Fully Patched Is Not Out of Reach of a Surveillance Vendor

“Our executives’ phones are fully patched and enrolled, so mercenary spyware is not our problem.”

Stop there, before that sentence goes into the board risk summary as a closed item.

Fully patched is not out of reach of a surveillance vendor.

Patching is a control over known flaws.

It retires every exploit chain whose bugs the update fixes.

That is a large and real property, and you should keep buying it.

It says nothing about a chain nobody has reported.

And a commercial surveillance vendor exists to sell exactly that chain.

Its product is aimed at the current release, not the last one.

Its customer is a government.

Its target is whoever that government picks.

So patch status answers one question: does a known chain still work on this phone?

The question in your board summary is different: could a chain in use today reach a person someone has chosen?

Those are two questions with one green dashboard between them.

Google’s Threat Intelligence Group, reviewing in-the-wild zero-day exploitation in 2025, found that commercial surveillance vendors accounted for more zero-days than traditional state-sponsored espionage groups.

For the first time in the years GTIG has tracked the split.

Serious exploit development is no longer mainly an intelligence-service activity.

It is a commercial industry with several government customers.

That share is dated evidence.

The business model behind it is not.

1. “But We Install Every iOS Update the Day It Ships.”

Good. Keep doing it.

Now look at what the vendor was building while you did.

Citizen Lab captured and analyzed FORCEDENTRY in 2021.

It was an integer-overflow vulnerability in Apple’s CoreGraphics library, CVE-2021-30860.

It arrived as a PDF disguised with a .gif extension, delivered over iMessage.

The target did nothing.

The PWNYOURHOME and FINDMYPWN chains followed in 2022.

All three are documented NSO Group output aimed at zero-click compromise of fully patched, current-model iPhones.

Not stragglers on last year’s release.

Current phones, current software.

Day-one patching did not defeat those chains while they were unknown.

It defeated each of them once it was known.

That is the whole mechanism, and it is worth stating slowly.

A zero-click chain works until somebody detects it.

Then a lab analyzes it and publishes.

Then the platform vendor ships a fix.

From that point it only works against devices that have not installed the fix.

The chain is burned the moment it is published and patched.

So the vendor’s core product has a use-until-detected shelf life, not the multi-year revenue tail of ordinary licensed software.

Every burned chain means a fresh, unpatched flaw has to be found in a widely deployed OS.

That is why the vendor keeps a development capability rather than buying one bug.

Reliability is part of that capability.

A memory-corruption exploit succeeds or fails depending on heap layout, allocator behaviour and timing, which vary between runs and between configurations.

Engineering it to work reliably is a separate task from getting the bug to trigger at all.

A zero-click chain that must work on phones its developer has never seen is that engineering done well.

Only a standing, well-resourced development team sustains it chain after chain.

Your update policy shortens how long a burned chain stays useful against you.

It cannot shorten the life of a chain nobody has burned yet.

Public competitions make the same point in daylight.

Pwn2Own pays researchers to exploit current, patched, default-configuration software, live, on a clock.

Pwn2Own Berlin 2025 paid $1,078,750 across 28 purchased zero-days.

Twenty-eight.

Against software that was fully patched when the contest opened.

At Pwn2Own Berlin 2026, Cheng-Da Tsai of DEVCORE earned $200,000 for a Microsoft Exchange compromise.

He chained three separate bugs into remote code execution as SYSTEM.

Hardened, patched targets increasingly demand chains, not single bugs.

Chains are built by people who do this as a job.

The contestants disclose theirs: vendors get full detail and 90 days to patch before public disclosure.

A surveillance vendor discloses nothing.

Its chain stays unpatched until somebody else catches it.

That is the difference between a researcher and a supplier, and it is the difference your patch policy cannot see.

2. “But the Phones Are Enrolled in MDM.”

Enrollment is a management relationship.

It lets you set and observe device policy: OS version, configuration, passcode, managed apps.

