NCSC: 80 Countries Now Have Commercial Spyware

Close-up of a smartphone screen in a dark room with reflections on glass surface — Photo via Unsplash

TL;DR: Britain's National Cyber Security Centre updated its commercial cyber proliferation assessment on April 7, 2026, confirming that at least 80 countries have purchased commercial cyber intrusion software or spyware over the last ten years. The NCSC identifies four categories of commercial hacking tools now flooding the market, from spyware-as-a-service to zero-day exploit brokers, and judges that off-the-shelf spyware "almost certainly rival[s] the equivalent capabilities of some state-linked Advanced Persistent Threat groups." The agency's own forecast: international oversight will lack consensus, be difficult to enforce, and remain subject to political and commercial influence.

80 Countries. Let That Sink In.

The UK's National Cyber Security Centre (part of GCHQ, Britain's signals intelligence agency) updated its commercial cyber proliferation assessment on April 7, 2026 ^[1]. The headline number: at least 80 countries have purchased commercial cyber intrusion software or spyware over the last ten years.

That's more than a third of the countries on Earth with the ability to read your messages, listen to your calls, access your photos, track your location, and remotely activate your camera and microphone. All through your phone. No physical access needed.

Who Gets Targeted

The NCSC's assessment focused on the documented victims: journalists, human rights activists, political dissidents, and foreign government officials. Thousands of them, hit annually by state-deployed spyware ^[1].

The 2026 update adds a new category: corporate executives and wealthy individuals are now "increasingly being attacked" ^[2].

This isn't surprising. The commercial spyware industry runs on profit. Paragon's Graphite works similarly to other commercial offerings ^[3]. When you build tools that powerful and sell them to dozens of governments, the target list inevitably widens.

The NCSC's own language is blunt: commercial spyware has been "almost certainly used by some states in the targeting of journalists, human rights activists, political dissidents" and foreign officials ^[1]. The "some states" phrasing does a lot of work there. The NCSC knows exactly which states. They just can't say.

How a $0 Click Costs You Everything

The NCSC identifies four categories of commercial hacking tools flooding the market ^[1]:

Spyware-as-a-service: Off-the-shelf phone hacking. Read messages, intercept calls, access photos, activate the camera and mic. Delivered via phishing links or zero-click exploits that require no interaction from the target at all.
Hackers-for-hire: Private groups conducting espionage, stealing intellectual property, or harvesting insider trading data. They range from script-kiddie operations to "state-actor-equivalent" sophistication.
Zero-day exploit marketplace: Governments are the dominant buyers of undisclosed software vulnerabilities. The prices are astronomical (a single iPhone zero-click chain can fetch $2.5 million) and the NCSC says state purchasing has "likely increased" over the past three years.
Tool commoditization: Customizable hacking frameworks, originally built for penetration testing, repurposed by state and non-state actors. Malware-as-a-service is expanding the number of victims "almost certainly."

The assessment's key judgment: these commercial tools "almost certainly rival the equivalent capabilities of some state-linked Advanced Persistent Threat groups" ^[1]. In plain English: off-the-shelf spyware is now as powerful as the hacking units of nation-state intelligence agencies.

The Price of Admission Keeps Falling

The NCSC flagged something that should alarm everyone: the barrier to acquiring this technology is "rapidly decreasing" ^[2].

When the Pegasus Project exposed NSO Group in 2021, commercial spyware felt like a tool reserved for deep-pocketed authoritarian regimes. Saudi Arabia. UAE. Mexico. Hungary.

Five years later, the industry didn't shrink after the scandals. It metastasized. NSO Group is still operating. Paragon Solutions sells to the US government. Intellexa's Predator spyware was sanctioned by the US Treasury, then those sanctions were lifted in March 2026 ^[4].

New companies are filling every gap. The NCSC predicts "almost certain expansion of the global commercial sector" over the next five years ^[1].

International Oversight? Don't Hold Your Breath.

The UK signed onto the Pall Mall Process, a diplomatic initiative to address commercial spyware proliferation. The US launched its own anti-spyware push at the 2023 Summit for Democracy.

The NCSC's assessment of where this is heading: "Oversight of the commercial intrusion cyber sector will almost certainly lack international consensus, be difficult to enforce and subject to political and commercial influence" ^[1].

That's the UK's own intelligence agency saying, diplomatically, that nobody is going to stop this. The commercial incentives are too large, the buyer market too dispersed, and the political will too fragmented.

The best-case scenario in the NCSC's view? Some companies might "voluntarily limit customer bases" if international norms emerge ^[1]. Voluntary. Might. If.

What You Can Do About It

You probably aren't a government target. But "probably" does more work than it used to when at least 80 governments have the tools.

Update Everything, Always

Zero-click exploits target unpatched vulnerabilities. Install iOS, Android, and app updates the day they drop. Every day you wait is a day your phone has a known unlocked door.

Enable Lockdown Mode (iPhone)

Settings → Privacy & Security → Lockdown Mode. It disables features that spyware commonly exploits: link previews in Messages, certain web technologies, inbound FaceTime from unknown numbers. Apple built this specifically for people at risk of mercenary spyware.

Reboot Your Phone Daily

Many commercial spyware variants don't survive a device restart. A daily reboot clears memory-resident infections. It's not a fix, but it raises the cost of keeping your device compromised.

Audit Linked Devices

In Signal and WhatsApp, check Settings → Linked Devices regularly. Remove anything you don't recognize. Attackers use linked device exploits to silently mirror your conversations.

The Quiet Arms Race

The NCSC assessment paints a picture of an industry that regulation can't catch. At least 80 countries have commercial cyber intrusion tools now, and the response is an updated PDF on a government website.

The commercial spyware market is a surveillance arms race where the weapons get cheaper, the buyers multiply, and the targets expand from political dissidents to anyone with a bank account worth draining or a secret worth stealing.

The UK's intelligence agency just told you that a third of the planet's governments can hack your phone. The question isn't whether you're a target. It's whether you've done anything to make yourself a harder one.