntitySplunk Services Israel Ltd. (company no. 516040250; registered address Hamelacha 32, Netanya)
SectorEnterprise software — SIEM, SOAR, IT observability, data analytics
Parent EntityCisco Systems Inc. (NASDAQ: CSCO) since 18 March 2024
FoundersErik Swan, Rob Das, Michael Baum (US-domiciled)
BDS-1000 ScoreBRS 326 — Tier D (Moderate)
Israeli-Nexus One-LinerSplunk maintained an Israeli R&D subsidiary (Netanya) and integrates multiple Israeli-origin security technologies; no confirmed Israeli military contracts; V-ECON score driven by Israeli operational presence; post-acquisition Cisco’s Israel footprint is structurally upstream.

Executive Summary

Splunk Inc. is a US-incorporated, San Francisco-headquartered enterprise software company that developed and sold platforms for searching, monitoring, and analyzing machine-generated data — primarily as SaaS or on-premises software licenses. Its core product lines (Enterprise Security/SIEM, SOAR, and Observability Cloud) serve government, enterprise, and commercial customers globally12. On 18 March 2024, Cisco Systems completed its acquisition of Splunk for approximately $28 billion; Splunk now operates as a wholly owned Cisco subsidiary and has been delisted from NASDAQ12.

The documented Israeli-nexus vectors are concentrated in two domains. Economically, Splunk maintained a confirmed R&D and engineering subsidiary in Israel (Splunk Services Israel Ltd., Netanya) that was active through at least 2023, drawing operational funding from US headquarters as a standard cost-centre R&D operation345. The Israeli presence — spanning the pre-acquisition period — is the primary driver of the V-ECON score. Technologically, Splunk’s platform integrates telemetry from a cluster of Israeli-origin or Israeli co-founded security vendors (Check Point, CyberArk, SentinelOne, Palo Alto Networks/Cortex XSOAR, Wiz, Claroty, Armis), representing documented interoperability relationships rather than OEM dependencies or embedded Israeli software in Splunk’s core product code67.

What the evidence does not support is equally material. No verified contracts, framework agreements, or procurement relationships between Splunk and Israeli Ministry of Defence, IDF, Shin Bet, or Mossad have been identified in any public source8910. No Splunk products have been documented as purpose-built for military, tactical, or weapons-systems applications. Splunk does not appear in the UN Human Rights Council database of settlement-linked businesses (A/HRC/43/71), the Who Profits Research Center database, or the BDS Movement’s campaign target list111213. No organised divestment campaigns citing Splunk specifically for Israeli military supply or occupation-related activity have been identified. The claim that Israeli IMOD tenders name-specify Splunk alongside QRadar — which circulated during research — could not be verified in any tender record or reputable source and is marked unsubstantiated14.

The resulting BRS of 326 reflects a Tier D (Moderate) classification. The V-MIL score is zero: no military nexus was documented across any of the seven V-MIL sub-domains. The V-DIG score is elevated by documented Israeli-origin technology integration relationships. The V-POL score reflects the structural presence of the In-Q-Tel intelligence-community investment tie and the comparative absence of public statements on the Israel-Palestine conflict relative to the company’s documented precedent of crisis-driven corporate stances.


Timeline of Relevant Events

DateEventSource
2003Splunk Inc. founded in San Francisco by Erik Swan, Rob Das, and Michael Baum (US nationals)V-POL End Notes15
Pre-2012In-Q-Tel (US Intelligence Community strategic investment arm) makes investment in Splunk prior to IPO; documented in Splunk S-1 registration statementV-POL End Notes16
2012Splunk IPO; transitions from In-Q-Tel portfolio to arms-length commercial customer relationshipV-POL End Notes16
Pre-2020Splunk establishes R&D and engineering office in Tel Aviv areaV-ECON End Notes35
2019Splunk achieves FedRAMP authorization; US DoD Impact Level authorizations for Government and Public Sector product suiteV-MIL End Notes17
21 September 2022Cisco announces intent to acquire SplunkV-ECON End Notes18
21 September / October 2023Cisco/Splunk acquisition closes; Splunk delisted from NASDAQ; becomes wholly owned Cisco subsidiaryV-MIL End Notes1; V-ECON End Notes1
October 2023Hamas attack on Israel; subsequent Israeli military operations in Gaza beginContextual
Post-October 2023No Splunk corporate statement issued on Israel-Palestine conflict; contrast: Splunk issued named substantive blog post on Ukraine war in February 2022V-POL End Notes1914
18 March 2024Cisco acquisition formally completed; Splunk Services Israel Ltd. subsumed into Cisco Israel structureV-ECON End Notes110
June 2026Live verification: IMOD tender claim re: Splunk + QRadar found unsubstantiated; Ministry of Energy civilian Splunk usage at .conf19 confirmedV-DIG End Notes14

Corporate Overview

Corporate Structure and Ownership

Splunk Inc. was incorporated in Delaware with operational headquarters in San Francisco, California. It operated as an independent public company (NASDAQ: SPLK) from its 2012 IPO until its acquisition by Cisco Systems. The acquisition — announced September 2022, formally closed September/October 2023, and legally finalized March 2024 — transferred all Splunk equity to Cisco at approximately $157 per share ($28 billion total)1218.

