In 2022, many observers predicted the end of NSO Group, the Israeli company behind the Pegasus spyware. As someone who works on secure communication and embedded security, I have followed the story closely, because it touches on the vulnerabilities that every software engineer is trying to prevent.
A quick recap
Pegasus is a commercial spyware tool sold to governments. It can take over a smartphone, often without the user clicking anything, and access messages, the microphone and the camera. NSO has always argued that its customers use it to fight serious crime and terrorism. Investigations by researchers and journalists, however, documented its use against journalists, activists and politicians, and in November 2021 the US Commerce Department added NSO to its Entity List.
What happened next
- 2022: a US defence contractor explores buying NSO’s technology but drops the plan after opposition from the US government.
- May 2025: a US jury orders NSO to pay WhatsApp’s owner Meta about $167 million in punitive damages over attacks on WhatsApp users.
- October 2025: a judge reduces the damages to about $4 million but permanently bars NSO from targeting WhatsApp. In the same month, a US investor group acquires a controlling stake in the company, which remains based in Israel.
- 2025 to 2026: the Pall Mall Process, launched by the UK and France, produces a code of practice for states and works on guidelines for the commercial intrusion industry.
So NSO did not disappear, but the environment around it changed. Legal, financial and diplomatic pressure on the whole sector has clearly grown.
Why engineers should care
- Vulnerabilities are a market. Zero-click exploits are not academic curiosities; they are products with buyers and price tags. Every memory-safety bug or unchecked input in widely used software can end up in such a toolkit.
- Secure defaults matter. Messaging apps that parse complex content from strangers are a prime attack surface. Sandboxing, strict input validation and memory-safe languages reduce the risk at the source.
- Defence in depth works. Features such as Apple’s Lockdown Mode, regular updates and hardware-backed security, for example a Root of Trust, make attacks harder and more expensive.
- Courts can shape security too. The WhatsApp ruling shows that legal accountability is becoming part of the security landscape, not only patches and firewalls.
The takeaway
Commercial spyware is unlikely to vanish, but the era of operating without consequences seems to be ending. For those of us who build software, the best contribution is unglamorous but effective: fewer exploitable bugs, faster patches and security designed in from the start.
Sources
- MIT Technology Review, “The hacking industry faces the end of an era”, June 2022. Link
- TechCrunch, “Spyware maker NSO Group confirms acquisition by US investors”, October 2025. Link
- Al Jazeera, “US court bars Israeli spyware firm from targeting WhatsApp users”, October 2025. Link
- Lawfare, “The Key Challenges of Governing Commercial Spyware”, January 2026. Link