Israel’s exit strategy

Israel, and a security state that recycles its own talent

Israeli cyber power is told as one of two stories, and they rarely meet. In the first, Unit 8200 is an elite hacker factory, the military-intelligence unit widely linked to Stuxnet and a generation of prodigies, though the precise institutional hand behind that operation stays classified. In the second, an Israeli company sells an intrusion tool to a government that turns it on a journalist, and the affair becomes a scandal. One telling is admiring, the other appalled, and both point at the same place without naming what connects them.

Seen as a labour market rather than an arsenal, the two become one. What is distinctive about Israeli cyber power is not a weapon but a flow of people: technical talent selected young, trained inside military intelligence, and released in large numbers into a private industry that turns the training into products. The flow is not one-way, though, and the market is not merely downstream of the security state. It is one of the mechanisms by which the security state reproduces its own capability.

More talent than posts

The substrate is a small state with a long-standing sense of existential and asymmetric threat, compulsory service that lets the military select from a whole cohort, an intelligence establishment treated as strategic infrastructure, and a deliberate policy of technological superiority. Unit 8200 is the IDF’s principal signals-intelligence unit and central to Israel’s cyber capability, while offensive and defensive cyber responsibilities have moved between military organisations as the state has reorganised the domain over the years. The institutional history is messier than the hacker-factory image.

The mechanism that gives the unit its weight is selection at national scale. Universal conscription hands the military a population-wide pool from which to identify technical ability; the unit then gives a very young cohort unusually early responsibility over real problems; and much of that experience travels with the veterans into civilian ventures on release. The state does not merely train specialists. It returns them to the civilian economy while they are still young.

The network leaves too

The coupling is human before it is technical. The pipeline runs unit to veteran to start-up to product to regulated export, and the veterans are the mechanism: two of Check Point’s three founders came out of 8200, NSO built its research team from it, and Candiru, by Citizen Lab’s account, reportedly recruits from its ranks. A veteran does not leave with a skill alone, though. They leave with a network: former commanders and colleagues as potential co-founders, a reputation legible to other recruits, familiarity with classified problem domains, a feel for how intelligence organisations and government procurement work, and credibility with the investors who fund the next firm. The alumni network is now part of the machinery in its own right, to the point that the state’s innovation agency has backed programmes run by the 8200 alumni association to turn veterans into founders. Labour market undersells it. It is a labour market with an unusually powerful referral system, in which the worker leaves the institution but the network leaves with them.

More than spyware

Told through Pegasus alone, the ecosystem reads as a single scandal: 8200, then NSO, then an abused government. That is the loud branch, not the tree. Cyber has become one of the largest destinations for Israeli technology investment: since the start of the Gaza war, a sharply higher share of the capital raised by Israeli start-ups went to cyber companies than in earlier years, and the innovation agency’s 2025 report puts three of every five high-tech dollars into cybersecurity or enterprise software. The firms span endpoint and cloud security, identity, fraud detection, network and application security, defence technology and critical-infrastructure protection. The offensive-spyware houses, Pegasus from NSO among them, are the extreme end of that range, not the whole of it.

NSO and Candiru are not the state operating under cover. They are what happens after the capability leaves: a military-trained labour pool turned into a commercial export industry, whose products carry capabilities first developed in a national-security setting. Israeli origin does not establish Israeli control, which is the distinction the scandal keeps collapsing.

The state buys it back

The usual story stops at the gate, when the veteran walks out, and it misses half the market. Israel is not only a country that exports cyber firms. It is an unusually demanding customer for them. A state under persistent attack has reason to buy what its own ecosystem produces, and the firms gain a sophisticated domestic environment in which to test and refine it. The National Cyber Directorate now sits across the civilian economy, running incident response and defence for critical infrastructure and ordinary organisations alike; its 2025 reporting recorded more than 2,300 organisations given proactive warning of targeted attacks.