Pre-acquisition beneficial ownership was concentrated among US institutional investors: Vanguard Group, BlackRock, and T. Rowe Price were the largest shareholders as documented in SEC beneficial ownership disclosures2021. No Israeli state sovereign wealth fund, Israeli-domiciled strategic investor, or Israeli institutional holder with governance influence was identified.

Post-acquisition, all Splunk governance structures were dissolved as a standalone entity. Cisco — also Delaware-incorporated, NASDAQ-listed — now holds 100% of Splunk’s equity and reports Splunk’s contribution on a consolidated basis210.

Israeli Entities and Operations

Splunk Services Israel Ltd. is confirmed as Splunk’s Israeli legal entity (Israeli company number 516040250), registered at Hamelacha 32, Netanya, and listed in Splunk Inc.’s own SEC Form 10-K subsidiary exhibits for FY2020 through FY202345. The registered seat is Netanya; Tel Aviv references in career listings and technology press likely reflect office location rather than registered domicile.

The Israeli office was characterised as an R&D and engineering centre focused on core platform and security product development352223. It operated as a cost centre — drawing operational funding from US headquarters — rather than as a profit-generating subsidiary repatriating earnings to Israel. This is structurally consistent with the standard multinational R&D centre model: intellectual property developed at the centre was owned by the US parent entity.

The scope of the Israel office (estimated at tens to low hundreds of engineers based on LinkedIn and Glassdoor data through 2022–2023) was directional only and not independently verified through auditable sources2425.

Cisco Israel — the parent entity’s own Israeli operations — maintains substantial, long-established R&D, sales, and office presence in Israel (Herzliya and Tel Aviv areas), built through prior acquisitions of Israeli networking and security companies26. This Cisco-level Israel footprint is distinct from Splunk’s legacy independent footprint and represents the relevant parent-entity exposure as of mid-2024 onward. However, Cisco’s specific role with respect to Splunk technology deployment within Cisco-Israel operational relationships is not separately disclosed in any available public filing — a material downstream evidence gap.

Integration Relationships with Israeli-Origin Technology Vendors

Splunk’s platform integrates telemetry from a documented cluster of Israeli-origin or Israeli co-founded security vendors. All relationships are technology integration/data ingestion in character: Splunk functions as the central SIEM/SOAR platform; Israeli-origin tools serve as telemetry sources or action targets within Splunk workflows. No evidence has been identified that any Israeli-origin software is embedded in Splunk’s core product code, cloud data pipeline, or licensed at the OEM level67.

VendorIsraeli ConnectionNature of Integration
Check Point Software TechnologiesFounded in Israel; HQ Tel AvivSmartEvent, firewall, threat prevention logs feed Splunk SIEM/SOAR via Splunkbase Add-On. Bidirectional in certain configurations.
CyberArk SoftwareFounded Israel; HQ Newton MA / Ra’anana ILPAM platform audit events and vault logs forwarded to Splunk for SIEM correlation. Named Splunk technology partner.
SentinelOneIsraeli co-founded; HQ Mountain View CAEDR telemetry ingested via published Splunk Add-On and App. Named Splunk technology alliance partner.
Palo Alto Networks / Cortex XSOARIsraeli co-founders (founders of Demisto); HQ Santa Clara CADeep SOAR workflow integration; firewall logs, Prisma Cloud alerts, WildFire threat intelligence ingest into Splunk. Most operationally significant integration.
WizIsraeli-founded; HQ New YorkCloud security posture management (CSPM) integrates for cloud security event forwarding to Splunk.
ClarotyIsraeli co-founded; HQ New YorkOT/IoT security platform integrates for operational technology network monitoring and alert forwarding.
Armis SecurityIsraeli co-founded; HQ San FranciscoAgentless device security platform integrates for asset visibility and threat telemetry ingestion. Named Splunk technology partner.
NICE Ltd.Founded Israel; HQ Ra’anana ILWorkforce management/contact-centre analytics integrations within broader Splunk ecosystem. Nature of direct licensing/OEM relationship not confirmed.
Verint SystemsIsraeli co-founded; HQ Melville NYSecurity intelligence products reference Splunk as data destination. Ongoing status post-2023 unconfirmed.

