What the leaked Cisco documents show
Cisco spent months repairing networks used by Israel's military intelligence community, according to internal documents obtained by The Guardian. Repeated outages had threatened one of the company's most sensitive accounts. The documents were leaked by Cisco workers opposed to the company's role in the Gaza war.
A confidential Cisco memo drafted in September 2025 described the damage in blunt terms. The failures happened during the war and 'deeply impacted customer sentiment,' it said. The memo also warned that the repeated outages 'severely impacted critical operations' during a period of national conflict.
According to the Guardian, the problems began while Israeli intelligence agencies were upgrading their digital infrastructure. Cisco responded by activating senior executives and assembling multiple internal teams over several months. Staff travelled to meet Sapir, a secretive military technology unit. The documents described site visits under extreme security because of the ongoing war.
Cisco later billed the repair internally as a 'customer success story' and said the client had returned to normal operations. The records were part of a larger trove that current and former employees gave to the Guardian. Those workers said they were furious that the company kept expanding the relationship.
The cache also covers dozens of deals Cisco pursued in 2026 with Israeli government, intelligence, air force and navy clients. Many were tagged as AI projects, reflecting demand for more computing and data-processing capacity.
The Guardian describes Cisco as a supplier of the routers, servers and communications systems that move data for companies, governments and militaries. Its military work has drawn less scrutiny than cloud contracts held by Microsoft, Google and Amazon. Yet those services still depend on physical networks.
How large is Cisco's business with Israel's military?
The documents put the military intelligence relationship at about $67 million over three years, according to both the Guardian and Calcalist. That figure covers contracts with Israeli military intelligence, not Cisco's entire Israeli business.
Calcalist, which reviewed the documents, reported that Cisco Israel's revenue rose from $122 million in fiscal 2015 to $283 million in 2024. In the first half of 2024, the Defense Ministry accounted for about $98 million of roughly $150 million in Israeli revenue.
The dependence ran both ways. An April 2021 internal document described Cisco as the Defense Ministry's dominant information and communications technology partner. The account covered 10 classified organizations and represented about half of Cisco Israel's revenue at the time.
That concentration helps explain why the company treated the outages as an emergency. Losing the account would have removed a large share of a business that Cisco had spent years building inside Israel's defense establishment.
The figures also show volatility. In the first half of 2025, Cisco Israel's revenue fell to $115 million, and Defense Ministry revenue dropped to $42 million. The internal presentation did not explain the decline, Calcalist reported.
Internal presentations tracked the commercial upside of the war. A 2024 deck put $111 million of Israeli revenue under a 'conflict impact' heading. It also listed a $50 million opportunity in an AI computing project and $15 million for a routed optical-network project.
One slide carried the phrase 'Never let a good crisis go to waste,' a line the presentation incorrectly attributed to Winston Churchill. The detail offers a window into how the account was discussed internally. On its own, it is not evidence of unlawful conduct.
Why did Israeli intelligence lose confidence in Cisco's networks?
The failures were not cosmetic. Cisco's documents described outages lasting several hours, repeated crashes and diagnostic mechanisms that stopped working, according to the Guardian and Calcalist.
They struck as intelligence agencies were modernising their infrastructure. The disruption became serious enough that intelligence leaders threatened to cancel the business, Calcalist reported.
Cisco workers familiar with the problems told the Guardian that the outages endangered intelligence forces' access to military data. The documents do not identify which operations, if any, were affected.
Internal records show the response was structured around restoring confidence. Cisco aimed to reverse what it called negative sentiment and return the account to normal operations, according to the Guardian.
Cisco referred to the customer as the Israel Intelligence Force, or IIF. It described the body as the provider of network infrastructure for intelligence departments inside the Israeli Ministry of Defense. The Guardian said the label appears to refer to Aman, the IDF's military intelligence directorate.
Sapir, the unit Cisco staff visited, operates communications and computing infrastructure inside that directorate. Calcalist reported that it manages the main data center hosting major intelligence organizations, including Unit 8200. It was also reportedly involved in moving Israel's intelligence apparatus underground after 7 October 2023.
The documents do not establish that the relocation caused the outages. They also do not identify specific military operations affected by the failures. That limit matters: the records show a vendor protecting a client relationship, not a complete account of how the networks were used.
The repair effort shows how deeply a commercial supplier can become embedded in military operations. Cisco provides the plumbing through which data moves. Maintenance work therefore sits close to the intelligence cycle, even when the company frames it as technical support.
Did Splunk try to join Project Nimbus?
The documents also point to Cisco's ambitions beyond networking hardware. Splunk is the data-analytics company Cisco bought in 2024 for about $28 billion. Splunk explored joining Project Nimbus, the Israeli government's cloud program with Google and Amazon.
Project Nimbus was awarded in 2021 and is valued at about $1.2 billion, according to Calcalist. Splunk's platform processes large volumes of machine-generated data, which makes it useful for spotting technical failures and security threats.
The program's structure matters because it lets additional vendors attach analytics and services to government cloud deals. That widens the set of companies whose products sit inside sensitive workflows.
Executives at the Cisco subsidiary made the pitch earlier in 2026. The documents do not show whether it succeeded, and Cisco has not said publicly whether Splunk is part of Nimbus.
The Israeli National Digital Agency had already used Splunk for years. In September, it published a notice of intent to extend the arrangement through a NIS 12 million agreement, Calcalist reported.
