Commercial spyware
Intrusion tools sold by private companies to states to monitor phones, often with no action by the victim; their market is subject to blacklists and sanctions.
Commercial spyware is an industry: private companies develop or buy vulnerabilities unknown to vendors, build exploit chains able to infect a phone without its victim clicking anything, and sell the package as a service to governments. Pegasus, developed by an Israeli company, and Predator, marketed by a European consortium, are the best-documented examples; journalistic and academic investigations have established their use against journalists, opponents and politicians, including in European Union countries. States have begun to regulate this market. In November 2021, the US Commerce Department added Pegasus's developer to its Entity List; in March 2024, the Treasury sanctioned the leaders of the Predator consortium. The European Parliament held a committee of inquiry, and a diplomatic process launched in 2024 by France and the United Kingdom seeks common rules. For insurance, the subject touches protection of executives and exposed persons, the liability of companies whose work devices are compromised, and above all the economics of vulnerabilities: the same market that equips intelligence services feeds, through leaks or resale, criminal tools.
Textbook case: the CFO of a European group engaged in a sensitive acquisition learns, through an alert from the phone maker, that the device was targeted by state spyware. The company activates its incident response panel, which establishes what information may have leaked and whether the deal is compromised.
Pegasus, Predator, commercial spyware, mercenary spyware
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.