It is how you enforce the update clock in objection one.

It is not a detector of a chain aimed at the version you enforced.

Walk through what a compliance check sees on a phone running a zero-click chain against the current release.

A current OS. Tick.

The required configuration. Tick.

A managed profile. Tick.

The phone is compliant precisely because the chain was built for compliant phones.

Nothing in that posture report asks whether an image parser was just handed a crafted file.

Look at the price, too.

Microsoft prices standalone Intune Plan 2 at $4.00 per user per month, paid yearly.

Most organizations get baseline Intune inside Microsoft 365 E3 at $39.00 or E5 at $60.00 per user per month.

That is priced as fleet policy management.

It is a sensible thing to buy.

It was never sold as exploit-chain detection, and the vendor on the other side is not spending at that scale.

3. “But App Review Keeps Malicious Apps off the Device.”

App review is a pre-install gate.

It looks at apps a developer submits.

Apple funds it largely inside a transaction-commission business: 30% of in-app revenue, 15% under the Small Business Program for developers earning under $1 million a year.

Review protects the channel apps come through.

The documented chains did not come through that channel.

FORCEDENTRY came over iMessage as a disguised PDF.

The Samsung chain in GTIG’s 2025 data came as a “1-click” WhatsApp image.

Neither was an app.

Neither went through review.

Both reached system code that parses content arriving from outside.

App review answers whether a submitted app is acceptable. It does not answer whether the phone’s own image-handling code can be exploited by a message.

That is not a failure of review.

It is a different object.

4. “But Spyware Vendors Only Sell to Governments.”

Correct, as far as the buyers go.

Pegasus is not sold per copy.

It is sold as a government contract.

Estonia made a reported $30 million down payment for access in 2018.

Uganda’s 2019 deal was reported between $10 million and $20 million.

Mexico’s cumulative Pegasus-related spending had passed $60 million by 2023.

NSO Group reported $243 million in revenue and $99 million in operating income for 2020.

A client base of national governments.

Now read the objection again, because it answers the wrong question.

It tells you who pays.

It does not tell you who is targeted.

The 2019 WhatsApp attack at the centre of Meta’s lawsuit targeted roughly 1,400 users across 20 countries.

More than 100 of them were human-rights defenders, journalists and other members of civil society.

None of them were governments.

The buyer is a government. The target is whoever the buyer chooses.

Whether one of your people is a plausible choice is a question about their role, their counterparties and their travel.

It is not settled by the vendor’s customer list.

And certainly not by your patch report.

5. “But NSO Group Was Sanctioned and Lost in Court.”

Both partly true.

Neither is a control on your phones.

The US Commerce Department added NSO Group to its Entity List in November 2021.

That effectively bars US companies from supplying it with technology.

It is an export-control restriction on a supply chain, not a shutdown order.

It constrained the company.

It did not stop it operating.

The litigation is more instructive, and it is still moving.

Meta sued NSO Group in October 2019 under the US Computer Fraud and Abuse Act.

A US federal judge found NSO liable in December 2024.

A jury awarded $168 million in May 2025.

The judge later cut that to about $4 million.

A permanent injunction barring NSO from targeting WhatsApp users followed in October 2025.

By June 2026, Meta was alleging NSO had violated it, through spear-phishing attempts against users in Jordan and Lebanon.

Apple sued in November 2021 over FORCEDENTRY.

It dropped the case in September 2024, with no public liability finding.

Two platform vendors, one defendant, two different endings.

And on Meta’s allegation, the favourable ending did not stop the conduct.

Sanctions and judgments are dated evidence about a vendor’s legal position.

They are not evidence that a chain in use today has stopped working.

6. “But a Zero-Click Chain Costs Millions, and Nobody Would Spend That on Us.”

Look at who spends it and how.

The government buys a contract, not a single intrusion.

Estonia’s $30 million was a down payment for access.

The development cost is the vendor’s R&D, and the vendor serves several government customers.

