Paragon Solutions

Paragon Solutions is an Israeli offensive-cyber company that develops mobile-device interception software for sovereign government clients under a stated policy of selling only to democracies. Its Graphite platform is one of two commercial-spyware products — alongside NSO Group's Pegasus — to have produced first-forensic-confirmation reporting of active journalist infections in a G7 country. In 2024 Paragon was acquired by US private-equity firm AE Industrial Partners in a transaction that moved the holding company to Florida. In 2025 Paragon terminated its contract with the Italian government after that government refused to permit Paragon to audit whether Graphite had been used against journalist Francesco Cancellato — an unprecedented public commercial-spyware customer termination.

Paragon founding and Unit 8200 lineage

Paragon was founded around 2019 by former senior figures from Israel's signals-intelligence community, including Ehud Schneorson, a former commander of Unit 8200, alongside additional founders drawn from Israeli offensive-cyber operations. The founder cohort's Unit 8200 pedigree places Paragon squarely inside the same alumni pipeline that produced NSO Group, Candiru, and QuaDream — a lineage that is now the industry's dominant selection filter for founders capable of engineering zero-click mobile exploits at scale.

Graphite architecture and positioning

Graphite is a zero-click mobile-device interception platform targeting iOS and Android handsets, capable of on-device access to encrypted messaging clients — WhatsApp, Signal, iMessage — via device compromise rather than protocol break. Zero-click means no user action is required for infection; there is no phishing link to click and no attachment to download. Paragon markets Graphite for lawful-intercept and counter-terrorism missions to democratic-government intelligence and law-enforcement agencies, with a stated end-use policy that distinguishes it from the NSO Group commercial posture.

AE Industrial Partners acquisition and US restructure

In 2024, Paragon was acquired by AE Industrial Partners, the US private-equity firm, in a transaction that restructured the holding company under a Florida-domiciled US parent. The acquisition is one of the more notable transactions in the commercial-spyware category and a signal of US private-capital appetite for vetted offensive-cyber assets. The structural bet embedded in the transaction is that a Florida-domiciled, democracies-only vendor can secure US-government sales access denied to Herzliya-domiciled competitors on the US Entity List.

The WhatsApp disclosure and the 90-user campaign

In January 2025, WhatsApp — the Meta-owned messaging platform — publicly disclosed that it had detected and blocked an active Graphite campaign targeting approximately 90 users across more than two dozen countries, primarily in Europe. The infection vector was zero-click via WhatsApp; the vulnerability was patched. Meta sent a cease-and-desist letter to Paragon. WhatsApp notified affected users directly, including Francesco Cancellato, editor-in-chief of Italian outlet Fanpage.it — converting the corporate security disclosure into a public-record surveillance scandal within days.

COPASIR, Fanpage.it, and the Italian contract termination

Cancellato's outlet had recently published investigative reporting on the youth wing of Prime Minister Giorgia Meloni's Fratelli d'Italia party. On June 5, 2025, COPASIR — the Italian parliamentary committee for the security of the republic — released a report acknowledging that Italian intelligence services had deployed Graphite against pro-immigration activists Luca Casarini and Giuseppe "Beppe" Caccia, defending the surveillance as lawful. The Italian government's Department of Information for Security (DIS) declined Paragon's offer to audit Graphite system logs to determine whether Cancellato's device had been targeted, calling such an audit "invasive practices, unverifiable in scope, results and method, and therefore not compliant with national security requirements." Paragon and the Italian government publicly parted ways, with each claiming to have terminated the other. On June 12, 2025, the Citizen Lab at the University of Toronto published forensic confirmation, with high confidence, that Graphite had been installed on the iPhones of Fanpage's Naples newsroom head Ciro Pellegrino and one anonymous prominent European journalist — the first forensic evidence of Graphite iOS infection on a journalist's device.

Paragon's democracies-only regulatory bet

Paragon's commercial positioning rests on end-user vetting — the stated policy of selling only to democracies, and a corporate governance structure designed to survive US export-control and regulatory scrutiny that has previously delisted or restricted its Israeli peers. The Italian episode is now the first live test of that positioning in the public record. That Paragon terminated a live customer over refusal to permit a system-log audit is an unprecedented event in the commercial-spyware category. Whether the market treats the termination as evidence of governance discipline, or as evidence that democracies-only is not itself a sufficient control, is the operative question for future acquirers, insurers, and US-government customers.

Where Paragon sits in the cohort

Paragon sits within the Israeli commercial-spyware cohort that includes NSO Group, Candiru, and QuaDream — but has positioned itself deliberately apart on end-user controls, US corporate domicile, and governance disclosure. NSO Group is on the US Entity List and lost a landmark WhatsApp civil verdict in May 2025. Candiru is on the Entity List. QuaDream shut in 2023 after the Israeli Ministry of Defense denied an export license for a Morocco sale. Paragon's evolution — Israeli signals-intelligence alumni founding, product built on the same Israeli offensive-cyber pipeline, US private-equity ownership, US corporate restructure — is the structural arc that distinguishes it most sharply from the original NSO trajectory. It is the category's live case study in whether a commercial-spyware vendor can rebuild the compliance perimeter at the corporate-domicile and governance layer, rather than the product layer.

Primary Sources

Citizen Lab, "Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted" (June 12, 2025). COPASIR report (June 5, 2025) confirming Italian intelligence use of Graphite against Casarini and Caccia. WhatsApp/Meta public disclosure (January 2025) of the 90-user Graphite campaign. Reuters reporting by Raphael Satter on the Paragon-Italy contract termination. AE Industrial Partners acquisition disclosures (2024). Apple threat-notification communications to affected iOS users (April 29, 2025).

Related Olam Coverage

Unit 8200 · NSO Group · Pegasus · Candiru · QuaDream · BIS Entity List and Israeli offensive-cyber companies · Israel's cyber-export 102-to-37 tightening