CrowdStrike Took XM Cyber's Code. 164 Profiles Still Claim to Work There

If you hire Israeli cybersecurity engineers, XM Cyber's layoffs look like a rare pool, and the obvious search will send you to the wrong people. Most leavers haven't updated their profiles, few describe themselves as attack path engineers, and many aren't short of money.

Calcalist reports that only about 50 of XM Cyber's roughly 300 Israeli employees remain, after extensive layoffs since CrowdStrike announced in July that it was buying XM's source code and more than 45 patents. The deal left out the customers and almost all of the staff. People left in waves, many are holding option payouts, and about 50 are staying put on retention bonuses.

What did CrowdStrike actually buy from XM Cyber?

CrowdStrike bought XM Cyber's intellectual property (more than 45 patents and its proprietary source code) and took no revenue, no customers and almost no team. XM keeps operating under its owner, Schwarz Digits, and licenses the technology back from CrowdStrike.

The way the deal was paid matters for sourcing. According to an SEC filing, CrowdStrike paid $145 million in cash and issued 2.1 million shares. CRWD closed at $208, so the stock part was worth about $437M at the close (my arithmetic), and the share price has gone up since. That's why option holders did better than the cash figure suggests.

Some background:

• Ownership: Schwarz Group bought XM in 2021 for $700M.
• Founders: former Mossad director Tamir Pardo, Noam Erez, Boaz Gorodisky and Shaul Shani.

An IP-only deal is an acquisition where the buyer takes the asset and leaves the people. In the CrowdStrike XM Cyber acquisition, the people who wrote the code are the one part of the company nobody paid for.

How many XM Cyber employees are actually on the market?

Somewhere between roughly 150 and 250 Israeli staff have left, depending on whose numbers you believe. Calcalist says about 50 of roughly 300 remain, working with existing customers. XM disputes that. It says it "will continue to operate with approximately 150 employees" and calls other workforce figures incorrect.

Before the deal, XM employed 400 people worldwide, 75% of them in Israel. XM's statement doesn't say whether its 150 is Israel-only or global, so the two accounts don't line up neatly. Plan for both:

• Calcalist's account: about 250 Israeli leavers, about 50 retained.
• XM's account: about 150 remaining, so the leaver pool is smaller but still large for one company.

Either way, this was not a one-day layoff. Departures have run since July. Someone who left early has had months to rest, take advisory work or sign somewhere else. Someone who left last month is still deciding what comes next. If you search them as one group, you'll pitch the wrong message to half of them.

Why are the attack path engineers the most available group?

The engineers are probably the easiest XM people to reach, because their main output was the thing CrowdStrike bought. Once the code and patents belonged to someone else, R&D had less to do. Customer-facing staff still had a job.

This flips the usual acquisition pattern. In an acqui-hire, the buyer pays for engineers and leaves the product behind. Here CrowdStrike paid for the product and left the engineers. Calcalist says the roughly 50 who stayed are "working with existing customers", which points to support, customer success and field roles, not core R&D.

The practical point: don't treat XM's attack path management engineers as a locked-up group you'll have to pry loose. They're more likely the first people who left. The hard-to-reach group is the customer-facing staff on retention bonuses.

Why do so many profiles still say XM Cyber?

Profiles are months behind reality. In Refolk's index of professional profiles, 164 people in Israel still name XM Cyber in their headline. In a 25-profile sample, all 25 listed XM Cyber as their current employer.

164

The reason is simple. Someone with an option payout and no money worries has no reason to update their headline, turn on "open to work" or announce a job search. Senior people often avoid public job-seeking signals anyway. Money makes them even less likely to bother.

Here is how the numbers line up:

The ~114 is an upper bound, since some headlines may say "ex-XM". The direction is still clear. A filter for "current employer = XM Cyber" plus "open to work" mostly returns people who have already left, and misses the leavers who have quietly updated.

There's another problem. The XM-tagged pool in Refolk's index leans toward go-to-market and operations. The top titles are:

• Senior Product Manager
• VP Operations
• Director of Revenue Operations
• SVP Marketing
• Head of Global Field Marketing

Engineering titles do appear (Software Group Lead, Senior DevOps Engineer, Senior Security Researcher), but less often. GTM people keep their headlines polished because the headline is part of how they sell. Engineers don't bother.

That's why a headline search gives you a skewed pool for sourcing laid-off security engineers. You need to search employment history with dates, not the current-title field. Refolk is built for that: you describe the person in plain English ("engineers who worked at XM Cyber in Israel and left after July") and get back a shortlist ranked by actual work history, not by what a headline says.

Why do keyword searches for attack path management fail?

Searching by skill keywords mostly misses this pool, because XM's engineers don't describe themselves by product category. In Refolk's index, only one Israeli headline matches "attack path exposure management", and it belongs to a Head of Data & AI at Cye, not an XM alum.

Engineers name their function, not their market. An engineer who spent years building attack-graph logic writes "Security Researcher," "Software Group Lead" or "Senior DevOps Engineer." The category name belongs to the marketing team.