The 2019 WhatsApp campaign reached about 1,400 users.

How much that capability cost per target nobody has published, and dividing an unrelated contract by that campaign would be a made-up number.

The point is structural.

The marginal decision is the customer’s choice of target, not a fresh multi-million-dollar purchase for your executive.

Chain economics also cut in your favour, and this is where patching earns its keep.

GTIG’s 2025 review of a SonicWall SMA 1000 compromise shows the order attackers prefer.

Initial access used an already-known, patched authentication bypass, CVE-2025-23006, plus a known Java deserialization flaw.

The one genuine zero-day, CVE-2025-40602, a local privilege escalation, was saved for the last step.

Known bugs are cheap and disposable.

A zero-day is scarce, spent only where nothing else closes the gap.

A patched device forces the attacker to spend more of the scarce kind.

An unpatched one lets them use the cheap kind.

Mitigations do the same work.

The Samsung chain in the same dataset used three related memory-corruption CVEs in the Quram image-parsing library: CVE-2025-21042, CVE-2025-21043 and CVE-2025-43300.

It was exploitable because that library shipped without pointer-authentication or branch-target mitigations enabled.

Comparatively ordinary memory-corruption bugs reached full compromise without the extra bypass steps a hardened component would have forced.

Missing mitigations made the chain cheaper.

Enabled mitigations make the next one dearer.

Speed matters after a chain is burned, too.

A published fix is also a map to the flaw.

In Anthropic’s 2026 testing of patch-diff-to-exploit conversion, a model produced a working code-execution exploit for one Firefox vulnerability in under an hour.

All eight of its successful Firefox exploits were built within about 12 hours in total.

The closed-source Windows kernel cases in the same study took substantially more effort.

Once a fix ships, the window for an unpatched phone is measured in hours, not a monthly maintenance cycle.

7. No, This Does Not Mean Patching Is Pointless.

It is not.

Patching retires each chain once it is known.

It forces a vendor to spend zero-days rather than cheap known bugs.

It is the single control in this piece that actually ends a chain’s life on your devices.

Nor does it mean every organization’s phones are spyware targets.

These chains are scarce, expensive and aimed at chosen people.

Most of your workforce is not on anybody’s list, and treating every phone as compromised would waste the effort the few exposed people need.

The correction is narrower.

Patch status answers the known-chain question, not the chosen-person question.

Put both questions in the risk summary.

Answer them separately.

8. What You Should Actually Do

Identify the people whose role makes them plausible mercenary-spyware targets. Give that group a separate device-risk profile rather than the fleet default.

The fleet profile is built for the median employee.

This group is not the median.

Apply emergency mobile OS updates on a same-day clock for that group. Not the fleet’s staged rollout.

A burned chain stays useful against you exactly as long as the fix sits uninstalled.

Route suspected compromise to a partner able to analyse exploit chains. A routine reimage clears the phone and answers nothing about the chain.

Report findings so the chain is burned. A chain dies when it is published and patched.

Your report can be the start of that, for everyone.

Prefer devices and components that ship with exploit mitigations enabled, including pointer authentication and branch-target protection.

Ask about mitigation coverage in the image, media and message-parsing components, not just the OS version.

Do not count vendor sanctions or court outcomes as a control. Record them as dated context.

They do not change what a chain in use today can do.

9. The Model Is Not Complicated.

Patch management answers: which known, fixed flaws can no longer reach this device?

Device management answers: does this device meet the policy we set?

Threat modelling answers: who might a government customer choose, and what would that person’s phone face?

The vendor’s answer to the first two is already built into its product.

It develops against the current release.

It targets compliant phones.

A vendor that maintains exploit development as a product will aim it at the current patch level, so patch status bounds only known chains.

Contract prices, litigation status and zero-day attribution shares are dated evidence.

That structure will outlast all of them.

Patch on the day.

Enforce it through MDM.

Keep app review doing its job.

Then find the handful of people for whom none of that is the whole answer, and give them the rest.