NSO Group

NSO Group is the Israeli offensive-cyber company that built Pegasus — the mobile-device interception platform whose customer-list scandals, US Commerce Department Entity List designation, and successful federal civil verdict against WhatsApp have made it the category-defining case study in commercial spyware. Founded in 2010 by Shalev Hulio, Omri Lavie, and Niv Karmi, NSO is headquartered in Herzliya and licenses Pegasus to sovereign government intelligence and law-enforcement customers. In November 2021 the US Department of Commerce added NSO to the Entity List. In May 2025 a US federal jury awarded Meta and WhatsApp $167,254,000 in punitive damages plus $444,719 in compensatory damages — the largest reported verdict in a civil case brought under the US Computer Fraud and Abuse Act.

Hulio, Lavie, Karmi, and NSO's founding

NSO was founded in 2010 in Herzliya, named for the founders' initials. The founding commercial thesis was to build a lawful-intercept product that solved the encrypted-messaging blindness problem for government intelligence agencies via end-device compromise rather than protocol break. The founders' technical backgrounds sit inside the Israeli private-sector offensive-cyber pipeline that traces to Unit 8200 and the surrounding signals-intelligence community. Hulio and Lavie were not themselves Unit 8200 alumni in the canonical sense, but the technical team assembled around them drew heavily from the Unit's alumni pool — the pattern that has since become standard for the category.

The Pegasus product line

Pegasus is a mobile-device interception platform targeting iOS and Android handsets, deployed via zero-click exploit chains that require no user action. Once installed, Pegasus provides operator-level access to encrypted messaging clients — WhatsApp, Signal, iMessage — as well as to camera, microphone, contacts, calendar, geolocation, and stored files. Pegasus is the canonical reference product for the entire commercial-spyware category and the touchstone against which every subsequent product — Paragon's Graphite, Candiru's DevilsTongue, QuaDream's REIGN — is structurally compared. It is also the product that has drawn the largest single body of adversarial forensic disclosure in the category's history.

NSO ownership — Francisco Partners, Novalpina, lender control

NSO's ownership trajectory has passed from founder control through Francisco Partners (US private equity, 2014 acquisition) to Novalpina Capital (2019 acquisition, subsequently dissolved amid partner disputes) and then to control by senior lenders following the firm's entry into restructuring. An attempted 2022 acquisition by defense contractor L3Harris was reported publicly and then withdrawn following US-government concerns. NSO's ownership trajectory — private-equity ownership, dissolution, lender workout, blocked strategic buyer — is the structural counter-case to Paragon's clean 2024 AE Industrial acquisition, and one of the operative case studies in what happens to a commercial-spyware vendor's capital structure after Entity List designation.

The November 2021 Entity List addition

On November 3, 2021, the US Department of Commerce Bureau of Industry and Security added NSO Group and Candiru to the Entity List — the export-control mechanism that requires a license for any US-origin technology export to the listed entity, with a policy of denial. The listing barred NSO from acquiring US-controlled software, hardware, or services without government approval. It also served as the operative signal to US private capital that commercial-spyware assets domiciled outside a US-friendly compliance perimeter were no longer straightforwardly exit-financeable. The Entity List addition was the single event most responsible for reshaping the category's capital-formation and exit architecture.

WhatsApp v. NSO — the May 2025 verdict

Meta and WhatsApp filed suit against NSO in the US District Court for the Northern District of California in October 2019, alleging that NSO used a WhatsApp vulnerability to deploy Pegasus against approximately 1,400 users between April and May 2019. The suit was brought under the US Computer Fraud and Abuse Act (CFAA), the California Comprehensive Computer Data Access and Fraud Act (CDAFA), and California unfair-competition statutes. On December 20, 2024, Judge Phyllis Hamilton granted summary judgment for Meta and WhatsApp on liability. A jury damages trial ran in early May 2025. On May 6, 2025, the jury returned $167,254,000 in punitive damages and $444,719 in compensatory damages — the largest reported verdict in a civil case brought under either the CFAA or the CDAFA. Trial testimony from NSO executives established that Pegasus had been installed on up to tens of thousands of devices, and that NSO continued to use WhatsApp as an infection vector after the complaint was filed. NSO signaled appeal through counsel at King & Spalding.

Pegasus targeting and the Citizen Lab record

NSO's public-record targeting problem — the operative accountability gap the WhatsApp litigation was designed to close — has been developed principally by the Citizen Lab at the University of Toronto, which has published forensic-confirmed cases of Pegasus deployment against journalists, opposition figures, human-rights defenders, and government officials across more than 45 countries. Named prominent cases include the family of Saudi journalist Jamal Khashoggi and multiple heads of state or their close staff. Apple Inc. v. NSO Group (N.D. Cal., filed November 2021, withdrawn September 2024) supplemented the Citizen Lab record with vendor-corroborated forensic-infrastructure disclosures before Apple withdrew the suit on stated concerns about disclosure of Apple's own threat-intelligence sources.

Where NSO sits in the cohort

NSO is the category's ceiling case: the vendor whose product, litigation record, sanctions status, and public-record forensic exposures set the parameters within which every subsequent Israeli offensive-cyber company builds. Its founders' post-NSO trajectories — Hulio's subsequent commercial-spyware ventures at Dream Security, Lavie's later work — are among the industry's most-watched signals for where the category next migrates. Its unresolved liabilities — appeal of the WhatsApp verdict, Entity List designation still active, and Israeli MoD export-license constraints under the post-2023 country-list tightening — are the category's operative live case law.

Primary Sources

WhatsApp Inc. v. NSO Group Technologies Ltd., N.D. Cal. Case No. 4:19-cv-07123 (summary judgment December 20, 2024; jury verdict May 6, 2025). US Commerce Department Federal Register notice adding NSO to the Entity List (November 3, 2021). Citizen Lab, "The Pegasus Project" and multiple named-target reports (2016–2025). Apple Inc. v. NSO Group Technologies Ltd., N.D. Cal. (filed November 2021, withdrawn September 2024). US Treasury advisories on the commercial-spyware category.

Related Olam Coverage

See also: The Builders · Olam AI Citation Share Index — 2026 Series · Israeli Cyber Public Companies Citation Share Index 2026