V-DIG Domain Audit — Walkers Snack Foods (PepsiCo UK Subsidiary)

Audit Phase: V-DIG Target Entity: Walkers Snack Foods Limited (Companies House no. 01836758) ¹ Parent: PepsiCo, Inc. (NASDAQ: PEP) Prepared: 2026-05-01

Scope Note: Walkers Snack Foods publishes no standalone technology disclosures. Its Companies House filings contain statutory accounts only ¹, and no Walkers-specific CISO, vendor procurement, or infrastructure data is publicly available. All technology findings in this audit are necessarily inherited from PepsiCo parent-level disclosures and apply to Walkers by virtue of its wholly owned subsidiary status within PepsiCo’s centralised global IT and procurement model ². Where a finding relates to PepsiCo at the enterprise level, that is stated explicitly.

Enterprise Technology Stack & Vendor Relationships

Organisational & Procurement Context

PepsiCo operates a centralised IT and shared-services model under which all subsidiaries, including Walkers, inherit the parent’s vendor stack. The global procurement function operates on a consolidated “global lever” approach, with CPO Marcelo Stefani publicly describing cross-subsidiary vendor rationalisation as a core pillar of PepsiCo’s procurement transformation ³. No Walkers-specific vendor exceptions or carve-outs are documented in any public source.

Confirmed Israeli-Origin Technology Deployments

Wiz (Cloud Security — confirmed active integration)

A PepsiCo Careers job posting for a Senior Manager – Infrastructure and DevOps role explicitly listed “leading the integration of security tools such as Wiz” as a core responsibility ⁴. This constitutes direct, first-party-adjacent evidence of active operational integration — not a licensing negotiation or pilot. Wiz is an Israeli-founded company (founded 2020, Tel Aviv; co-founders include Assaf Rappaport, Yinon Costica, Roy Reznik, and Amit Arad, all alumni of Israeli military intelligence units) ⁵. The job posting confirms Wiz is embedded at the infrastructure/DevOps engineering management layer of PepsiCo’s cloud environment, indicating operational rather than peripheral deployment. The scope of Wiz deployment across Walkers specifically — as opposed to PepsiCo globally — is not separately documented, but given PepsiCo’s centralised cloud model this tool would apply enterprise-wide.

CyberArk (Privileged Access Management — corroborated, vendor-published source)

PepsiCo’s Global Manager of Privileged Access, Christopher White, is documented on CyberArk’s own blog as an advocate of the platform, citing more than five years of use and describing its application within PepsiCo’s enterprise identity security strategy ⁶. CyberArk is headquartered in Petah Tikva, Israel, and is a market-leading provider of Privileged Access Management (PAM) software. The primary source is vendor-published rather than an independent corporate disclosure; the relationship is nonetheless consistent with CyberArk’s known Fortune 500 customer base and is corroborated by the specificity of the named employee reference. The multi-year tenure and explicit named-employee advocacy suggest a deeply embedded enterprise deployment rather than a peripheral or trial engagement.

Unverified Vendor Claims (excluded from confirmed findings)

The prior research memo contains additional Israeli-origin vendor claims that cannot be confirmed from independent public sources and are therefore excluded from verified findings:

SentinelOne (Endpoint Detection & Response): The claim of a “flagship enterprise customer” relationship is sourced solely to a SentinelOne vendor marketing comparison page, not to any PepsiCo press release, SEC disclosure, or independent trade publication. No public confirmation identified.
Check Point Software Technologies (network security / CloudGuard): A Vietnamese technology distributor event ⁷ does not constitute evidence of a direct, global PepsiCo–Check Point enterprise contract. No independent corroboration identified. Note that Check Point and Wiz entered a documented strategic security partnership ⁸, meaning Check Point tooling could be present in environments where Wiz is deployed, but this is not evidenced for PepsiCo specifically.
Claroty (OT/Industrial Security): General industry documentation on OT security challenges in drinks manufacturing ⁹ and a Claroty–Check Point integration brief ¹⁰ neither name PepsiCo as a Claroty customer. Claroty’s founding lineage connects to Team8, the venture group co-founded by Nadav Zafrir (former commander of IDF Unit 8200), but a PepsiCo deployment is unverified.
Torq (Security Hyperautomation): Claimed to orchestrate security tools across PepsiCo’s environment, but PepsiCo’s presence on Torq’s public customer page is not confirmed by independent sources ¹¹.

