NSO Group: Pegasus, Entity List, $167M WhatsApp Verdict

NSO Group is the Israeli offensive-cyber company that built Pegasus — the mobile-device interception platform whose customer-list scandals, US Commerce Department Entity List designation, and successful federal civil verdict against WhatsApp have made it the category-defining case study in commercial spyware. Founded in 2010 by Shalev Hulio, Omri Lavie, and Niv Karmi, NSO is headquartered in Herzliya and licenses Pegasus to sovereign government intelligence and law-enforcement customers. In November 2021 the US Department of Commerce added NSO to the Entity List. In May 2025 a US federal jury awarded Meta and WhatsApp $167,254,000 in punitive damages plus $444,719 in compensatory damages — the largest reported verdict in a civil case brought under the US Computer Fraud and Abuse Act.

Hulio, Lavie, Karmi, and NSO's founding

NSO was founded in 2010 in Herzliya, named for the founders' initials. The founding commercial thesis was to build a lawful-intercept product that solved the encrypted-messaging blindness problem for government intelligence agencies via end-device compromise rather than protocol break. The founders' technical backgrounds sit inside the Israeli private-sector offensive-cyber pipeline that traces to Unit 8200 and the surrounding signals-intelligence community. Hulio and Lavie were not themselves Unit 8200 alumni in the canonical sense, but the technical team assembled around them drew heavily from the Unit's alumni pool — the pattern that has since become standard for the category.

The Pegasus product line

Pegasus is a mobile-device interception platform targeting iOS and Android handsets, deployed via zero-click exploit chains that require no user action. Once installed, Pegasus provides operator-level access to encrypted messaging clients — WhatsApp, Signal, iMessage — as well as to camera, microphone, contacts, calendar, geolocation, and stored files. Pegasus is the canonical reference product for the entire commercial-spyware category and the touchstone against which every subsequent product — Paragon's Graphite, Candiru's DevilsTongue, QuaDream's REIGN — is structurally compared. It is also the product that has drawn the largest single body of adversarial forensic disclosure in the category's history.

The Pegasus operator model: licensed to sovereigns, not sold

The commercial architecture of Pegasus is one of the operative distinguishing features of the offensive-cyber category from adjacent security-software categories. NSO licenses Pegasus to sovereign government customers — intelligence services, national police forces, ministries of interior — under contracts that specify the customer, the deployment envelope, and the licensing period. NSO's stated position is that operational targeting decisions are made by the customer under the customer's own legal authority. The vendor provides the platform, the customer decides who to target, and the vendor's compliance regime operates at the level of country-selection and license-renewal rather than target-selection.

That model is what makes both the commercial case and the accountability gap. Commercially, sovereign licensing produces high per-customer revenue at low customer count, with contract sizes that reach into the tens of millions of dollars per deployment. Accountability-wise, the model places NSO at commercial arm's length from targeting decisions that the vendor's own tools enable. The Citizen Lab and WhatsApp litigation records have argued — with substantial forensic support — that the arm's-length model does not survive contact with the record. That argument is the operative one in the case law now being built.

NSO ownership — Francisco Partners, Novalpina, lender control

NSO's ownership trajectory has passed from founder control through Francisco Partners (US private equity, 2014 acquisition) to Novalpina Capital (2019 acquisition, subsequently dissolved amid partner disputes) and then to control by senior lenders following the firm's entry into restructuring. An attempted 2022 acquisition by defense contractor L3Harris was reported publicly and then withdrawn following US-government concerns. NSO's ownership trajectory — private-equity ownership, dissolution, lender workout, blocked strategic buyer — is the structural counter-case to Paragon's clean 2024 AE Industrial acquisition, and one of the operative case studies in what happens to a commercial-spyware vendor's capital structure after Entity List designation.

The November 2021 Entity List addition

On November 3, 2021, the US Department of Commerce Bureau of Industry and Security added NSO Group and Candiru to the Entity List — the export-control mechanism that requires a license for any US-origin technology export to the listed entity, with a policy of denial. The listing barred NSO from acquiring US-controlled software, hardware, or services without government approval. It also served as the operative signal to US private capital that commercial-spyware assets domiciled outside a US-friendly compliance perimeter were no longer straightforwardly exit-financeable. The Entity List addition was the single event most responsible for reshaping the category's capital-formation and exit architecture.

