4 ms·

I'm quite surprised by the corporate history section. Specifically, NSO Group is worth a lot less than I thought it was, even at its peak. ($1B+ valuation) Al

I'm quite surprised by the corporate history section. Specifically, NSO Group is worth a lot less than I thought it was, even at its peak. ($1B+ valuation) Also, the amount of infighting is... Surprising perhaps? Less surprising is the number of spinoffs out of it, and the number of competing Israeli spyware groups. I'm constantly surprised by how good he Israeli startup environment seems to be. Why is this? How are there so many acquisitions out of there?

kortilla 2y ago
Things like this are similar to law firms. The shelf life of vulnerabilities means that there isn’t a lot of intellectual property owned by the company. The value is in the people’s skills. So once people get really good they quickly realize they can make more by starting their own company and siphoning off client relationships.
tokioyoyo 2y ago
Valuations don’t really matter in their playing field. It’s more about power and politics, rather than raw numbers.
- tptacek 2y ago
  [flagged]
  - ghxst 2y ago
    I'd imagine they have a very limited market as in who they can sell their products and services to, for reasons that might make political power more interesting than valuation.
    - tptacek 2y ago
      I don't know about that. Something I think a lot of people sleep on with this stuff is that most countries have multiple security agencies, and you generally cut deals with them individually. The market for this stuff is bigger than it looks.
      - ghxst 2y ago
        That's probably a fair assumption too. I was mostly thinking that the customers / clients you have and services you have to offer can be largely dependent by people in positions of power where having the right connections and influence might be the key difference between a service or product being viable. For example - although not related to NSO - something like operation Trojan Shield required both Australian and Lithuanian cooperation due to fourth amendment interpretations. Having a zero day in such cases is only part of the work and everything beyond that might be very much dependant on the strings you can pull. But I can also see the argument that that would be something the government can figure out after they buy the product or service, so maybe I'm wrong on that and it's less important than I thought.
        tptacek 2y ago
        My mental model of how this works --- and I have some (imperfect) evidence for it --- is that a given one of these firms (NSO or one of its competitors) has an addressable market of N countries each with an average of K security agencies, and basically all of those agencies pay subscription fees to be continuously in a position to do a CNE operation when they want to. (Generally, I don't think countries just "buy exploits"; a significant component of the money in this space comes from "maintenance", so much so that I think it makes more sense to think of exploits as subscription services.)
        ghxst 2y ago
        > so much so that I think it makes more sense to think of exploits as subscription services. I think this makes sense, especially given the uncertainty of when an exploit gets patched. To my original argument of political power vs valuations you can probably say that having those same people you'd otherwise try to influence on your board with a financial incentive allows you to achieve the same thing, I'm not sure why I didn't consider that before.
        tptacek 2y ago
        Don't get me wrong: I'm sure there's plenty going on between NSO and Israel, and a lot of politics involved. But I also know it to be a real industry, with lots of players.

kortilla 2y ago

Things like this are similar to law firms. The shelf life of vulnerabilities means that there isn’t a lot of intellectual property owned by the company. The value is in the people’s skills. So once people get really good they quickly realize they can make more by starting their own company and siphoning off client relationships.

tokioyoyo 2y ago

Valuations don’t really matter in their playing field. It’s more about power and politics, rather than raw numbers.

tptacek 2y ago
[flagged]
- ghxst 2y ago
  I'd imagine they have a very limited market as in who they can sell their products and services to, for reasons that might make political power more interesting than valuation.
  - tptacek 2y ago
    I don't know about that. Something I think a lot of people sleep on with this stuff is that most countries have multiple security agencies, and you generally cut deals with them individually. The market for this stuff is bigger than it looks.
    - ghxst 2y ago
      That's probably a fair assumption too. I was mostly thinking that the customers / clients you have and services you have to offer can be largely dependent by people in positions of power where having the right connections and influence might be the key difference between a service or product being viable. For example - although not related to NSO - something like operation Trojan Shield required both Australian and Lithuanian cooperation due to fourth amendment interpretations. Having a zero day in such cases is only part of the work and everything beyond that might be very much dependant on the strings you can pull. But I can also see the argument that that would be something the government can figure out after they buy the product or service, so maybe I'm wrong on that and it's less important than I thought.
      - tptacek 2y ago
        My mental model of how this works --- and I have some (imperfect) evidence for it --- is that a given one of these firms (NSO or one of its competitors) has an addressable market of N countries each with an average of K security agencies, and basically all of those agencies pay subscription fees to be continuously in a position to do a CNE operation when they want to. (Generally, I don't think countries just "buy exploits"; a significant component of the money in this space comes from "maintenance", so much so that I think it makes more sense to think of exploits as subscription services.)
        ghxst 2y ago
        > so much so that I think it makes more sense to think of exploits as subscription services. I think this makes sense, especially given the uncertainty of when an exploit gets patched. To my original argument of political power vs valuations you can probably say that having those same people you'd otherwise try to influence on your board with a financial incentive allows you to achieve the same thing, I'm not sure why I didn't consider that before.
        tptacek 2y ago
        Don't get me wrong: I'm sure there's plenty going on between NSO and Israel, and a lot of politics involved. But I also know it to be a real industry, with lots of players.