Supply Chain & Logistics Technology

PepsiCo UK (including Walkers) operates logistics partnerships with XPO Logistics for UK freight ¹², and Walkers has separately moved part of its delivery fleet to HVO (hydrotreated vegetable oil / used cooking oil) powered trucks ¹³. These logistics technology relationships do not involve Israeli-origin vendors. PepsiCo’s European supply chain has undergone SAP implementation for ERP functions ¹⁴, with SAP being a German-origin vendor.

The 2021 Walkers IT Outage. In September 2021, a significant IT outage at Walkers caused a major supply disruption affecting UK supermarkets for several weeks ¹⁵ ¹⁶. The outage was reported as related to an ERP/SAP system migration. This event is publicly documented and confirms that Walkers’ manufacturing and supply chain operations are tightly coupled to the parent’s enterprise IT stack, reinforcing the conclusion that any group-level IT vendor deployment reaches Walkers operationally.

AWS Strategic Partnership (confirmed)

PepsiCo announced a multi-year strategic collaboration agreement with AWS in 2025. The announcement confirms PepsiCo’s generative AI platform (“PepGenX”) is hosted on Amazon Bedrock, and that the collaboration spans supply chain AI, demand sensing, and cloud infrastructure broadly ¹⁷. This is confirmed by PepsiCo’s own press release. AWS is a direct contractor under Israel’s Project Nimbus government cloud programme ¹⁸, a dimension addressed further in Section 3.

Surveillance, Biometrics & Retail Technology

Computer Vision & Shelf Analytics

Trax Retail (confirmed commercial relationship)

PepsiCo has a documented commercial relationship with Trax, an Israeli-founded computer vision and retail intelligence company (founded by Joel Bar-El and Dror Feldheim, Tel Aviv). Trax’s NRF Europe showcase featured PepsiCo products and is consistent with publicly known CPG client relationships ¹⁹. The 2017 Warburg Pincus-led investment round established Trax’s profile as a significant enterprise-focused retail AI platform ²⁰. Industry documentation confirms Trax’s application is shelf compliance and planogram auditing — i.e., the system analyses images of retail shelves to assess whether products are correctly stocked — rather than biometric identification of shoppers. PepsiCo, as a large CPG manufacturer, uses Trax-type retail execution analytics to monitor in-store compliance by retail partners and field sales teams. The application is inventory/shelf analytics, not surveillance of individuals.

Trigo (autonomous checkout / shopper body-tracking — partially corroborated)

The prior memo identifies a potential PepsiCo connection to Trigo, an Israeli company (Tel Aviv) that builds autonomous frictionless checkout systems using ceiling-mounted cameras and AI skeletal-body tracking to identify shoppers and bill them without cashiers. Trigo’s technology has been piloted with Wakefern (ShopRite) in New Jersey, as reported in regional trade press ²¹ ²² ²³. A connection to PepsiCo via this deployment is plausible given PepsiCo’s role as a major CPG supplier to ShopRite-format stores, but the specific claim that PepsiCo holds a formal technology partnership role in the Trigo–Wakefern deployment — as opposed to being a CPG brand present on the monitored shelves — is not independently verified by any public source. The distinction is material: a CPG brand’s products appearing in a Trigo-equipped store does not make that brand a party to the surveillance technology deployment.

Biometric Identification & Facial Recognition at PepsiCo/Walkers Facilities

No public evidence identified of PepsiCo or Walkers procuring or deploying facial recognition, biometric identification, or real-time visitor-monitoring technology from Israeli-origin vendors (including AnyVision/Oosto, BriefCam, or equivalent platforms) at their own manufacturing sites, distribution centres, or offices. A general industry note documents BriefCam’s integration with the Milestone XProtect VMS platform for forensic video analytics ²⁴, but no named PepsiCo deployment of BriefCam is documented in any public source.

Workforce Monitoring & Predictive Surveillance

No public evidence identified of PepsiCo or Walkers deploying Israeli-origin predictive policing software, sentiment analysis platforms, social media monitoring tools, or AI-driven workforce surveillance systems.

Third-Party Reach of Surveillance Technologies

No public evidence identified that Israeli-origin surveillance or biometric technologies are deployed by PepsiCo or Walkers indirectly via outsourced security providers, managed service contracts, or bundled enterprise suite relationships beyond the Wiz and CyberArk deployments documented in Section 1.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Primary Cloud Provider: AWS

PepsiCo’s 2025 strategic collaboration agreement with AWS ¹⁷ confirms AWS as the primary hyperscale cloud provider for PepsiCo’s enterprise-wide workloads, including generative AI (PepGenX on Amazon Bedrock), supply chain optimisation, and demand forecasting infrastructure ²⁵. This partnership is documented at the level of a formal multi-year strategic collaboration agreement, making AWS a deep infrastructure dependency for the PepsiCo group and therefore for Walkers as a subsidiary.