Domain Summaries

V-MIL: Military

V-Domain Score: 0.00 (I=0.50, M=0.50, P=0.50)

Mechanism of Involvement

The V-MIL audit examined seven sub-domains covering direct defence contracts, dual-use products, heavy machinery and construction, supply chain integration with defence primes, logistical sustainment, munitions and weapons systems, and export licensing and regulatory history.

Direct Defence Contracting: No public evidence was identified of any verified contract, tender award, framework agreement, or memorandum of understanding between Splunk and the Israeli Ministry of Defence (IMOD), Israel Defence Forces (IDF), Israel Prison Service, Israel Border Police, or any other Israeli state security body89. Splunk’s documented government contracting activity is concentrated in the US federal sector, having achieved FedRAMP authorization in 2019 and Department of Defense Impact Level authorizations for its Government and Public Sector product suite172728. No Splunk entry was identified in SIBAT public export directories, Israeli defence exhibition catalogues, or Israeli defence procurement registries29.

Dual-Use Products: No evidence was identified that Splunk manufactures or markets ruggedised, tactical, mil-spec, or otherwise defence-grade hardware variants of its products. Splunk’s core products (Enterprise Security, SOAR, Observability Cloud) are general-purpose enterprise tools available commercially to any qualifying organization. No Israeli-specific tactical, mil-spec, or contract-modified variant of any Splunk product has been identified in public sources630.

Munitions and Weapons Systems: No public evidence was identified that Splunk has any role in the manufacture, integration, maintenance, or component supply of Iron Dome, David’s Sling, Arrow missile defence, F-35 fighter aircraft, main battle tanks, warships, or ballistic missile systems. The SIPRI Arms Transfers Database contains no record of Splunk as a supplying entity in this context31. Splunk does not develop, sell, license, or maintain offensive cyber capabilities, zero-day exploit tools, digital weapons systems, or systems designed to produce targeting decisions632.

Supply Chain Integration: No public evidence was identified of any verified supply relationship between Splunk and Israeli defence prime contractors including Elbit Systems, Israel Aerospace Industries (IAI), Rafael Advanced Defense Systems, or Israel Military Industries (IMI/Elbit Land)333435.

Export Licensing: No public evidence was identified of any government decision — in any jurisdiction — to grant, deny, suspend, or revoke an export licence for Splunk products specifically to Israeli military or security end-users. No investigation, citation, enforcement action, or administrative penalty related to Splunk’s compliance with arms embargoes or export control regimes affecting defence trade with Israel has been identified36.

Counter-Arguments and Evidence Limits

Splunk’s strongest defence in the military domain is structural: it is an enterprise software company with no physical goods, no munitions, no defence materiel, and no documented Israeli government procurement relationships. Its product classification as general-purpose enterprise software places it outside the categories of defence articles that ordinarily appear in Israeli defence procurement registries. The absence of Splunk from the Who Profits database, the UN HRC settlement database, the BDS Movement’s target list, and all civil society campaign materials targeting technology companies on Israeli defence grounds is consistent with the absence of a documented military nexus — not definitive proof of absence, but the evidentiary record as it stands.

A material evidence gap exists: Israeli defence procurement is classified, and no Israeli public procurement database equivalent to USASpending.gov was accessible during the audit. Whether Splunk software reaches Israeli defence end-users through indirect channel partner relationships — or through US government-to-government technology-sharing arrangements — cannot be confirmed or excluded from available public records alone937.

Named Entities and Evidence Map

EntityRelationshipEvidence Status
Israeli Ministry of Defence (IMOD)Alleged customerNot verified — no documented contract, tender, or MoU
Israel Defence Forces (IDF)Alleged customerNot verified — no documented contract, tender, or MoU
Shin Bet / MossadAlleged customerNot verified — no documented contract, tender, or MoU
Elbit Systems / IAI / RafaelDefence prime supply chainNot verified — no documented supply relationship
SIBATExport registryNot identified — no Splunk entry found
SIPRI Arms Transfers DatabaseArms transfer recordNot listed — no Splunk record found
US DoD (as US partner)Federal contracts holderConfirmed — US domestic contracts only

V-DIG: Digital

V-Domain Score: 0.92 (I=5.00, M=1.50, P=6.00)

Mechanism of Involvement

The V-DIG audit examined enterprise technology stack integration, surveillance and biometric technologies, cloud infrastructure and data residency, defence and intelligence sector technology relationships, AI and autonomous systems, and technology ecosystem R&D footprint.

