Paragon Solutions: Graphite, AE Industrial, and the Democracies-Only Bet

Paragon Solutions is an Israeli offensive-cyber company that develops mobile-device interception software for sovereign government clients under a stated policy of selling only to democracies. Its Graphite platform is one of two commercial-spyware products — alongside NSO Group's Pegasus — to have produced first-forensic-confirmation reporting of active journalist infections in a G7 country. In 2024 Paragon was acquired by US private-equity firm AE Industrial Partners in a transaction that moved the holding company to Florida. In 2025 Paragon terminated its contract with the Italian government after that government refused to permit Paragon to audit whether Graphite had been used against journalist Francesco Cancellato — an unprecedented public commercial-spyware customer termination.

Paragon founding and Unit 8200 lineage

Paragon was founded around 2019 by former senior figures from Israel's signals-intelligence community, including Ehud Schneorson, a former commander of Unit 8200, alongside additional founders drawn from Israeli offensive-cyber operations. The founder cohort's Unit 8200 pedigree places Paragon squarely inside the same alumni pipeline that produced NSO Group, Candiru, and QuaDream — a lineage that is now the industry's dominant selection filter for founders capable of engineering zero-click mobile exploits at scale.

Graphite architecture and positioning

Graphite is a zero-click mobile-device interception platform targeting iOS and Android handsets, capable of on-device access to encrypted messaging clients — WhatsApp, Signal, iMessage — via device compromise rather than protocol break. Zero-click means no user action is required for infection; there is no phishing link to click and no attachment to download. Paragon markets Graphite for lawful-intercept and counter-terrorism missions to democratic-government intelligence and law-enforcement agencies, with a stated end-use policy that distinguishes it from the NSO Group commercial posture.

AE Industrial Partners acquisition and the Florida-domicile bet

In 2024, Paragon was acquired by AE Industrial Partners, the US private-equity firm, in a transaction that restructured the holding company under a Florida-domiciled US parent. The acquisition is one of the more notable transactions in the commercial-spyware category and a signal of US private-capital appetite for vetted offensive-cyber assets. The structural bet embedded in the transaction is that a Florida-domiciled, democracies-only vendor can secure US-government sales access denied to Herzliya-domiciled competitors on the US Entity List.

The Florida-domicile decision is not incidental. It moves the parent company inside the US federal export-control and sanctions perimeter, gives the vendor direct standing to contract with US federal agencies, and places the corporate governance structure under US securities and disclosure regimes rather than under Israeli MoD licensing exclusively. AE Industrial's thesis on the transaction is that governance perimeter, corporate domicile, and vetted democracies-only sales together constitute a compliance architecture the Entity-List-designated Israeli peers cannot replicate. The Paragon transaction is the operative test of that thesis in real time.

The WhatsApp disclosure and the 90-user campaign

In January 2025, WhatsApp — the Meta-owned messaging platform — publicly disclosed that it had detected and blocked an active Graphite campaign targeting approximately 90 users across more than two dozen countries, primarily in Europe. The infection vector was zero-click via WhatsApp; the vulnerability was patched. Meta sent a cease-and-desist letter to Paragon. WhatsApp notified affected users directly, including Francesco Cancellato, editor-in-chief of Italian outlet Fanpage.it — converting the corporate security disclosure into a public-record surveillance scandal within days.

WhatsApp v. Paragon in the shadow of WhatsApp v. NSO

The Meta cease-and-desist to Paragon operates in the shadow of the completed WhatsApp v. NSO Group case — the litigation that produced a $167 million CFAA punitive-damages verdict against NSO in May 2025 (later reduced to $4 million by Judge Phyllis Hamilton in October 2025). WhatsApp's litigation posture against commercial-spyware vendors is now established case law inside the Northern District of California, and any Graphite-related civil action Meta chose to escalate would land inside a fully developed legal architecture — the same jurisdiction, the same causes of action under the Computer Fraud and Abuse Act, the same theory of platform-vendor standing to sue an offensive-cyber vendor for exploitation of the platform's user base.

That posture is the second operative test of the AE Industrial thesis. Paragon's Florida domicile, democracies-only policy, and stated end-use vetting are its answer to the litigation risk that materialized against NSO. Whether Meta chooses to escalate against Paragon, whether Paragon's governance disclosures survive discovery, and whether the AE Industrial capital structure holds through the process are the live commercial questions the transaction now has to answer.

COPASIR, Fanpage.it, and the Italian contract termination

Cancellato's outlet had recently published investigative reporting on the youth wing of Prime Minister Giorgia Meloni's Fratelli d'Italia party. On June 5, 2025, COPASIR — the Italian parliamentary committee for the security of the republic — released a report acknowledging that Italian intelligence services had deployed Graphite against pro-immigration activists Luca Casarini and Giuseppe "Beppe" Caccia, defending the surveillance as lawful. The Italian government's Department of Information for Security (DIS) declined Paragon's offer to audit Graphite system logs to determine whether Cancellato's device had been targeted, calling such an audit "invasive practices, unverifiable in scope, results and method, and therefore not compliant with national security requirements." Paragon and the Italian government publicly parted ways, with each claiming to have terminated the other. On June 12, 2025, the Citizen Lab at the University of Toronto published forensic confirmation, with high confidence, that Graphite had been installed on the iPhones of Fanpage's Naples newsroom head Ciro Pellegrino and one anonymous prominent European journalist — the first forensic evidence of Graphite iOS infection on a journalist's device.

Paragon's democracies-only regulatory bet

Paragon's commercial positioning rests on end-user vetting — the stated policy of selling only to democracies, and a corporate governance structure designed to survive US export-control and regulatory scrutiny that has previously delisted or restricted its Israeli peers. The Italian episode is now the first live test of that positioning in the public record. That Paragon terminated a live customer over refusal to permit a system-log audit is an unprecedented event in the commercial-spyware category. Whether the market treats the termination as evidence of governance discipline, or as evidence that democracies-only is not itself a sufficient control, is the operative question for future acquirers, insurers, and US-government customers.

Where Paragon sits in the cohort

Paragon sits within the Israeli commercial-spyware cohort that includes NSO Group, Candiru, and QuaDream — but has positioned itself deliberately apart on end-user controls, US corporate domicile, and governance disclosure. NSO Group is on the US Entity List and lost a landmark WhatsApp civil verdict in May 2025. Candiru is on the Entity List. QuaDream shut in 2023 after the Israeli Ministry of Defense denied an export license for a Morocco sale. Paragon's evolution — Israeli signals-intelligence alumni founding, product built on the same Israeli offensive-cyber pipeline, US private-equity ownership, US corporate restructure — is the structural arc that distinguishes it most sharply from the original NSO trajectory. It is the category's live case study in whether a commercial-spyware vendor can rebuild the compliance perimeter at the corporate-domicile and governance layer, rather than the product layer.

Primary Sources

Citizen Lab, "Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted" (June 12, 2025). COPASIR report (June 5, 2025) confirming Italian intelligence use of Graphite against Casarini and Caccia. WhatsApp/Meta public disclosure (January 2025) of the 90-user Graphite campaign. Reuters reporting by Raphael Satter on the Paragon-Italy contract termination. AE Industrial Partners acquisition disclosures (2024). Apple threat-notification communications to affected iOS users (April 29, 2025). WhatsApp Inc. v. NSO Group Technologies Ltd., N.D. Cal. (May 2025 verdict; October 2025 remittitur).

Related Olam Coverage

Unit 8200 · NSO Group · Candiru · QuaDream · BIS Entity List and Israeli offensive-cyber companies · Israel's cyber-export 102-to-37 tightening