AWS and Project Nimbus. AWS was selected in May 2021 as one of two providers under Israel’s Project Nimbus, a $1.2 billion (USD) government cloud contract covering all Israeli government ministries and state bodies ¹⁸. The scope of Project Nimbus — as detailed in investigative reporting — encompasses sensitive government data including defence-related workloads ²⁶. AWS subsequently launched the il-central-1 AWS region (Tel Aviv) in 2023 to fulfil this contract. PepsiCo’s deep strategic reliance on AWS therefore means its cloud infrastructure expenditure contributes to a provider that is simultaneously executing a comprehensive Israeli government and defence cloud programme.

PepsiCo use of the AWS il-central-1 Israel region specifically: The prior memo asserted that PepsiCo “logically” uses the il-central-1 region for SodaStream operations. This is an inference, not a documented finding. No PepsiCo press release, AWS case study, SEC filing, or independent news report confirms that PepsiCo or SodaStream routes workloads through the AWS Israel region. This claim is excluded from verified findings; the broader AWS strategic relationship remains confirmed.

Google Cloud

The prior memo asserted PepsiCo is a significant Google Cloud customer, citing a Bay Area Council Economic Institute report on US–Israel tech investment ²⁷. Review of that source establishes it as a regional economic report on bilateral investment flows, not a PepsiCo cloud procurement disclosure. No independent equivalent to the documented 2025 AWS announcement has been identified for Google Cloud. Google Cloud was the co-winner of Project Nimbus alongside AWS ²⁸ and launched the me-west1 (Tel Aviv) region to serve that contract. A PepsiCo–Google Cloud enterprise relationship cannot be confirmed or excluded on available evidence; it is neither verified nor affirmatively disproved.

SodaStream and Israeli Data Infrastructure

SodaStream, acquired by PepsiCo in January 2019 for approximately $3.2 billion ²⁹, operates manufacturing facilities at the Idan HaNegev industrial park in Israel’s Negev desert. Whether SodaStream’s local IT operations rely on Israeli co-location facilities, the AWS il-central-1 region, or the PepsiCo global cloud stack is not documented in any public source. No separate SodaStream IT infrastructure disclosures have been identified.

Project Nimbus — PepsiCo’s Contractual Status

PepsiCo is not a party to Project Nimbus. The Project Nimbus contract is between the Israeli government and AWS/Google Cloud as infrastructure providers. PepsiCo is a commercial customer of AWS. No public evidence identifies PepsiCo as having a direct contractual, sub-contractual, or service delivery role in the Project Nimbus programme or any other Israeli sovereign cloud contract.

Data Residency

No public evidence identified that PepsiCo or Walkers has designated Israel as a data residency jurisdiction for UK or European customer data. Walkers’ consumer-facing UK data operations (loyalty programmes, digital marketing) are governed by UK GDPR and are expected to reside in UK or EEA-compliant infrastructure; no public disclosure specifies which cloud regions are used.

Defence, Intelligence & Security Sector Technology Relationships

Direct Military & Intelligence Contracts

No public evidence identified of any contract, partnership, service agreement, or technology supply relationship between Walkers Snack Foods, PepsiCo, Inc., and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), Mossad, Shin Bet, or any other Israeli military or intelligence entity.

Dual-Use Technology Considerations

PepsiCo’s documented deployments of Israeli-origin technology are in commercial enterprise contexts — cloud security (Wiz), privileged access management (CyberArk), and retail shelf analytics (Trax). No public evidence identifies any of these specific commercial deployments as having been repurposed for, shared with, or contracted to military or intelligence end-users in Israel or the occupied territories.

The AWS Project Nimbus contract ¹⁸ ²⁶ does extend cloud infrastructure services to Israeli defence-related ministries; PepsiCo’s status as a commercial AWS customer means it contributes revenue to a provider with such defence contracts, but PepsiCo itself has no documented direct technology provision role in defence applications.

Offensive Cyber & Weapons Systems

No public evidence identified. PepsiCo is a food and beverage manufacturer with no known involvement in offensive cyber development, digital weapons systems, signals intelligence tools, or military hardware supply chains.