Israeli-Origin Technology Integration: The primary documented digital vector is Splunk’s integration ecosystem — a documented cluster of Israeli-origin and Israeli co-founded security vendors whose telemetry feeds into Splunk’s SIEM/SOAR platform. The most operationally significant is the Palo Alto Networks / Cortex XSOAR relationship: Cortex XSOAR (formerly Demisto, Israeli-founded) has deep SOAR workflow integration with Splunk Enterprise Security, enabling playbook-driven automated response across firewall logs, cloud security alerts, and threat intelligence678. Check Point, CyberArk, SentinelOne, Wiz, Claroty, Armis, NICE, and Verint also maintain documented integration relationships, ranging from confirmed ongoing (Check Point, CyberArk, SentinelOne, Palo Alto, Wiz, Claroty, Armis) to confirmed integration-level only (NICE, Verint)67.

These integrations represent interoperability relationships, not embedded OEM dependencies: Israeli-origin security tools serve as telemetry sources or action targets within Splunk workflows. No evidence has been identified that any Israeli-origin software is embedded in Splunk’s own product code or cloud data pipeline67.

Cloud Infrastructure: Splunk Cloud (SaaS) is hosted on Amazon Web Services (AWS) and Google Cloud Platform123. AWS launched an Israel (Tel Aviv) region in August 2023; Google Cloud launched an Israel region in 2024. No public evidence was identified that Splunk specifically routes Israeli customer data through AWS Israel or Google Cloud Israel infrastructure, or that Splunk has contracted dedicated colocation or data centre capacity within Israel123. Cisco’s Israeli offices (Herzliya and Tel Aviv) are office facilities; no evidence was identified that they host Splunk Cloud infrastructure or data processing capacity26.

Project Nimbus: Project Nimbus is the Israeli government cloud contract awarded to AWS and Google in 2021 (valued ~$1.2 billion), under which both hyperscalers provide cloud services to Israeli government and military bodies. Splunk is a software platform that runs atop cloud infrastructure; it is not a cloud infrastructure provider. No public evidence was identified that Splunk holds a direct sub-contract, named work order, or stated role within Project Nimbus. Cisco is also not listed among Project Nimbus prime or named sub-contractors. However, sub-contractor and ISV relationships below the AWS/Google prime level in Project Nimbus are not publicly disclosed; it therefore cannot be confirmed or excluded from available public records alone whether Cisco/Splunk software is deployed within Project Nimbus-scoped infrastructure1938.

US Federal Government Technology: Splunk holds documented US federal government contracts with agencies across the US intelligence community and Department of Defense for SIEM, log management, and observability software — visible in USASpending.gov records39. These are US-domestic contracts and do not independently constitute an Israeli military or intelligence nexus.

Dual-Use Profile: Splunk’s SIEM and SOAR platform is inherently dual-use — a general-purpose log aggregation, threat detection, and incident response tool used by government, law enforcement, and commercial SOCs globally. No public reporting, NGO documentation, or official disclosure has confirmed that Splunk’s technology has been deployed specifically for military, intelligence, or law enforcement surveillance applications within Israel or the Occupied Palestinian Territories in any documented instance192021.

Israeli State Usage (Verified — Civilian Only): One documented civilian Israeli-state usage was identified: Israel’s Ministry of Energy presented its use of Splunk-based machine learning at Splunk’s .conf19 conference14. This is a civilian ministry analytics deployment with no security or military dimension. No IDF, IMOD, police, or intelligence usage has been verified.

R&D Footprint: No evidence was identified of Splunk operating a dedicated R&D centre, engineering office, or innovation laboratory within Israel prior to the Cisco acquisition. Splunk’s named global engineering and product offices included San Francisco (HQ), Seattle, Denver, Austin, London, and Bangalore132.

Counter-Arguments and Evidence Limits

Splunk’s strongest defence in the digital domain rests on several pillars. First, all identified Israeli-origin integration relationships are interoperability/data-ingestion relationships — Splunk functions as the central platform; Israeli-origin tools feed data into it. No Israeli-origin software is embedded in Splunk’s core code, and Splunk does not license, OEM, or redistribute Israeli-origin technology at the component level. Second, Splunk’s product line is strictly defensive and observability-oriented: it does not develop offensive cyber capabilities, zero-day exploits, digital weapons, or systems designed to produce targeting decisions. Third, the confirmed Israeli state usage (Ministry of Energy) is explicitly civilian and represents the opposite of military involvement. Fourth, the existence of US federal government contracts — including with intelligence community agencies — does not create an Israeli defence nexus; these are documented US domestic arrangements.

The primary evidence gap is the indirect channel: Splunk distributes through Cisco’s Israeli channel partner and reseller network, making it structurally possible that Splunk licenses reach Israeli government or defence end-users without public confirmation. The impossibility of ruling this out does not constitute evidence of its occurrence. The Project Nimbus sub-contractor question is similarly open: Splunk’s absence from publicly disclosed subcontractor lists does not confirm its absence from the contract.

