Subject type: Commercial surveillance technology vendor
Jurisdiction: Israel
Also known as: NSO Group Technologies, Q Cyber Technologies
File opened: 8 September 2026
Last updated: 8 September 2026
Origin
NSO Group was founded in 2010 in Herzliya by Niv Carmi, Shalev Hulio and Omri Lavie, whose initials give the company its name. Its product, Pegasus, is an intrusion suite capable of compromising smartphones and extracting messages, location, microphone and camera access, in its most capable versions without any action by the target.
The founding proposition was that encryption had made lawful interception at the network level ineffective, and that agencies therefore needed access at the endpoint. That argument is not frivolous. The dispute is about what follows from it.
Command
Ownership has changed repeatedly. The founders sold a majority to Francisco Partners in 2014, bought back control in 2019 with backing from Novalpina Capital, and the collapse of Novalpina left the holding in the hands of a creditor-appointed administration. Subsequent restructuring has involved further changes of control, including US-linked investor interest. Any statement about current beneficial ownership should be verified against the most recent filings rather than taken from earlier reporting.
One control point has been constant regardless of owner. Every export requires a licence from the Israeli Ministry of Defence, which means the customer list is a matter of Israeli government policy. NSO’s defence in most controversies has rested on this, and the argument cuts in an uncomfortable direction for the licensing authority.
Capability
Zero-click exploitation chains against current mobile operating systems, delivered and updated as a service. Sustaining that capability requires continuous vulnerability research as platform vendors patch, and the cost of maintaining it is the reason the product is expensive and the market is small.
Documented deployments against journalists, human rights defenders, lawyers, opposition politicians and the associates of dissidents have been reported by Citizen Lab, Amnesty International and multiple news organisations over several years, in a list of countries that includes both authoritarian states and EU members.
Funding and ownership
Private equity and creditor holdings, with revenue from state customers on licence and support contracts. The business has operated under sustained financial pressure since 2021, driven by lost customers, litigation costs and restricted access to banking and capital.
Restrictions and exposure
The US Commerce Department added NSO to the Entity List in November 2021, finding that its tools had been supplied to governments that used them against journalists and activists. A 2023 US executive order restricted federal agency use of commercial spyware presenting counterintelligence or human rights risk.
Litigation has been the more damaging vector. WhatsApp sued in US federal court in 2019 and prevailed on liability, with damages proceedings following. Apple brought a parallel action. The Israeli export licensing regime was tightened after 2021, sharply reducing the approved customer list.
The unresolved policy question is not specific to this company. Interception capability of this kind is a legitimate function of states and an instrument of repression in the same hands, and no jurisdiction has yet built a licensing regime that reliably separates the two.
Watch items
- Beneficial ownership as disclosed in current filings.
- Damages and injunctive outcomes in the WhatsApp and Apple actions.
- Israeli export licence approvals by destination.
- Competitor displacement, including vendors operating from less regulated jurisdictions.
Related files
- Reconnaissance General Bureau: state-run intrusion capability for comparison