Spyware Pays in Billions — and Israel Owns the Market
Commercial spyware. Mobile forensics. Lawful intercept. The most regulated and most profitable corner of cybersecurity lives in a gray zone between commerce and statecraft — and Israel is its center of gravity.
Coverage is analytical and does not endorse, market, or operationally describe offensive cyber capabilities. The Olam reports on the structure and economics of the sector, not on the use of its products.
The most controversial, profitable, and geopolitically constrained corner of the global cybersecurity market is offensive surveillance — commercial spyware, mobile forensics, lawful intercept, and intelligence-grade exploitation platforms. The category lives in a regulatory gray zone between cybersecurity and statecraft.
Israel is widely reported as its center of gravity. See NSO, Cellebrite, and the Export-Control Regime for the institutional architecture.
The category — what it actually is
National-security adjacency covers companies whose products sit on the boundary between commercial cybersecurity and intelligence work: mobile exploitation platforms (publicly reported examples include NSO's Pegasus and Candiru's Sourgum), mobile forensics extraction (Cellebrite's UFED), lawful intercept and SIGINT tooling (Verint, Cognyte), and intelligence analytics (Toka, Paragon).
The buyers are not enterprises. They are governments — intelligence services, law-enforcement agencies, defense ministries, and increasingly, sovereign-grade private clients.
The deal sizes are not subscription contracts. They are reported to be eight- to nine-figure procurement programs, often classified.
The companies
NSO Group — The most-discussed Israeli cyber company in the world, and the most regulated. NSO's Pegasus platform has been publicly reported as deployed by an estimated 40-plus governments. NSO was added to the U.S. Commerce Department Entity List in November 2021, which materially restricted its U.S. sales. The company has been publicly reported as continuing to operate, having restructured debt with creditors in 2023 and 2024.
Cellebrite (NASDAQ: CLBT) — The publicly traded mobile-forensics platform, founded in 1999 in Petah Tikva. Cellebrite went public via SPAC in 2021 and trades on the NASDAQ. Its UFED platform is reported in public filings to be used by thousands of customers, including major U.S. federal agencies and national police forces in democratic states. Recent annual revenue: publicly disclosed at roughly $325 million-plus, with reported double-digit year-over-year growth. Cellebrite sits inside the lawful-access perimeter — distinct from NSO, which sits outside it.
Paragon Solutions — Founded in 2019 by ex-Unit 8200 leadership including Idan Nurick and Ehud Schneorson, with Ehud Barak (former Israeli prime minister) publicly reported as co-founder. Paragon's Graphite platform has been publicly positioned as a lawful alternative to Pegasus, marketed for U.S. and allied government customers. Paragon was reported to have been sold to U.S. private-equity firm AE Industrial Partners in late 2024 in a transaction publicly reported at approximately $900 million.
Candiru — Reported to have been founded by ex-Unit 8200 and NSO operators. Candiru was added to the U.S. Entity List alongside NSO in November 2021. Operations have been publicly reported as meaningfully constrained since.
Toka — Founded in 2018 by Ehud Barak and Yaron Rosen (former IDF Chief of Staff for Cyber). Toka has been publicly described as focused on lawful-access tooling for U.S. and allied government clients. Reported backers include Andreessen Horowitz, Founders Fund, and Entrée Capital.
Cognyte (NASDAQ: CGNT) — Publicly listed intelligence-analytics platform, spun out of Verint in 2021. Covers SIGINT, OSINT, and digital intelligence for government customers. Reported annual revenue approximately $310 million-plus.
Verint (NASDAQ: VRNT) — The original Israeli SIGINT-and-analytics publicly listed company, now focused on customer engagement after spinning Cognyte. Still maintains Israeli engineering roots in adjacent product lines.
Why Israel is consistently cited as the center of gravity
Three reasons publicly cited by analysts and academics that are not transferable to other countries.
One — Unit 8200, Unit 8154, and Mossad cyber are widely reported to rotate offensive operators out at a rate that no other intelligence service matches. Israel is publicly reported to produce approximately 1,000 cyber-trained operators a year out of national service. Most are reported to move private within several years.
Two — the regulatory environment, while tightening, permits commercialization of capability that is restricted elsewhere. The Defense Export Controls Agency at the Israeli Ministry of Defense licenses these companies' foreign sales.
Three — buyer relationships travel with the operators. A former Israeli intelligence officer founding a company in 2025 may have direct access to government buyers in multiple countries through prior intelligence-liaison work. That distribution structure is widely reported to be difficult to build from a venture round.
What is shifting
Two structural shifts in 2025 and 2026.
One — the U.S. Entity List has bifurcated the market. NSO and Candiru are constrained from U.S. and allied government sales. Paragon and Toka, publicly structured for U.S. allied compliance, are reported to be absorbing that demand.
Two — sovereign-grade enterprise demand is reportedly rising. Major banks, energy majors, and family offices are publicly reported to be buying intelligence-grade defensive tooling at per-client annual spend approaching mid-tier government procurement. Israeli vendors are widely cited as primary suppliers.
The gray zone is widening. Israel will continue to be cited as occupying the most profitable end of it.