An earlier government document said officials had considered Google's Chronicle platform as a possible replacement under Nimbus. They concluded at the time that it did not meet their analytical, operational and security requirements.
If Splunk does join Nimbus, the line between Cisco's own contracts and the wider cloud stack serving Israel's government would blur further. That layering is one reason human rights researchers say accountability is difficult to establish.
What does Cisco say, and what did the EEOC find?
Cisco did not respond to the Guardian's request for comment on the documents. The Israeli military said it is 'assisted by services provided by a range of companies'. It added that it does not comment on other entities' contracts.
The company's formal position on its human rights obligations appears in its 2026 proxy statement. Cisco says it runs risk-based due diligence, commissions independent assessments and reviews the geopolitical context of high-risk customers and end users.
The same filing summarizes the proponents' case. It argues that investors lack enough information to judge how Cisco weighs severe risks when selling to governments, militaries and law enforcement. It points to prior reporting on Israel, a Supreme Court case involving China's Golden Shield system and US immigration contracts.
That position is now contested inside the United States. In June, the EEOC's San Jose office issued a determination. It found reasonable cause to believe Cisco subjected a class of employees to a hostile work environment. The finding cited national origin and religion.
The 9 June letter, signed by local director Margaret Ly, followed complaints filed in December 2024. Employees said an internal Cisco forum was filled with racist and Islamophobic posts after the 7 October attacks. They said the harassment escalated after more than 1,700 workers signed a letter challenging the company's Israel ties.
Cisco disagreed with the finding. A spokesperson said the company 'thoroughly investigated all concerns and took appropriate action,' according to the Guardian. The EEOC determination is a cause finding, not a final court ruling, and the dispute has not been resolved.
Cisco also says its Global Human Rights Policy commits it to the UN Guiding Principles on Business and Human Rights. It publishes an annual Purpose Report. The question raised by the proposal is whether those documents give investors enough detail about specific customers.
Bridge to Humanity, the employee group behind the 2024 letter, called Cisco's intelligence work a 'shocking and complete contradiction of values'. It argued that supplying military technology made the company comparable to an arms manufacturer.
Eric Sype of 7amleh, a Palestinian digital rights group, spoke to the Guardian. He said the tech sector is moving 'more and more aggressively into military contracting'. He argued that Cisco's hardware sits underneath cloud contracts held by Microsoft, Google and Amazon.
The Guardian reports that the war has killed more than 70,000 Palestinians. That context is central to the dispute over whether vendors should apply stricter human rights tests to military and intelligence customers.
Why is the 15 December shareholder vote significant?
Cisco shareholders will vote on Proposal No. 5 at the annual meeting on 15 December 2026, starting at 8:00 a.m. Pacific time. Azzad Asset Management, a US firm managing Shariah-compliant portfolios, filed the proposal on 17 June 2026.
The resolution asks the board to commission an independent third-party Human Rights Impact Assessment. It would cover severe and foreseeable risks tied to high-risk customers and end uses, including surveillance, military, intelligence and immigration enforcement.
It also asks Cisco to publish a report summarizing the methodology, findings and responsive actions. Azzad says the goal is information rather than divestment. Investors cannot judge whether Cisco's diligence works if the company does not disclose it.
Human rights impact assessments typically examine how a product could be misused. They also look at what leverage a company has over a customer and whether existing safeguards work. The proposal asks Cisco to make those judgments public rather than relying on internal reviews.
Cisco's board recommends a vote against. It argues that Cisco already conducts risk-based due diligence, commissions independent assessments and publishes its human rights policy and Purpose Report. The board says the requested report would not provide meaningful additional benefit.
The Anti-Defamation League and JLens have also urged shareholders to reject the proposal. They argue that its framing overlaps with the goals of the Boycott, Divestment and Sanctions movement, Calcalist reported. Supporters of the resolution reject that characterisation.
The vote is advisory in practice but politically loaded. The proxy itself notes that Microsoft and Meta have commissioned independent human rights assessments. That undercuts the idea that such reviews are unusual for large technology companies.
Even if it passes, the resolution cannot force the board to act. A majority would still raise the cost of ignoring the request, especially with pension funds and religious investors watching the result.
A strong minority vote would keep the issue alive for next year and give investors a benchmark. A weak vote would let Cisco argue that its existing program has shareholder backing.
What to watch next
The first test is the 15 December vote and the size of the dissent. Proxy advisers, major asset managers and individual holders will all shape the result.
The second is whether Splunk appears in any Nimbus arrangement. A confirmed role would expand scrutiny from Cisco's networking contracts to the analytics layer of Israel's government cloud.
The third is the EEOC case. A cause finding can lead to conciliation or litigation. The employees have also filed grievances with the National Labor Relations Board and California's labor commissioner, which remain under review.
The fourth is the AI pipeline. Dozens of 2026 deals were tagged as AI projects, and the documents suggest Cisco sees demand for more computing and data processing. Those deals will face more questions than networking contracts did.
The debate also extends beyond Cisco. Other infrastructure vendors face similar questions about military and intelligence customers. Precedents set in shareholder votes tend to travel across the sector.
The limits of the story deserve equal weight. The documents were selected and leaked by critics of the company, and Cisco declined to comment on them. Neither the Guardian nor Calcalist found evidence that Cisco broke a specific law. The revenue figures are internal management numbers, not audited segment disclosures.
What the records do establish is a gap between Cisco's public human rights language and the commercial decisions taken during the war. How shareholders, regulators and customers respond to that gap will determine whether this becomes a turning point or another disclosure fight.