3 ms·

I'd imagine they have a very limited market as in who they can sell their products and services to, for reasons that might make political power more interesting

by ghxst 2y ago

I'd imagine they have a very limited market as in who they can sell their products and services to, for reasons that might make political power more interesting than valuation.

tptacek 2y ago
I don't know about that. Something I think a lot of people sleep on with this stuff is that most countries have multiple security agencies, and you generally cut deals with them individually. The market for this stuff is bigger than it looks.
- ghxst 2y ago
  That's probably a fair assumption too. I was mostly thinking that the customers / clients you have and services you have to offer can be largely dependent by people in positions of power where having the right connections and influence might be the key difference between a service or product being viable. For example - although not related to NSO - something like operation Trojan Shield required both Australian and Lithuanian cooperation due to fourth amendment interpretations. Having a zero day in such cases is only part of the work and everything beyond that might be very much dependant on the strings you can pull. But I can also see the argument that that would be something the government can figure out after they buy the product or service, so maybe I'm wrong on that and it's less important than I thought.
  - tptacek 2y ago
    My mental model of how this works --- and I have some (imperfect) evidence for it --- is that a given one of these firms (NSO or one of its competitors) has an addressable market of N countries each with an average of K security agencies, and basically all of those agencies pay subscription fees to be continuously in a position to do a CNE operation when they want to. (Generally, I don't think countries just "buy exploits"; a significant component of the money in this space comes from "maintenance", so much so that I think it makes more sense to think of exploits as subscription services.)
    - ghxst 2y ago
      > so much so that I think it makes more sense to think of exploits as subscription services. I think this makes sense, especially given the uncertainty of when an exploit gets patched. To my original argument of political power vs valuations you can probably say that having those same people you'd otherwise try to influence on your board with a financial incentive allows you to achieve the same thing, I'm not sure why I didn't consider that before.
      - tptacek 2y ago
        Don't get me wrong: I'm sure there's plenty going on between NSO and Israel, and a lot of politics involved. But I also know it to be a real industry, with lots of players.

by ghxst 2y ago

I'd imagine they have a very limited market as in who they can sell their products and services to, for reasons that might make political power more interesting than valuation.

tptacek 2y ago

I don't know about that. Something I think a lot of people sleep on with this stuff is that most countries have multiple security agencies, and you generally cut deals with them individually. The market for this stuff is bigger than it looks.

ghxst 2y ago
That's probably a fair assumption too. I was mostly thinking that the customers / clients you have and services you have to offer can be largely dependent by people in positions of power where having the right connections and influence might be the key difference between a service or product being viable. For example - although not related to NSO - something like operation Trojan Shield required both Australian and Lithuanian cooperation due to fourth amendment interpretations. Having a zero day in such cases is only part of the work and everything beyond that might be very much dependant on the strings you can pull. But I can also see the argument that that would be something the government can figure out after they buy the product or service, so maybe I'm wrong on that and it's less important than I thought.
- tptacek 2y ago
  My mental model of how this works --- and I have some (imperfect) evidence for it --- is that a given one of these firms (NSO or one of its competitors) has an addressable market of N countries each with an average of K security agencies, and basically all of those agencies pay subscription fees to be continuously in a position to do a CNE operation when they want to. (Generally, I don't think countries just "buy exploits"; a significant component of the money in this space comes from "maintenance", so much so that I think it makes more sense to think of exploits as subscription services.)
  - ghxst 2y ago
    > so much so that I think it makes more sense to think of exploits as subscription services. I think this makes sense, especially given the uncertainty of when an exploit gets patched. To my original argument of political power vs valuations you can probably say that having those same people you'd otherwise try to influence on your board with a financial incentive allows you to achieve the same thing, I'm not sure why I didn't consider that before.
    - tptacek 2y ago
      Don't get me wrong: I'm sure there's plenty going on between NSO and Israel, and a lot of politics involved. But I also know it to be a real industry, with lots of players.