Better Health for All

Cognyte's core surveillance products and services carry an unacceptable risk of contributing to serious human rights abuses, including targeting vulnerable groups and political opponents.

This extensive surveillance can cause severe, widespread mental health damage, such as fear, anxiety, and paranoia, with no redeeming health benefits. The company's products and practices are directly harmful to mental health, and there is no evidence of mental health support or initiatives. Furthermore, Cognyte's privacy policy details data collection, storage, sharing with affiliates and third parties, and disclosure to authorities, including compliance with legal requirements for data disclosure. However, the company was banned by Facebook (now Meta) in 2021 for enabling the management of fake accounts across social media platforms, indicating poor data protection and inadequate consent protocols.

Fair Trade & Ethical Sourcing

Cognyte's Specialized Disclosure Report (Form SD) for the period January 1, 2024, to December 31, 2024, indicates that 90% of its total hardware spend and 92% of total components/parts containing conflict minerals are covered by Conflict Minerals Reporting Templates (CMRTs).

The company relies on third-party assurances and certifications, including RMI's Responsible Minerals Assurance Process. However, the vast majority of suppliers provided data at a company/divisional level, limiting Cognyte's ability to identify specific smelters or refiners and obtain continuous, real-time country of origin and chain of custody information from suppliers. The report also notes that 24 key suppliers, representing approximately 90% of hardware spend, undergo risk assessment for conflict minerals.

No War, No Weapons

Cognyte Software Ltd. sold intercept spyware to a Myanmar state-backed telecommunications firm in January 2021, despite Israel's claimed ban on defense technology transfers to Myanmar since 2017.

A legal complaint has been filed accusing the company of aiding and abetting crimes against humanity. The company divested its Situational Intelligence Solutions (SIS) business, which generated a gain of $5.8 million in 2022 and $4.8 million in 2024. The company mentions internal policies and guidelines to mitigate misuse, but specific ethical 'red lines' are not detailed. A Trade Compliance team reviews sales opportunities and reports to senior management and the board.

Planet-Friendly Business

No specific, quantitative data points related to Planet-Friendly Business KPIs were found across the provided articles. Several articles explicitly state a lack of publicly available data for various environmental metrics, including carbon emissions, renewable energy use, water consumption, waste diversion, and climate targets.

While one article mentions GHG Emissions, Waste, and Biodiversity as negative impact categories with qualitative scores from an external model, these are not specific, measurable facts that can be mapped to the rubric's quantitative thresholds.

Respect for Cultures & Communities

No specific, concrete data points were found in the provided articles to assess Cognyte Software Ltd. against the defined KPIs for Respect for Cultures & Communities. The articles primarily discuss career opportunities,

event participation, a lawsuit alleging human rights abuses (not cultural appropriation or specific community engagement metrics), and a code of conduct without quantitative performance data.

Safe & Smart Tech

In May 2021, Cognyte experienced a major data breach that exposed 5 billion user records, including names, email addresses, and passwords.

This breach was due to insufficient authentication and authorization controls on an Elasticsearch service, which allowed public access to the database. The misconfiguration was discovered and fixed within 4 days by a security researcher. The company's privacy policy states that users can unsubscribe from mailing lists and terminate website use, but this indicates minimal user control over personal data. The policy also mentions data retention for legitimate purposes like website maintenance, dispute resolution, and fraud prevention, which suggests limited data minimization practices. While the policy addresses compliance with EU data subject rights and US state privacy laws, the occurrence of a major breach due to inadequate controls suggests basic compliance with significant gaps. No formal vulnerability disclosure program is mentioned, and the vulnerability was discovered by a security researcher using a honeypot, indicating a lack of proactive engagement with the security research community.