Spain drops probe into targeting of Pedro Sanchez with Pegasus spyware

A Spanish high-court judge has provisionally shelved a long-running 2022 investigation into the use of NSO Group’s Pegasus spyware against Prime Minister Pedro Sánchez and several ministers after Israeli authorities failed to respond to five cooperation requests from May 2022–Feb 2025. Spanish investigators found Sánchez’s phone infected five times in 2020–21 with more than 2.5 GB of data exfiltrated and Defense Minister Margarita Robles’ phone accessed four times in 2021; the probe was reopened in April 2024 but blocked by Israel’s non-cooperation, which the judge said breached international obligations. The affair has political fallout at home (including the removal of Spain’s spy chief) and reputational implications for NSO, but it is unlikely to be materially market-moving in the near term.

Analysis

Market structure: The immediate commercial winners are enterprise and government-focused cybersecurity vendors (example tickers: CRWD, PANW, FTNT, S, RPD) and forensic/IR service providers that can sell compliance/audit tooling; demand tailwinds for EU government contracts could add low hundreds of millions to vendor revenues across 12–24 months. Losers are reputationally exposed offensive-surveillance suppliers (NSO, private) and any regional vendors facing export/contract curbs; sovereign clients that suffer leaks (Spain) may reallocate IT spend from legacy suppliers to vetted, auditable vendors, increasing pricing power for proven platforms.

Risk assessment: Tail risks include EU-wide bans or export controls on offensive cyber tools, class-action litigation against vendors, or diplomatic sanctions between Israel and EU—each could knock 5–20% off revenues for exposed suppliers within 6–18 months. Hidden dependencies: many commercial cyber vendors rely on government validation and certifications; a change in procurement rules (ISO/EN tiering) could shift market share quickly; catalysts include EU/France probe outcomes and any formal export-control proposals in the next 30–90 days.

Trade implications: Tactical opportunities favor overweighting large-cap, profitable cyber names and sector ETFs (HACK) while avoiding small, opaque surveillance tech firms; 3–12 month time frame for capture of procurement cycles and regulatory responses. Volatility spikes around regulatory announcements favor directional call-spreads on CRWD/PANW sized to 0.5–1% notional; consider pair trades (long CRWD, short smaller-cap Israel-exposed names) to isolate secular cybersecurity upside.

Contrarian view: Consensus treats this as reputational noise; underappreciated is accelerated procurement cycles by EU ministries of defense/internal security—if even 1–2 large EU contracts (~$50–200m each) reallocate to mainstream vendors, multiples could re-rate by 10–25% over 12–18 months. Conversely, political entanglement could produce short, sharp drawdowns in Israel-exposed equities, creating opportunistic entry points for long cyber replacements.

Key Decisions for Investors

• Establish a 2–3% portfolio long position split 60/40 in CrowdStrike (CRWD) and Palo Alto Networks (PANW), horizon 6–18 months, target +20–30% upside; set a hard stop-loss at 12% and scale in on any >8% intraday dips.
• Allocate 0.5–1% notional to HACK (ETFMG Prime Cyber Security ETF) as broad EU government procurement hedge; trim if EU issues formal export-control legislation within 90 days.
• Buy 3–6 month call spreads on CRWD: buy 5–10% OTM calls, sell 15–20% OTM calls sized to 0.5% notional to capture regulatory-driven upside and volatility; roll or cut if premium decays >60% or after 90 days without catalyst.
• Reduce/avoid exposure to small-cap or Israeli surveillance-tech names (avoid private NSO-related suppliers; trim any Elbit Systems (ESLT) positions by 1–2% if held) and reallocate proceeds to large-cap cyber names; reassess after monitoring EU/France probe announcements over next 30–90 days.