Israeli startup builds zero-click spy tools for Western intelligence agencies

Radiant Research Labs, an Israeli startup founded in May 2023 by former IDF/NSO operatives Tal Slomka (CEO) and Tzvika Moschkowitz (head of marketing), has developed roughly ten major 'zero-click' cyber tools that infiltrate devices without user interaction and focuses on building the underlying cyber tool engines rather than fielded exploit products. The firm says it works primarily with democratic partners under Israeli MoD-aligned export practices and provided technical assistance to IDF intelligence after 7 October to help locate hostages, but its activities sit amid heightened scrutiny and sanctions-led debate around firms such as NSO over misuse and export controls.

Analysis

Market structure: Offensive zero-click capability commoditizes high-end intrusion engines and shifts value upstream to specialist cyber-infrastructure providers and national integrators (Elbit ESLT, diversified cyber vendors). Expect 12–36 month revenue tailwinds for endpoint detection (CRWD, PANW, FTNT) as governments and enterprises double spend on detection/mitigation; pricing power rises for niche exploit frameworks but falls for end-user turnkey sellers as buyers demand stove‑piped, government‑approved suppliers.

Risk assessment: Primary tail risk is regulatory sanction (US/Treasury/Commerce) or export-control blacklisting of Israeli suppliers — a 5–15% probability event that would crater valuations of focal vendors and freeze exports within 3 months. Operational risk includes tool leakage/weaponization causing a major disclosure/countermeasure that forces a 6–12 month mitigation cycle and spike in demand for patches and defensive subscriptions.

Trade implications: Near-term (days–weeks) expect volatility in cyber/security equities and Israeli names; medium-term (3–12 months) favor defenders and defense contractors. Buy-side should prefer diversified exposures (HACK ETF) and targeted longs in CRWD/PANW and ESLT while using defined-cost option structures to express upside without large directional exposure.

Contrarian angles: Consensus fears of “surveillance backlash” underestimate sustained government budget increases for offensive/defensive cyber—historical parallels to post-9/11 defense re‑spend suggest 3–5 year multi‑billion dollar program flows. Overdone fears will create entry points; worst-case sanction scenarios are binary and likely to be priced into small-cap/specialty vendors rather than large-cap defenders.

Key Decisions for Investors

• Establish a 2.0–3.0% portfolio long in CrowdStrike (CRWD) and 1.0–1.5% in Elbit Systems (ESLT) split 60/40 between CRWD/ESLT; target +20–30% total return over 12 months, set stop-loss at -12% and trim 50% at +25%.
• Allocate 1.5% to HACK (ETFMG Prime Cyber Security ETF) as diversified sector exposure; hold 6–12 months and rebalance if HACK outperforms sector peers by >15% or underperforms by >10%.
• Buy a defined-cost options bullish spread on PANW: purchase 3‑month 5% OTM calls and sell 3‑month 20% OTM calls (size = 0.5–1.0% portfolio notional); exit if implied volatility rises above 80th percentile or PANW rallies >20% from entry.
• Hedge geopolitical tail risk with a 1.0% allocation to GLD (gold ETF) or 1.0% to UUP (dollar ETF) and avoid direct exposure >5% to any small-cap/Israeli cyber stock until US export-control language is clarified in the next 30–60 days (monitor Treasury/Commerce notices).