Named Entities and Evidence Map

EntityRelationshipEvidence Status
Check Point Software TechnologiesTechnology integration partnerConfirmed — Splunkbase Add-On; bidirectional SOAR integration
CyberArk SoftwareTechnology integration partnerConfirmed — PAM logs to Splunk SIEM
SentinelOneTechnology integration partnerConfirmed — EDR telemetry integration
Palo Alto Networks / Cortex XSOARTechnology integration partnerConfirmed — deep SOAR workflow; highest operational significance
WizTechnology integration partnerConfirmed — CSPM event forwarding
ClarotyTechnology integration partnerConfirmed — OT/IoT monitoring integration
Armis SecurityTechnology integration partnerConfirmed — asset visibility telemetry
NICE Ltd.Integration-level onlyNot confirmed at contract level
Verint SystemsData-forwarding integrationUnconfirmed post-2023
AWS / Google Cloud (Israel regions)Cloud infrastructure providersSplunk Cloud hosted on AWS/GCP globally; no identified Israel-specific routing
Project Nimbus (AWS + Google prime)Israeli government cloudSplunk not a named sub-contractor; cannot be confirmed or excluded
Israeli Ministry of EnergyConfirmed civilian customerConfirmed — .conf19 conference presentation of Splunk ML use
IDF / IMOD / Shin Bet / MossadAlleged customersNot verified — no confirmed contracts
Cisco TalosPost-acquisition threat intelligenceNo Israeli-origin intelligence provenance identified

V-ECON: Economic

V-Domain Score: 4.64 (I=6.50, M=5.00, P=7.00)

Mechanism of Involvement

The V-ECON audit examined supply chain and sourcing relationships, product origin and labeling, investment and capital exposure, operational presence, corporate structure, and profit repatriation.

Israeli R&D Presence (Primary Vector): The confirmed operational presence in Israel constitutes the primary economic nexus. Splunk Services Israel Ltd. (Israeli company number 516040250; registered address Hamelacha 32, Netanya) appears in the Israeli companies registry and in Splunk Inc.’s own SEC Form 10-K subsidiary exhibits for FY2020 through FY2023, confirming wholly-owned Israeli subsidiary status45. The office was characterised as an R&D and engineering centre in the Tel Aviv area focused on core platform and security product development — consistent with the well-documented pattern of multinational technology companies establishing R&D centres in Israel to access local engineering talent352223.

The R&D centre operated as a cost-centre: operational funding was drawn from US headquarters, intellectual property was owned by the US parent entity, and no profit repatriation mechanism from Israel was identified. Splunk’s 10-K filings categorise international revenue in aggregate without isolating Israel as a named geographic market; no investor presentation, earnings call transcript, or press release identifies Israel as a “strategic growth market” or named revenue territory223.

Post-Acquisition Capital Structure: Cisco completed the acquisition of Splunk on 18 March 2024 for approximately $28 billion1218. All Splunk assets — including its Israeli subsidiary — became part of Cisco’s corporate structure. Cisco independently maintains a substantial, long-established Israel footprint including R&D centre and operations acquired through prior Israeli technology acquisitions26. The Cisco-level Israel exposure is distinct from Splunk’s legacy independent footprint and falls outside the direct scope of this Splunk-targeted audit, but represents the relevant parent-entity exposure as of mid-2024.

No Physical Goods Supply Chain: As a pure-play software company, Splunk has no physical goods supply chain, no importer-of-record structure, no physical product inventory, and no settlement-origin goods linkages. The Who Profits Research Center and Corporate Occupation NGO databases do not identify Splunk in connection with settlement-linked physical supply chain activity4041.

No Settlement Operations: No offices, warehouses, retail locations, or operational facilities in the West Bank, Gaza Strip, or Golan Heights have been identified. The UN HRC database (A/HRC/43/71) — noting the caveat that it has not been updated since February 2020 — does not list Splunk42.

No Beneficial Ownership by Israeli State: Pre-acquisition beneficial ownership was concentrated among US institutional investors (Vanguard, BlackRock, T. Rowe Price). No Israeli state sovereign wealth fund, Israeli-domiciled strategic investor, or Israeli institutional holder exercising governance influence was identified2021.

Counter-Arguments and Evidence Limits

Splunk’s strongest economic defence is structural: it is a US-incorporated, US-headquartered, US-listed software company with no Israeli founding connection, no Israeli state ownership, no physical goods operations in occupied territories, and no identified involvement in settlement infrastructure or settlement-linked goods. The Israeli R&D presence, while confirmed, operated as a standard cost-centre talent-access arrangement — not a profit-generating market presence. The IP developed was owned by the US parent; no mechanism by which Splunk profits flowed into Israel through ownership or profit-sharing was identified.