Export Control & Sanctions Compliance

No public evidence identified of export control actions, BIS investigations, OFAC sanctions inquiries, or equivalent UK/EU regulatory proceedings targeting PepsiCo or Walkers in connection with technology exports or services to restricted state entities.

AI, Algorithmic & Autonomous Systems

PepsiCo’s Generative AI Platform (PepGenX)

PepsiCo’s internally branded generative AI platform, “PepGenX,” is built on Amazon Bedrock and described in the 2025 AWS strategic collaboration announcement as serving internal business use cases including demand forecasting, supply chain optimisation, and consumer insights generation ¹⁷. The platform is documented as an internal enterprise tool. No evidence identifies PepGenX as provided to, licensed by, or shared with Israeli state or military bodies.

AI-Driven Supply Chain & Demand Sensing

AWS documentation highlights AI-driven supply chain use cases in the context of PepsiCo’s AWS collaboration ²⁵, consistent with the PepGenX announcement. These applications are commercial enterprise functions. No Israeli state, military, or intelligence agency connection is identified.

Retail AI (Trax)

As documented in Section 2, PepsiCo’s use of Trax computer vision technology is limited to shelf analytics and retail execution monitoring. No evidence identifies this as extending to algorithmic profiling of individual consumers, predictive policing applications, or data-sharing with public authorities.

AI Training Data Sourcing

No public evidence identified regarding the datasets used to train PepsiCo’s internal AI/ML models. No evidence of training data derived from civilian population surveillance, intercepted communications, or datasets originating from Israeli military or intelligence operations.

Autonomous Systems & Lethal Autonomy

No public evidence identified. PepsiCo has no known involvement in autonomous weapons systems, lethal autonomous platforms, or drone warfare supply chains.

AI Governance & Transparency

PepsiCo publishes sustainability and ESG reporting ³⁰ and annual proxy statements ³¹ but does not publish a dedicated AI ethics framework, algorithmic impact assessment, or AI governance report as of the audit preparation date. The PepsiCo Annual Report and 10-K filing ³² contains standard enterprise risk disclosures including technology risk, but does not specifically address AI ethics governance in the context of Israeli technology vendors.

Technology Ecosystem & R&D Footprint

Israeli Innovation Engagement

JVP Play Corporate Innovation Partnership (confirmed)

PepsiCo is a confirmed participant in Jerusalem Venture Partners’ “JVP Play” corporate innovation platform, alongside Tesco and Barclays ³³. JVP (Jerusalem Venture Partners) is one of Israel’s oldest and most prominent venture capital firms, founded in 1993 by Erel Margalit. The JVP Play programme is a structured pipeline connecting established corporates with early-stage Israeli technology startups for piloting, co-development, and commercial evaluation. PepsiCo’s participation confirms a formal, institutionalised engagement with the Israeli startup ecosystem beyond ad hoc commercial relationships. The McKinsey “Committed Innovator” interview with PepsiCo Labs ³⁴ and the PepsiCo Labs platform ³⁵ corroborate PepsiCo’s documented strategic interest in Israeli innovation as an identified cluster.

N-Drip Agritech Partnership (confirmed)

In 2022, PepsiCo announced a commercial partnership with N-Drip, an Israeli gravity-fed micro-drip irrigation company, to deploy water-saving irrigation technology across PepsiCo’s agricultural supply chain globally ³⁶. The partnership is confirmed by PepsiCo’s own press release. N-Drip is based in Israel; the commercial application is precision agriculture for PepsiCo’s raw ingredient supply chain (potato and grain farming relevant to Walkers crisps production). This is a confirmed agritech partnership with an Israeli-origin company that has a direct operational connection to Walkers’ upstream supply chain.

Physical R&D Presence in Israel

No public evidence identified of PepsiCo operating a dedicated technology R&D centre, software engineering office, or enterprise innovation lab within Israel. The JVP Play and N-Drip relationships represent engagement with the Israeli ecosystem via structured VC programmes and commercial partnerships respectively, not via a PepsiCo-owned R&D footprint in Israel.

SodaStream operates product R&D functions within Israel related to carbonation hardware and consumables — this is consumer goods product development by an Israeli-origin subsidiary, not enterprise technology R&D conducted on behalf of the broader PepsiCo group.

