I worked at a place that faced exactly that.

I initially was in the Huawei client engagement where they wanted copies of all of our source code. We said “no, nobody gets that”. They just keep asking over and over.

On one hand, that seems like a sure way to get your product copied. On the other, they’d be totally nuts to run a cybersecurity product without the source code, right?

Seems like a situation where getting the interests to align is just very difficult.

No other customers demanded source code.

Even with white labeled products so they stay legally compliant, is it really justifiable to increase the risk? They're having people flying in and out for "sales meetings", shared office spaces, devices, maybe even staff overlap.

I understand it's a good way to make money but it comes with some tail risk.

Basically, a Chinese MSSP or SI is selected and given the American/Israeli company's logo and makes a revenue share agreement, and an airgapped environment using a distinct fork is deployed.

That said, most companies decide not to operate in the Chinese market - the TAM is too small for the headaches that it entails (losing Gov and NATO+ defense procurement opportunities).

Makes sense, thanks for elaborating. Just the logistics of it sound like a lot of overhead.

Usually it's included as a sweetener for a contract (generally LVM...(cough cough)...EMEA).