The post-acquisition picture introduces nuance rather than amplification: Cisco’s substantial Israeli operations represent a structural change, but this is a change in the parent entity’s exposure, not necessarily a change in what Splunk technology specifically does in Israel. Whether the Splunk brand’s Israeli R&D operation was retained, expanded, or consolidated post-acquisition is not confirmed in available public records.

Named Entities and Evidence Map

EntityRelationshipEvidence Status
Splunk Services Israel Ltd.Wholly-owned Israeli subsidiaryConfirmed — Israeli registry; SEC 10-K subsidiary exhibits FY2020–2023; registered Netanya
Splunk Tel Aviv R&D officeOperational facilityConfirmed — active through at least 2023; R&D and engineering focus
Cisco Systems (parent)AcquirerConfirmed — acquisition closed March 2024; Cisco Israel footprint structurally upstream
Vanguard / BlackRock / T. Rowe PricePre-acquisition major shareholdersConfirmed — US institutional investors; no Israeli state ownership
Who Profits / Corporate OccupationSettlement supply chain databasesNot listed — Splunk not identified
UN HRC A/HRC/43/71Settlement business databaseNot listed (caveat: database unupdated since 2020)
Israeli technology press (Calcalist, Globes, TheMarker)Coverage of Israeli tech sectorReferences to Splunk as multinational R&D centre; no anchor-employer designation

V-POL: Political

V-Domain Score: 2.00 (I=2.00, M=7.00, P=7.00)

Mechanism of Involvement

The V-POL audit examined corporate communications and public stance, operations in occupied or contested territories, internal governance and content policies, brand heritage and state partnerships, lobbying, advocacy, financing, and logistics.

In-Q-Tel Intelligence Community Relationship: Splunk maintained a formal early-stage relationship with In-Q-Tel (IQT), the not-for-profit strategic investment arm of the US Intelligence Community, which invested in Splunk prior to its 2012 IPO — documented in Splunk’s S-1 registration statement16. This represents a verified institutional tie to the US intelligence community at the founding stage. No active ongoing IQT investment relationship post-IPO is confirmed in public records; the standard post-IPO transition to arms-length commercial customer relationship is the default assumption. The full scope of any intelligence community deployments — including whether those involved sharing with allied intelligence services such as Israeli intelligence under Five Eyes-adjacent arrangements — is not publicly documented and constitutes a material evidence gap.

Selective Geopolitical Stance Pattern: Splunk issued no public corporate statement specifically addressing the Israel-Palestine conflict, the October 2023 Hamas attack, or the subsequent Israeli military operations in Gaza at any point during its independent existence1443. This omission is analytically significant given the company’s documented precedent: following Russia’s February 2022 invasion of Ukraine, Splunk published a named, substantive corporate blog post under executive authorship, explicitly titled to signal solidarity with Ukraine, pledging to suspend business with Russia and Belarus and committing to offer free security monitoring tools to Ukrainian government entities19. No equivalent statement — in tone, specificity, or material commitment — was issued in response to the October 2023 conflict.

No Lobbying or Political Contributions on Israel Issues: OpenSecrets records confirm Splunk conducted registered US federal lobbying (expenditures in the hundreds of thousands of dollars annually), focused on cybersecurity policy, data privacy legislation, federal procurement rules, and cloud computing regulation — consistent with a domestic enterprise technology sector profile44. No LDA filings specifically referencing Israel-Palestine policy, anti-BDS legislation, sanctions legislation, or Middle East trade policy were identified. Splunk is not identified as a member, funder, or leadership participant in AIPAC, the US-Israel Business Alliance, or comparable Israel-focused advocacy organizations. No PAC contributions directed specifically toward candidates or committees on the basis of Israel-Palestine policy positions were identified4445.

No Donations to Military-Welfare or Parastatal Organizations: No material corporate donations or sponsorships directed toward Israeli settlement organizations, parastatal bodies (e.g., Jewish National Fund — JNF), or military-welfare funds (e.g., Friends of the Israel Defence Forces — FIDF) were identified in corporate name464748.

No Occupied Territory Operations: No evidence was identified of Splunk maintaining offices, data centres, dealership networks, or subsidiary operations explicitly within Israeli settlements in the West Bank or other internationally recognized occupied territories. Whether any channel partners within Splunk’s Israeli reseller ecosystem operate in or service clients located within West Bank settlements is not determinable from available public records — a material evidence gap.

No Organized BDS Campaigns: Splunk does not appear on the BDS Movement’s official campaign target list13. The “No Tech for Apartheid” campaign — the primary activist coalition targeting enterprise technology companies on Israel-Palestine grounds — has focused principally on Google, Amazon, Microsoft, and IBM; Splunk is not identified as a named target49.