Acquisitions

SodaStream ($3.2 billion, completed January 2019)

PepsiCo completed the acquisition of SodaStream International Ltd. in January 2019 ²⁹. SodaStream is headquartered in Airport City, Israel, and operates manufacturing at the Idan HaNegev site in the Negev desert. Technology domain: home carbonation appliances and beverage consumables. This is a consumer goods acquisition, not an enterprise technology acquisition. It nonetheless makes PepsiCo a significant operator of Israeli manufacturing and R&D infrastructure with Israeli-resident employees. SodaStream’s former West Bank factory history is addressed in Section 7.

Patent & IP Relationships with Israeli Academic Institutions

No public evidence identified of significant patent portfolios, licensing agreements, joint research programmes, or sponsored research arrangements between PepsiCo/Walkers and Israeli academic or state research institutions (Technion – Israel Institute of Technology, Hebrew University of Jerusalem, Weizmann Institute of Science, or Israeli Innovation Authority-funded programmes).

PepsiCo Labs Scouting Activity

PepsiCo Labs, the company’s corporate venture and innovation scouting unit ³⁵, has publicly identified Israel as a priority innovation cluster. The McKinsey interview documents PepsiCo Labs VP David Schwartz’s comments on Israel as an innovation source ³⁴. The JVP Play partnership ³³ is the most concrete institutional expression of this scouting orientation.

Civil Society Scrutiny & Regulatory History

BDS Movement Targeting

PepsiCo — and by extension Walkers as its UK consumer-facing brand — appears on the BDS (Boycott, Divestment, and Sanctions) Movement’s corporate priority targeting list ³⁷. The basis cited by the BDS Movement is PepsiCo’s ownership of SodaStream and continued investment in Israeli manufacturing. The BDS Movement’s guidance directs consumer and institutional boycott pressure toward PepsiCo products including Walkers crisps.

SodaStream–West Bank History. SodaStream’s former factory at Mishor Adumim in the Ma’ale Adumim settlement industrial zone (occupied West Bank) was the subject of sustained BDS campaigns from approximately 2009 to 2015, including high-profile actions such as the Scarlett Johansson/Oxfam controversy in 2014 ³⁸. SodaStream relocated its manufacturing to the Idan HaNegev site (within Israel’s internationally recognised pre-1967 borders) in 2015 — three years prior to PepsiCo’s acquisition. The settlement-era history therefore predates PepsiCo ownership, and the physical relocation predates the acquisition. However, the BDS campaign against PepsiCo/SodaStream has continued on grounds of broader Israeli operations post-relocation ³⁷.

Academic & Institutional Scrutiny

Columbia University ACSRI (2023–2024)

Columbia University’s Advisory Committee on Socially Responsible Investing annual report (2023–2024) references PepsiCo in the context of investor-level ESG scrutiny ³⁹. While not a dedicated investigation of PepsiCo’s technology relationships, its presence in an academic institutional ESG review reflects awareness of the company’s Israel-related commercial exposure at the level of university endowment governance.

No Tech For Apartheid Campaign

The No Tech For Apartheid campaign primarily targets Google and Amazon as the direct Project Nimbus contractors ⁴⁰. PepsiCo is not a named target in No Tech For Apartheid campaign literature based on available evidence. The connection between PepsiCo and Project Nimbus is indirect — as a commercial customer of AWS, whose revenues partly fund AWS infrastructure that includes the Nimbus contract — rather than a direct contractual relationship. The campaign does not, on available evidence, pursue PepsiCo or Walkers as named targets.

Additionally, investigative reporting by +972 Magazine has detailed the scope of the Project Nimbus contract, including its extension to Israeli military and security services ²⁶, providing context for evaluating the significance of commercial relationships with AWS and Google Cloud for any enterprise customer of those providers.

Regulatory & Legal Proceedings

No public evidence identified of regulatory investigations, export control enforcement actions, OFAC or OFSI sanctions proceedings, UK government review, or legal actions targeting PepsiCo or Walkers in connection with technology sales, services, or data transfers to Israeli state or military entities.

No public evidence identified of UK Equality and Human Rights Commission, ICO, or other domestic regulatory engagement specifically focused on Walkers’ technology procurement practices in the context of Israeli vendor relationships.

Divestment Campaigns Specific to Walkers

No documented divestment campaign specifically targeting Walkers Snack Foods as a discrete legal entity (separate from PepsiCo parent) has been identified. Boycott and divestment pressure is directed at PepsiCo at the group level, with Walkers implicated as a consumer-facing brand of that group rather than as an independently targeted entity.