Experts debate Access-as-a-Service spyware industry
Atlantic Council panel discusses NSO Group's Pegasus, the Access-as-a-Service surveillance industry, and its national security and human rights implications.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is a policy discussion piece from the Atlantic Council's Cyber Statecraft Initiative, featuring a panel of five experts discussing the commercial spyware and "Access-as-a-Service" (AaaS) industry roughly one year after the US Commerce Department added NSO Group and three other companies to its Entity List. The article references NSO Group's Pegasus spyware being used by foreign governments to target journalists, activists, and even US diplomats and Embassy staff in Uganda, as well as reporting that the FBI briefly considered but ultimately declined to license Pegasus for domestic use.
The panelists—drawn from Citizen Lab, the Atlantic Council, the Norwegian Institute of International Affairs, MITRE, and Copenhagen Business School—explore how commercial surveillance and offensive cyber capabilities (including zero-day exploits) are packaged and sold to state and non-state customers, blurring lines between domestic and foreign surveillance, and between government and corporate data collection. They discuss the national security risks posed to the US and allies, the difficulty of regulating a globalized and increasingly professionalized industry, and calls for the US and EU to develop norms and enforcement mechanisms against abusive vendors.
This is an opinion/analysis piece rather than an incident report — there are no specific IOCs, exploited vulnerabilities, or newly disclosed malware. It is included here as background threat-landscape context on the commercial spyware and hack-for-hire ecosystem, referencing known past cases (NSO Group/Pegasus, Project Raven, targeting of Omar Abdulaziz) rather than a new campaign.
Mentioned in this report
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-the-rise-of-cyber-surveillance-and-the-access-as-a-service-industry
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs