Spain closes Pegasus spyware probe again, saying Israel has not responded

Spain's High Court has again closed its probe into alleged use of NSO Group's Pegasus spyware against Spanish cabinet members, citing lack of cooperation from Israeli authorities and an inability to identify suspects; the probe had followed a 2022 disclosure that targets included Prime Minister Pedro Sánchez and several ministers and prompted the resignation of Spain's spy chief. Judge José Luis Calama previously closed the case in 2023, reopened it in 2024 after information from France, but has halted progress due to unanswered requests to Israel; NSO denies wrongdoing and Israel says its role is limited to export licensing. Immediate market implications are limited, but the decision underscores ongoing geopolitical, regulatory and legal risks around government spyware and export-control scrutiny.

Analysis

Market structure: Closing Spain's probe because of non-cooperation is a tail-risk reminder that offensive cyber vendors (private NSO-like firms) face episodic legal/regulatory shocks while defensive cybersecurity vendors (CrowdStrike CRWD, Palo Alto PANW, Fortinet FTNT, SentinelOne S, Zscaler ZS) capture sustained demand for protection. Expect a modest rotation of IT spend: governments and corporates will reallocate incremental budgets into endpoint detection, cloud security, and managed security services over 6–24 months; revenue re-rating for top-3 defenders could lift multiples by 5–15% if guidance revisions follow.

Risk assessment: Tail risks include an EU/US coordinated export ban or sanctions on Israeli offensive-tool vendors (probability 5–15% in 6–12 months), class-action suits against contractors, or accelerated zero-day leakage raising remediation costs across companies. Near-term (days/weeks) volatility is headline-driven and muted; medium-term (3–12 months) regulatory clarifications and defense procurement cycles matter; long-term (1–3 years) structural shift to recurring-security spend and consolidation is most likely.

Trade implications: Bias long high-quality defenders: establish 2–3% positions in CRWD and PANW each, and buy 3–6 month calls (30–50% OTM) sized at 0.5–1% notional to lever upside; add 2% in FTNT for defensive yield. Avoid outright shorts on large Israeli primes, but hedge geopolitical exposure with 1–1.5% positions in long RTX or LMT if export controls materialize; use 3–9 month put spreads on NICE (NICE) or Elbit (ESLT) rather than naked shorts to limit downside.

Contrarian angles: Markets underweight the pickup in private-to-public M&A of distressed surveillance assets — expect 1–3 opportunistic tuck‑ins by large defenders in 12–24 months, which would accelerate growth and margin expansion. Also counterintuitively, increased scrutiny can drive governments to insource capabilities into defense primes (benefiting RTX/LMT) rather than shrink budgets; watch EU/US policy announcements (30–90 days) as triggers that could re-rate both cyber defenders and select defense contractors.

Key Decisions for Investors

• Establish a 2–3% long position in CrowdStrike (CRWD) and a 2–3% long in Palo Alto Networks (PANW) within the next 2–6 weeks; buy 3–6 month call options at ~30–50% OTM sized at 0.5–1% notional each to capture upside if FY results guide higher revenue from government/corporate spend.
• Allocate 2% to Fortinet (FTNT) for defensive cash flow; use covered calls (1–2 month expiries) if stock rallies >10% to harvest premium while retaining core exposure.
• Buy 3–9 month put spreads on NICE (NICE) or Elbit Systems (ESLT) sized at 0.5–1% notional to hedge potential regulatory spillover into Israeli tech/defense; widen strike width to cap cost and limit loss.
• Overweight the cybersecurity software sector by +3% relative to benchmark for 6–18 months, funded by a -3% reduction in general tech growth small-caps (names < $5bn market cap) which are most exposed to reputational/regulatory shocks.
• If EU/US announce export-control measures on offensive cyber tools within 60 days, increase CRWD/PANW positions by +50% and add 1–2% long in defense prime RTX or LMT as a rotation into government in‑sourced capabilities.