The wider title pool shows the scale. Refolk's index has 885 people in Israel with Security Researcher or Security Engineer titles. The top current employers in the sample are Meta, Apple, Pentera, Alice (formerly ActiveFence) and Cellebrite. If all 250 XM leavers were added, they'd equal about 28% of that pool. That comparison isn't like-for-like, because many leavers work in GTM, but it shows how big this release is for one company.

What works instead:

1. Anchor on employer history. XM Cyber, with tenure ending in July or later.
2. Expand titles by function. Security Researcher, Software Group Lead, Backend Engineer, Senior DevOps Engineer, Algorithm Engineer, Team Lead.
3. Add tenure depth. Two or more years at XM means they probably worked on the core attack-graph product, not just its last stretch.
4. Check public work. Published research, talks and code show what someone actually built.

Who else is competing for XM Cyber talent?

You won't be the only one calling, and the competition is specific. Pentera, a direct competitor in automated attack validation, already appears among the top employers of Israeli security researchers in Refolk's index. It knows this work better than almost anyone.

The main bidders:

• Pentera. Same problem space and little ramp-up time needed for an XM engineer.
• Defense-tech. GotFriends found new defense-tech jobs in Israel up 20% in 2026 over the same period last year, with wages rising about 8%. Kela Technologies, Xtend and D-Fend Solutions are among the hirers.
• CrowdStrike itself. It keeps buying in Israel. Globes lists the Seraphic Security purchase at $420M, and Calcalist reports talks to acquire Orion Security for around $500M. An XM leaver could end up working for CrowdStrike through another acquisition.

The odd part is that the wider Israeli tech market is cooling. More than a third of tech companies expect hiring to decline, nearly double the previous survey's share, and the planned hiring rate fell from 7.2% to 5.9%. Generalists face a buyer's market. Senior security engineers with real attack-path experience don't, so expect to pay full price.

How do you pitch someone who just cashed out options?

Pitch the work, not rescue. Globes estimates the option payouts at tens of millions of dollars in total. A "sorry about the layoff, happy to help" message reads as tone-deaf to someone whose shares just paid off.

A rescue pitch to someone holding an option payout is a pitch to the wrong person.

What tends to work with people who have money in the bank:

• Problem ownership. "You'd own exposure scoring from scratch" beats "stable team, great benefits."
• Equity that matters. They've just seen what equity can be worth, and they'll do the math.
• Founding-engineer roles. Early-stage companies have an edge, because the payout lets people take a lower salary.
• Co-founder conversations. For founders and VCs, this group is a co-founder pool. People who built attack-graph systems and now have money are exactly who starts the next exposure-management company. The teams Erez and Gorodisky built already know how to work together.
• Specificity. Mention the product they worked on and the problem you'd hand them. Generic security-engineer outreach gets ignored.

What to avoid: urgency language, "open to work" assumptions, and anything suggesting they need a job.

When should you reach out to each wave?

Time your outreach to when each person left, not to the headline about the layoffs. The pool divides into groups with different timing:

1. The earliest leavers, from July. Check where they are now before you write. Some have already signed, and if so, pitch them for later or ask who else from their team is looking.
2. The most recent leavers. The freshest group, and many will still be weighing options. Reach out now with a specific role.
3. The ~50 retained staff. They're on retention bonuses and probably customer-facing. Make contact now, with no ask, and come back when the bonuses vest. The vesting dates aren't public, so ask them directly when the time is right.
4. GTM and operations leavers. If you're hiring revenue, marketing or product leaders, the polished headlines in the 164-profile pool are useful for you. Engineering recruiters should look past them.

Because the profiles lag, run the same search again every few weeks. Re-running a plain-English query in Refolk shows who has changed jobs since the last pass, which is how you notice the next wave as people start updating their headlines.

FAQ

How many people were cut in the XM Cyber layoffs?

Calcalist reports that only about 50 of XM Cyber's roughly 300 Israeli employees remain after layoffs since July, which implies about 250 departures. XM disputes this. It says it will continue with approximately 150 employees and calls other figures incorrect. Before the deal, XM had 400 employees worldwide, 75% of them in Israel.

Did CrowdStrike hire the XM Cyber team?

No. The deal covered more than 45 patents and the proprietary source code, with no revenue, no customers and almost none of the staff. XM keeps running under Schwarz Digits and licenses the technology back. Individual leavers may still end up at CrowdStrike through hiring or its other Israeli acquisitions.

What titles should I search to find XM's attack path engineers?

Search by function, not category. Only one Israeli headline in Refolk's index matches "attack path exposure management," and it isn't an XM alum. Use titles such as Security Researcher, Software Group Lead, Senior DevOps Engineer and Team Lead, combined with XM Cyber employment that ended in July or later.

Should I contact the employees who stayed on retention bonuses?

Yes, but don't make an ask yet. The roughly 50 retained staff are tied to retention bonuses and are likely customer-facing. Start the conversation now, keep it light, and make a real offer once their bonuses vest. Recruiters who build the relationship early will be first in line when those people are free to move.