Counter-Arguments and Evidence Limits

Splunk’s strongest political defence rests on its civilian character and the absence of documented advocacy or organisational ties to Israeli state institutions. It is not an Israeli-founded company, has no Israeli co-founders, no state honours, no Brand Israel partnership language, no Israel-focused lobbying, and no identified donations to military-welfare or parastatal bodies. Its political giving was standard bipartisan technology-sector engagement directed at domestic procurement and regulatory interests.

The In-Q-Tel relationship — Splunk’s most analytically significant political nexus — is a documented historical tie to the US intelligence community, not to Israeli intelligence. While Five Eyes-adjacent intelligence-sharing arrangements could theoretically connect US intelligence deployments to Israeli intelligence cooperation, no public documentation confirms this pathway for Splunk specifically. The post-acquisition dissolution of Splunk’s independent governance further complicates forward-looking assessment.

The absence of a public statement on the Israel-Palestine conflict is an omission, not an affirmative position. Absent a statement, no material commitment — to boycott, to terminate contracts, to offer free tools — can be assessed as fulfilled or violated. The Ukraine statement establishes capacity and precedent; its absence in the Israel-Palestine context is analytically notable but does not independently constitute evidence of military supply or political advocacy.

Named Entities and Evidence Map

EntityRelationshipEvidence Status
In-Q-TelPre-IPO strategic investor (US IC)Confirmed — documented in S-1; post-IPO status default to commercial customer
FIDFAlleged donation recipientNot verified — no donations identified in Splunk corporate name
JNFAlleged donation recipientNot verified — no donations identified in Splunk corporate name
AIPAC / US-Israel Business AllianceAlleged membership/advocacyNot verified — no membership or funding identified
BDS MovementBoycott campaignNot a named target — not on official campaign list
No Tech for ApartheidActivist coalitionNot a named target — focused on Google, Amazon, Microsoft, IBM
UN HRC A/HRC/43/71Settlement databaseNot listed (caveat: unupdated since February 2020)
Splunk for GoodSocial impact programConfirmed — digital inclusion and disaster response; no Israel-specific state-backed partnerships identified

BDS-1000 Score (V4)

DomainIMPV-Domain Score
V-MIL0.500.500.500.00
V-DIG5.001.506.000.92
V-ECON6.505.007.004.64
V-POL2.007.007.002.00

The V-ECON score of 4.64 — driven by Splunk’s confirmed Israeli R&D subsidiary and operational presence in Netanya/Tel Aviv — establishes V_MAX. The V-DIG score contributes 0.92, reflecting documented Israeli-origin technology integration relationships (Check Point, CyberArk, SentinelOne, Palo Alto Networks/Cortex XSOAR, Wiz, Claroty, Armis) within Splunk’s platform ecosystem. The V-POL score of 2.00 reflects the documented In-Q-Tel intelligence community investment tie and the comparative absence of public statements on Israel-Palestine relative to the established Ukraine precedent. The V-MIL score is zero across all seven military sub-domains. The BRS of 326 places Splunk in Tier D (Moderate), below the threshold for economic targeted sanctions (≥500) but above the no-evidence baseline.

Method: Scale-free Impact (I) × Magnitude (M) × Proximity (P) per domain; V_MAX drives BRS; Sum_OTHERS provides context. Evidence-only — no unverifiable allegations. Human vetting applied; fabricated claims, wrong-entity attributions, and divested operations were discounted or excluded during score derivation.


Methodology Note


End Notes


Document compiled from V-MIL, V-DIG, V-ECON, and V-POL domain audits. All claims trace to audit-documented findings. Evidence gaps are noted explicitly. Scores represent human-vetted V4 determinations; no alterations have been made to verified numerical values. This dossier is documentary in character and does not constitute advocacy.

Footnotes

  1. Cisco Newsroom — Cisco Completes Acquisition of Splunk: https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cisco-completes-acquisition-of-splunk.html 2 3 4 5 6 7 8 9 10

  2. Cisco SEC 10-K (CIK 0000858877): https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0000858877&type=10-K 2 3 4 5 6

  3. Splunk Blog — Splunk Opens New Office in Tel Aviv: https://www.splunk.com/en_us/blog/splunk-life/splunk-opens-new-office-in-tel-aviv.html 2 3 4

  4. Israeli Companies Registry — Splunk Services Israel Ltd. (company no. 516040250): https://www.gov.il/ 2 3

  5. Splunk SEC 10-K (CIK 0001353283) subsidiary exhibits FY2020–FY2023: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001353283&type=10-K 2 3 4 5 6

