CrowdStrike Bought XM Cyber's Code, Not Its 250 Herzliya Engineers

On Oct 13, 2026, CrowdStrike closed a ~$586M deal for XM Cyber's source code and 45+ patents, and explicitly left the people and the customer book behind. Roughly 250 of the 300 Israeli staff have already been laid off since the July announcement, with only ~50 kept on to service existing accounts under a Schwarz Digits licence-back. For anyone recruiting breach and attack simulation engineers, this is the kind of concentrated supply event that happens once a decade, and the window to act closes in weeks, not quarters.

What actually happened in the CrowdStrike XM Cyber acquisition

CrowdStrike bought XM Cyber's intellectual property, not its company. The structure is an IP-only carve-out: source code plus 45+ patents to CrowdStrike, with Schwarz Group retaining the operating entity, the ~$450M order backlog, and a licence to keep servicing customers through a shrinking Israeli team.

The headline numbers from Calcalist and Ynet reporting:

• $145M in cash and stock, plus 2,118,022 CrowdStrike shares issued at closing ($208/share, ~$441M), implying ~$586M total consideration.
• Schwarz Group paid $700M for XM Cyber in 2021, so this is a roughly $100M+ paper loss on the IP alone.
• XM Cyber employed ~400 globally, 75% of them in Israel (~300).
• Only ~50 Israeli staff remain post-close. ~250 have been laid off since the July announcement.
• Retention bonuses are being paid to the stayers. Option payouts across all employees are estimated in the "tens of millions."

CrowdStrike's own release says a "smaller number" of XM Cyber staff will move over, with customers being migrated to Falcon Flex. Translation for sourcers: the acquirer is not absorbing the engineering team. They already have the headcount in Austin and Sunnyvale, and they wanted the attack-graph engine, not the people who built it.

~250

Why these 250 are a once-a-decade sourcing event

Because XM Cyber's attack-path engine required a skill blend that is rare globally, not just in Israel: graph algorithms, Active Directory internals, cloud IAM edge cases, and MITRE ATT&CK mapping, in one head. You cannot post for this and expect inbound.

Gartner has folded breach and attack simulation (BAS) into a broader category called Adversarial Exposure Validation (AEV), which is a fancy way of saying the same engine now gets cross-shopped by CTEM, CNAPP, CAASM, and exposure management vendors. So the demand side is larger than the pure BAS market suggests. The supply side, meanwhile, just dumped ~250 people with the exact skill blend onto LinkedIn in one week.

A quick calibration from Refolk's index of professional profiles:

• Israel-based professionals with Penetration Testing listed as a skill: 2,899.
• Ex-XM Cyber Israeli staff on the market: ~250.
• Churn as a share of the adjacent Israeli pentest pool: ~8.6%, in a single quarter.

An 8.6% supply shock in a tight security labor market is the kind of thing a US-based BAS vendor with a remote-first posture can use to acquire what would normally take 18 months of recruiting, inside one quarter. If you can hire across timezones, this is a staffing round, not a req.

The numbers, side by side

Here is the dataset the rest of the article runs on, in one table so you can skim it.

The 165 indexed Israeli XM Cyber profiles are the sourceable spine. They cluster in Tel Aviv District (6), Tel Aviv-Yafo (4), Center District (2), and Herzliya (1 self-listed home base, with the rest commuting into the Herzliya Pituach HQ). Senior titles visible in that set include CTO and Co-Founder, Senior Product Manager, SVP Marketing, Head of Global Field Marketing, Software Group Lead, Senior DevOps Engineer, and Senior Security Researcher.

Who is going to recruit them first

Cymulate. They hold about 20.7% of the 2025 BAS market, they are Israeli-headquartered in Rishon LeZion, and the commuter radius overlaps Herzliya Pituach cleanly. They have the strongest motive, the shortest geographic distance, and a product category that reads one-to-one on an ex-XM Cyber resume.

Then the obvious tier, in descending order of how fast they can move:

1. Cymulate (Rishon LeZion / Tel Aviv), BAS incumbent, same commute.
2. Pentera (Petah Tikva), automated security validation, overlapping skill set.
3. SafeBreach, Israeli-rooted BAS, direct replacement roles.
4. Picus Security and AttackIQ, non-Israeli BAS vendors who will hire remote.
5. Horizon3.ai (NodeZero), autonomous pentest, remote-first US.
6. NetSPI, ReliaQuest, Scythe, Mandiant, all adjacent.

The non-obvious buyers matter more, because the obvious ones will burn through the top of the stack in two weeks:

• Palo Alto Networks Prisma Cloud, hiring in Tel Aviv. Refolk's index shows a Head of Engineering for Data Security and AI Security (Prisma Cloud) in-country, which means the team is live and already paying local comp.
• Axonius and Seemplicity, both CAASM / exposure management, both Israeli, both now cross-shopping attack-graph talent under the AEV banner.
• Toka and Sola Security, smaller but real, and credible as "founder-adjacent" landing spots for the senior ICs.
• CrowdStrike Israel, counter-intuitively. They did not take the team wholesale, but they will hand-pick the most senior engine authors.

If you are running the pipeline for one of these vendors and do not want to spend a week writing Boolean strings against "attack path" OR "BAS" OR "adversary emulation," that plain-English intent is exactly what Refolk is built for. Ask for "ex-XM Cyber engineers in the Herzliya commuter belt with Active Directory and MITRE ATT&CK experience" and get a ranked shortlist back.