WhatsApp v. NSO — the May 2025 verdict

Meta and WhatsApp filed suit against NSO in the US District Court for the Northern District of California in October 2019, alleging that NSO used a WhatsApp vulnerability to deploy Pegasus against approximately 1,400 users between April and May 2019. The suit was brought under the US Computer Fraud and Abuse Act (CFAA), the California Comprehensive Computer Data Access and Fraud Act (CDAFA), and California unfair-competition statutes. On December 20, 2024, Judge Phyllis Hamilton granted summary judgment for Meta and WhatsApp on liability. A jury damages trial ran in early May 2025. On May 6, 2025, the jury returned $167,254,000 in punitive damages and $444,719 in compensatory damages — the largest reported verdict in a civil case brought under either the CFAA or the CDAFA. Trial testimony from NSO executives established that Pegasus had been installed on up to tens of thousands of devices, and that NSO continued to use WhatsApp as an infection vector after the complaint was filed. NSO signaled appeal through counsel at King & Spalding.

Pegasus targeting and the Citizen Lab record

NSO's public-record targeting problem — the operative accountability gap the WhatsApp litigation was designed to close — has been developed principally by the Citizen Lab at the University of Toronto, which has published forensic-confirmed cases of Pegasus deployment against journalists, opposition figures, human-rights defenders, and government officials across more than 45 countries. Named prominent cases include the family of Saudi journalist Jamal Khashoggi and multiple heads of state or their close staff. Apple Inc. v. NSO Group (N.D. Cal., filed November 2021, withdrawn September 2024) supplemented the Citizen Lab record with vendor-corroborated forensic-infrastructure disclosures before Apple withdrew the suit on stated concerns about disclosure of Apple's own threat-intelligence sources.

Post-NSO: the founders' next companies and the category's next migration

The trajectories of NSO's founders after their exit from operating control tell the second half of the category's story. Shalev Hulio has been publicly associated with subsequent commercial-spyware ventures, most prominently Dream Security — a next-generation offensive and defensive cyber platform that has been the operative signal for where former NSO talent has migrated post-Entity-List. Omri Lavie has been active across additional Israeli technology and adjacent security categories. The founders' post-NSO activity is closely tracked by both the industry and the accountability community as an operative signal for how the category is reconstituting itself under the constraints imposed by the Entity List, the WhatsApp verdict, and the Israeli MoD's post-2023 export-license country-list tightening.

The broader pattern is one of institutional continuity across corporate boundaries. Technical talent, sales relationships, and operational know-how do not disappear when a company enters restructuring — they migrate. NSO's alumni network inside the Israeli offensive-cyber cluster is one of the operative sources of the category's next wave of vendors, and the Citizen Lab / vendor-litigation infrastructure that built the accountability record on NSO is now positioned to track those successor entities with the same forensic methodology.

Where NSO sits in the cohort

NSO is the category's ceiling case: the vendor whose product, litigation record, sanctions status, and public-record forensic exposures set the parameters within which every subsequent Israeli offensive-cyber company builds. Its unresolved liabilities — appeal of the WhatsApp verdict, Entity List designation still active, and Israeli MoD export-license constraints under the post-2023 country-list tightening — are the category's operative live case law. Its founders' post-NSO trajectories are among the industry's most-watched signals for where the category next migrates.

Primary Sources

WhatsApp Inc. v. NSO Group Technologies Ltd., N.D. Cal. Case No. 4:19-cv-07123 (summary judgment December 20, 2024; jury verdict May 6, 2025). US Commerce Department Federal Register notice adding NSO to the Entity List (November 3, 2021). Citizen Lab, "The Pegasus Project" and multiple named-target reports (2016–2025). Apple Inc. v. NSO Group Technologies Ltd., N.D. Cal. (filed November 2021, withdrawn September 2024). US Treasury advisories on the commercial-spyware category.