  6. Splunkbase / Technology Partners documentation: https://www.splunk.com/en_us/products/cloud.html 2 3 4 5 6 7

  7. V-DIG Audit — Israeli-Origin Technology Integration Analysis: Internal audit document, 2026-05-01 2 3 4 5

  8. Splunk / Palo Alto Networks Cortex XSOAR integration documentation: https://www.paloaltonetworks.com/ 2 3

  9. Splunk SEC DEF 14A (CIK 0001353283): https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=SPLK&type=DEF+14A 2 3

  10. Cisco Israel — Locations and Operations: https://www.cisco.com/c/en/us/about/locations/israel.html 2 3

  11. Who Profits Research Center: https://whoprofits.org/

  12. Corporate Occupation NGO Database: https://www.corporateoccupation.org/

  13. BDS Movement — Campaign Target List: https://bdsmovement.net/act-now/economic-action 2

  14. V-DIG Audit Live Verification Update (June 2026) — IMOD tender claim unsubstantiated; Ministry of Energy .conf19 civilian usage confirmed: Internal audit document, June 2026 2 3 4 5

  15. Splunk S-1 Registration Statement (2012): https://www.sec.gov/Archives/edgar/data/1353283/000119312512228745/0001193125-12-228745-index.htm

  16. V-POL Audit — In-Q-Tel Relationship Documentation: Internal audit document, 2026-05-01 2 3

  17. Splunk Newsroom — Splunk Achieves FedRAMP Authorization (2019): https://www.splunk.com/en_us/newsroom/press-releases/2019/splunk-achieves-fedramp-authorization.html 2

  18. Reuters — Cisco to Buy Splunk for $28 Billion (2023-09-21): https://www.reuters.com/technology/cisco-buy-splunk-28-billion-2023-09-21/ 2 3

  19. V-POL Audit — Splunk Ukraine Corporate Statement (2022): Internal audit document, 2026-05-01 2 3 4

  20. V-DIG Audit — No Tech for Apartheid Campaign Analysis: Internal audit document, 2026-05-01; https://www.notechforapartheid.com/ 2 3

  21. Amnesty International — Technology and Human Rights Programme: https://www.amnesty.org/en/tech/ 2 3

  22. Calcalist (Israeli technology press): https://www.calcalist.co.il/ 2

  23. Globes (Israeli business press): https://en.globes.co.il/en/ 2 3 4 5

  24. Glassdoor / LinkedIn — Splunk Israel employee data (directional estimates): https://www.glassdoor.com/

  25. Splunk Careers — Israel job listings: https://www.splunk.com/en_us/careers/search-jobs.html?location=Israel

  26. Cisco Israel — R&D and Operations: https://www.cisco.com/c/en/us/about/locations/israel.html 2 3

  27. Splunk — Government Solutions: https://www.splunk.com/en_us/solutions/industries/government.html

  28. Splunk — Public Sector Solutions: https://www.splunk.com/en_us/solutions/industries/public-sector.html

  29. SIBAT — Israel Defence Export Directory: https://www.sibat.mod.gov.il/

  30. Splunk — Enterprise Security Product Suite: https://www.splunk.com/en_us/products/security.html

  31. SIPRI Arms Transfers Database: https://www.sipri.org/databases/armstransfers

  32. Splunk — Product Portfolio and Observability Cloud: https://www.splunk.com/en_us/products.html 2

  33. Elbit Systems — Investor Relations: https://www.elbitsystems.com/investor-relations/

  34. Israel Aerospace Industries (IAI): https://www.iai.co.il/

  35. Rafael Advanced Defense Systems: https://www.rafael.co.il/

  36. US Bureau of Industry and Security — Office of Export Enforcement / Office of Antiboycott Compliance: https://www.bis.doc.gov/index.php/enforcement/oac

  37. V-DIG Audit — Israeli Channel Partner and Procurement Evidence Gap: Internal audit document, 2026-05-01

  38. Project Nimbus — AWS/Google Israeli Government Cloud Contract Coverage: Internal audit document, 2026-05-01

  39. USASpending.gov — Splunk Federal Contracts: https://www.usaspending.gov/

  40. Who Profits — Settlement Supply Chain Database: https://whoprofits.org/

  41. Corporate Occupation: https://www.corporateoccupation.org/

  42. UN Human Rights Council — A/HRC/43/71 (Businesses with activities in Israeli settlements): https://www.ohchr.org/en/hr-bodies/hrc/regular-sessions/session43/list-of-businesses

  43. Splunk Newsroom Archive: https://www.splunk.com/en_us/newsroom.html

  44. OpenSecrets — Splunk Federal Lobbying Disclosures: https://www.opensecrets.org/ 2

  45. OpenSecrets — Splunk PAC Contribution Records: https://www.opensecrets.org/

  46. FIDF — Corporate Donor Records: https://www.fidf.org/

  47. JNF — Corporate Partnership Records: https://www.jnf.org/

  48. AJC — Corporate Partners List: https://www.ajc.org/

  49. No Tech for Apartheid — Campaign Scope: https://www.notechforapartheid.com/