What Cloud SOAR Platforms Know About Your Network
When you connect a cloud-hosted automation platform to your firewall management APIs, you are granting that platform access to the most sensitive operational data in your organization. Not user data. Not customer PII. Something arguably more valuable to a sophisticated adversary: your complete network topology and security policy architecture.
Let's enumerate exactly what transits through a cloud SOAR when it processes a routine firewall rule sync:
| Data Element | Transits Cloud SOAR? | Intelligence Value |
|---|---|---|
| Internal IP address ranges (RFC 1918) | Yes — in every API call payload | Network mapping — identifies segment boundaries |
| Subnet and VLAN structure | Yes — required for rule translation | Reveals network segmentation architecture |
| Firewall rule sets (ACLs, policies) | Yes — the core payload | Complete security policy — shows what's permitted and denied |
| Active Directory group membership | Yes — triggers sync workflows | Organizational structure, role assignments, privileged groups |
| Firewall management API credentials | Yes — stored in cloud vault | Direct administrative access to perimeter controls |
| VPN configurations | Yes — if VPN automation is enabled | Remote access architecture, tunnel endpoints, pre-shared keys |
| DNS zone data | Yes — if DNS sync is enabled | Internal hostname mapping, service discovery data |
Ask your cloud SOAR vendor: "In which jurisdiction is my firewall policy data stored? Which employees of your company have access to it? What happens to it if your company is acquired by a foreign entity? Can you guarantee it has never been accessed by a government agency under a legal order you are prohibited from disclosing?" If the answer to any of these is uncertain, you have a local data control problem.
Regulatory and Strategic Considerations Specific to the Israeli Market
Israel occupies a unique position in the global cybersecurity landscape. Israeli enterprises—particularly those in defense, critical infrastructure, telecommunications, and finance—operate under a regulatory and threat environment that is qualitatively different from their counterparts in the US or EU.
NISA Regulatory Mandate
The National Israel Security Authority (NISA/MALMAB) imposes strict data handling requirements on organizations designated as critical infrastructure or defense-adjacent. Network topology data, access control policies, and security configurations are classified as sensitive operational information that must remain under organizational control within Israeli jurisdiction.
Privacy Protection Authority
Israel's Privacy Protection Authority enforces data protection regulations that, while aligned with GDPR principles, include specific provisions for data localization. Any processing of organizational data—including network metadata—by a foreign cloud provider triggers reporting and assessment obligations that most security teams are not equipped to manage.
Elevated Threat Landscape
Israeli organizations face persistent, state-sponsored cyber operations from multiple adversaries. Network topology data is a high-value intelligence target. The attack surface created by routing this data through third-party cloud infrastructure—regardless of encryption or access controls—is an unnecessary risk amplifier.
Defense Supply Chain Adjacency
Many Israeli tech companies maintain contracts or partnerships with the Ministry of Defense, IDF, or defense-adjacent agencies. These relationships impose cascading data handling requirements that extend to any tool processing network infrastructure data. A cloud SOAR that stores firewall policies in a US data center may violate supply chain compliance terms.
For Israeli enterprises, local data control is not a compliance checkbox. It is a strategic imperative driven by a threat environment where your network topology is a target, not merely "data." Every additional system that holds your topology expands the attack surface. Every jurisdiction your data touches multiplies the legal exposure vectors. The only way to eliminate these risks is to process everything locally.
Cyberm8's Zero-Egress Action Model
Cyberm8 was designed from the ground up for environments where local data control is non-negotiable. The architecture is simple because the security requirement is absolute: no network topology data, firewall policy data, or infrastructure configuration data ever leaves your premises.
What "On-Prem" Actually Means
We are precise about this because vague claims about "on-prem options" are common in the vendor landscape. Here is exactly what Cyberm8's on-prem deployment guarantees:
- Action is local. The Cyberm8 engine runs as a container on your infrastructure. Docker, Podman, or Kubernetes. 2GB RAM. No cloud dependency for any operational function.
- Data never leaves. No firewall policy data, network topology data, credential data, or audit log data is transmitted to any external endpoint. The engine makes zero outbound data calls during operation.
- Credentials stay local. API credentials for your firewalls, AD servers, and cloud providers are stored in your local infrastructure. Not in a cloud vault. Not in a third-party key management system. On your hardware, under your control.
- Updates are pull-based. Software updates are available from a Cyberm8 repository that the engine can optionally pull from. In isolated environments, updates are applied via offline media. The engine never phones home.
- License validation is offline-capable. For defense and critical infrastructure deployments, Cyberm8 supports offline license validation that does not require any internet connectivity.
For every automation vendor you evaluate, request a packet capture of the container/agent during a 24-hour operational period. Filter for any outbound connections that leave your network perimeter. If you see data flowing to *.amazonaws.com, *.azure.com, or any third-party SaaS endpoint during normal operation, that vendor is not truly on-prem. With Cyberm8, this packet capture will show zero outbound data connections.
Cloud SOAR Data Flow vs. Cyberm8 Data Flow
| Data Flow Characteristic | Cloud SOAR (Torq, Tines) | Cyberm8 On-Prem |
|---|---|---|
| Firewall policy data processing location | Vendor cloud (US / EU) | Your premises (Israel) |
| API credentials storage | Vendor cloud vault | Your local infrastructure |
| Workflow action environment | Vendor cloud compute | Your container runtime |
| Audit logs | Stored in vendor cloud | Local append-only store |
| Operational during internet outage | No — all action stops | Yes — fully autonomous |
| Subject to foreign jurisdiction legal orders | Yes — US CLOUD Act, EU regulations | No — data never leaves Israeli jurisdiction |
| Vendor acquisition data risk | Data transfers with company ownership | No vendor holds your data |
The US CLOUD Act Consideration
The US Clarifying Lawful Overseas Use of Data (CLOUD) Act permits US law enforcement agencies to compel US-based cloud providers to produce data stored on their servers, regardless of where those servers are physically located. This applies to every US-headquartered or US-incorporated SaaS SOAR vendor.
If your firewall policies, network topology, and API credentials are stored in a US cloud provider's infrastructure, they are legally accessible under US CLOUD Act orders—even if the data never physically left Israeli borders. The only way to categorically eliminate this exposure is to ensure the data never reaches a US provider's infrastructure in the first place.
Network topology and security policy data may not be classified as "personal data" under privacy regulations, but it is operationally sensitive data that could enable or facilitate a cyberattack if disclosed. Under Israel's Privacy Protection Regulations (Data Security), 5777-2017, organizations must implement controls proportional to the sensitivity of the data. Routing this data through third-party cloud providers without explicit risk assessment and board-level approval may constitute a regulatory gap.
Deploy Cyberm8 On Your Infrastructure
Zero data egress. Zero cloud dependency. Full operational localty. Demonstrate to your legal team, risk committee, and regulators that your automation platform respects the boundaries your security policy demands.
Request On-Prem Deployment → info@cyberm8.com | Rosh Ha'ayin, Israel