The licence-back traps the 50 who stayed

The ~50 staffers kept behind are servicing a product whose IP now belongs to CrowdStrike, under a Schwarz Digits licence while customers migrate to Falcon Flex. That is a role with a defined expiry date. Retention bonuses mask it, but they do not change the arithmetic.

Expect a second wave of ~50 availability in Q2 to Q3 2027, as the Falcon Flex migration completes and the licence-back winds down. Three implications for how you build the pipeline today:

• Flag the stayers in your ATS now, with a Q2 2027 recontact date. Do not pitch hard, because they just took a retention bonus and will say no on reflex.
• Index on the title changes. The moment a stayer updates from "Senior Security Researcher, XM Cyber" to "Senior Security Researcher, Schwarz Digits / STACKIT," the migration is near the end.
• Build the relationship through BSidesTLV and OWASP Israel in H1 2027. The best of the stayers are the ones who understood the engine well enough to be kept, which is exactly the signal you want.

Why cash offers will lose

Because tens of millions of dollars in option payouts just hit this group. Senior engineers may be sitting on $100K to $500K of personal liquidity, which is a different negotiation.

Standard competing offers do not move someone who just banked a year of runway. What does move them, in roughly this order:

• Equity refresh grants with a believable path to a secondary. Refresh math beats base-salary math when the candidate already has cash.
• Lead engineer or principal titles, with a concrete surface area. "You own the attack-graph engine" beats "Senior Engineer, BAS Team."
• A technical founder they want to work for. The XM Cyber co-founder population is a short list, and the ex-engineers will follow a known name.
• Short interview loops. Five rounds over three weeks is a non-starter when every competitor is running two rounds in a week.

Recruiters leading with cash in this cohort will lose to recruiters leading with surface area and a title.

A 14-day sourcing playbook

Build the list, triage the stayers, contact the leavers, in that order. The window is 60 to 90 days before the strongest ICs are off the market, and the first 14 days decide whether you are first contact or seventh.

Days 1 to 3: build the list

• Pull the 165 indexed Israeli XM Cyber profiles. The Refolk index is already filtered to Israel-based current and former staff, so you are not scraping LinkedIn by hand.
• Tag each profile by status: laid off, still at XM Cyber, moved to CrowdStrike, moved elsewhere.
• Segment by role family: attack-graph engineering, security research, DevOps, product, GTM.

Days 4 to 7: triage

• Deprioritize the ~50 stayers for a Q2 2027 recontact.
• Deprioritize anyone already at Cymulate, Pentera, or Palo Alto Networks Prisma Cloud. They moved first because they are closest, and you will not pull them again this quarter.
• Prioritize the laid-off ICs with 3 to 8 years of tenure. They have the engine knowledge and are not yet locked into a replacement role.

Days 8 to 14: contact

• First message in Hebrew or English, matched to the candidate's LinkedIn language setting.
• Reference the specific engine component they worked on, not "your experience at XM Cyber." Specificity is the only thing that gets a reply in a flooded inbox.
• Offer a 20-minute conversation, not a formal interview loop. The ICs are talking to five recruiters this week.

Herzliya is not just an XM Cyber story

Herzliya Pituach is also home to Microsoft Israel R&D, multiple Palo Alto Networks teams, and offices adjacent to Check Point. That matters because passive LinkedIn geo-targeting on Herzliya will surface commuters from all of those employers, not just XM Cyber alumni.

Use it as an advantage. The same geo filter that catches the ex-XM Cyber cohort also catches Microsoft Herzliya security engineers, Palo Alto Networks Prisma Cloud ICs, and the Unit 8200 alumni network that cycles through all of these buildings. If you are building a BAS or AEV team, Herzliya security engineer sourcing is not a 250-person question, it is a several-thousand-person question with 250 motivated candidates right at the top.

FAQ

How many ex-XM Cyber engineers are actually sourceable in Israel right now?

About 250 people were laid off out of the ~300 Israeli staff, and Refolk's index currently holds 165 Israel-based XM Cyber profiles across current and former employees. The sourceable pool for an immediate hire is the subset of those 165 who are already flagged as leavers, roughly 130 to 140 after you exclude the ~50 stayers and the small number migrating to CrowdStrike.

Who are the most likely competing recruiters?

Cymulate first, because they hold ~20.7% BAS market share and share the Tel Aviv commuter radius. Then Pentera, SafeBreach, Palo Alto Networks Prisma Cloud (Tel Aviv), Axonius, and Seemplicity on the adjacent CAASM and exposure management side. Picus, AttackIQ, Horizon3.ai, and NetSPI will compete from outside Israel on remote packages.

Why did CrowdStrike buy the IP but not the team?

Because they already have the engineering headcount in Austin and Sunnyvale, and the ~$450M XM Cyber order backlog made a full acquisition structurally expensive. The IP-only carve-out lets CrowdStrike migrate customers to Falcon Flex on their own roadmap while Schwarz Digits runs the licence-back and absorbs the wind-down cost.

When does the second wave of availability hit?

Expect it in Q2 to Q3 2027, when the Falcon Flex customer migration completes and the licence-back winds down. The ~50 stayers taking retention bonuses today are the ones to recontact then, especially anyone whose title shifts from XM Cyber to Schwarz Digits or STACKIT in the interim.