According to an Atlantic Council study, the spyware industry is booming as investors increasingly turn their attention to this ethically questionable yet highly profitable field. Most of the funding goes to companies in the United States and Israel, and U.S. investments in spyware have tripled over the past year.
The Atlantic Council study covers 561 organizations across 46 countries worldwide for the period from 1992 to 2024. The researchers also identified 34 new investors, bringing the total to 128 (up from 94 in 2024).
It is noted that American investors show the greatest interest in spyware: in 2024, 20 new investor companies were identified in the U.S., bringing the total to 31. This growth has significantly outpaced other countries, including Israel, Italy, and the United Kingdom.
Thus, the number of identified investors in the EU and Switzerland totals 31, with Italy—considered a key hub for spyware—accounting for the largest share at 12 investors. The number of investors in Israel stands at 26.
Among U.S. investors, Atlantic Council analysts list the major hedge funds D.E. Shaw & Co. and Millennium Management, the well-known trading firm Jane Street, and the large financial company Ameriprise Financial.
According to the report, all of them channeled funds to the Israeli lawful spyware vendor Cognyte. It is noted that this company has previously been linked to human rights violations in Azerbaijan, Indonesia, and other countries.
Another notable example of U.S. investment in spyware is the recent acquisition of the well-known Israeli spyware provider Paragon Solutions by AE Industrial Partners — a Florida-based private investment firm specializing in national security.
The report’s authors note that U.S. policymakers have systematically fought the spread and misuse of spyware, at times resorting to tough policy measures, yet there remains a noticeable disconnect between them and U.S. investors. After all, “U.S. dollars continue to be used to finance the very entities that American policymakers are trying to fight.”
As an example, the spyware vendor Saito Tech (formerly Candiru), which has been on the U.S. Department of Commerce sanctions list since 2021, received new investments in 2024 from the American firm Integrity Partners.
In addition to a focus on investments, the Atlantic Council writes that the global spyware market is “growing and evolving,” now including four new vendors, seven new resellers or brokers, 10 new service providers, and 55 new individuals connected to the industry.
For example, recently identified vendors include Israeli firm Bindecy and Italy’s SIO. Among resellers are front companies linked to NSO Group products (such as the Panamanian KBH and Mexico’s Comercializadora de Soluciones Integrales Mecale). New service providers include the U.K.’s Coretech Security and UAE-based ZeroZenX.
The report underscores the central role played by these resellers and brokers, who constitute an “understudied group of actors.”
“These organizations act as intermediaries, obscuring the links between sellers, suppliers, and buyers. Intermediaries often help suppliers expand into new regional markets. This creates a sprawling and opaque spyware supply chain that makes it extremely difficult to untangle corporate structures, jurisdictional maneuvering, and accountability measures,” the study’s authors told Wired.