So the cycle does not run only outward. Threat produces demand, demand sustains firms, firms retain talent, and the state stays close enough to the market to buy from it and to regulate it. The war sharpened the loop into view, because capital allocation itself moved with the threat: the jump in the cyber share of start-up funding after October 2023 is a market answering a security signal, not a ministry ordering a product. Threat changes demand, demand changes investment, investment changes which companies form, and company formation changes the talent market. ## The door swings both ways

The revolving door has a return few accounts draw, and the war made it literal. The same reserve system that lets the military select can also pull the labour force back through the door: the innovation agency’s 2024 survey of technology companies found prolonged reserve mobilisation among the war’s major strains on the sector, alongside funding and hiring. The pipeline is not simply military to start-up, then. It is military to start-up to reserve to start-up, the state calling its exported talent back when it needs it and releasing it again afterwards. The scarce resource being moved is not software. It is people.

A diagram of effects for Israel's cyber ecosystem, drawn as one reinforcing loop with a single branch. State cyber investment trains talent, the trained talent builds companies and a sector, the sector draws capital and strategic weight, and that weight funds more state investment. The four edges run in the same direction, so the loop is reinforcing, marked R and read clockwise. Two of its edges are human interventions, the state's decision to train and its decision to reinvest; the other two are the flow of people into the sector and of capital toward it. Drawn in grey, meaning a sourced effect on a branch with no evidenced return: wartime reserve call-up, which pulls trained people back out of the companies. An increase in state cyber investment raises trained cyber talent, by human intervention. An increase in trained cyber talent raises cyber companies and sector. An increase in cyber companies and sector raises capital and strategic weight. An increase in capital and strategic weight raises state cyber investment, by human intervention. An increase in wartime reserve call-up lowers cyber companies and sector, by human intervention.

Reach without control

The signature, then, is a labour market, and the capability does not sit in an arsenal the state controls. It sits in a population of trained people and the companies they build, licensed but not owned. That was always the more accurate picture, and a recent episode sharpens it. In 2025, after reporting on how intercepted communications were stored and processed, Microsoft restricted some cloud services used by Unit 8200, a reminder that a military capability now runs partly on civilian, and often multinational, infrastructure. The capability is not only outside the arsenal. Some of it sits in an ecosystem the state can reach into but does not entirely control, including providers it neither owns nor can always direct.

A valve, not a wall

None of this leaves the door unregulated. The defence ministry licenses the export of defence equipment, knowledge and services as a matter of national security and foreign policy, and it tightens the rules when a scandal makes the diplomacy expensive. The export regime is not a wall around the labour market. It is a valve on the products leaving it, controlling who gets through rather than closing the way.

A chain cultivated

The evidence has a hard edge. There is strong support for every structural link, the selection, the training, the migration of people, the firms’ lineage in the unit, the export regime, and almost none for the arrow that would make this a simple story of state control: that the government wanted a given capability and a company duly built it. The firms are commercial concerns, and treating each as an arm of the state collapses the very question at issue, which is how state-made capability becomes market capability without the state issuing each instruction. Pegasus is a product, and its abuses are its buyers’. A door moves people and knowledge both ways; it does not imply a hand pushing each one through for a named purpose.

That the state cultivated the ecosystem is not in doubt. It has treated cyber as a strategic and economic sector for years, and the National Cyber Directorate invests in research, talent and industry directly. What is harder to establish is whether it designed the particular pathway, from 8200 to veteran to start-up to offensive product to foreign buyer, as a single coherent strategy, or whether that chain assembled itself and the state learned to cultivate, use and regulate it after the fact. That is the open edge, and the outside record does not close it.

There is a less flattering edge, too. If the military is the country’s premier technical sorting mechanism, then entry to the high-tech economy runs partly through military selection, and a labour market built on that selection can reproduce its biases. The innovation agency’s own programmes acknowledge how uneven high-tech participation is across Israeli society, Ethiopian Israelis among the underrepresented, which is one reason a labour market drawn from the army is less of a neutral meritocracy than the mythology around 8200 tends to suggest.

What keeps circulating

Israeli cyber power is not, in the end, an arsenal, and it is not simply an industry. It is a recycling system: the state selects and trains people, the market turns their experience into companies and products, buyers turn products into capital and reputation, and the state stays close enough to recruit from the system, buy from it, and regulate what leaves. The word the industry uses for the moment of transfer is exit, and it does more work than it looks, naming at once the person leaving the unit, the founder leaving into the market, the company leaving through acquisition, and the product leaving through export. The weapon everyone names is downstream. The capability lives in the circulation.

The exit, then, is not an escape from the security state. It is one of the ways the security state reproduces itself.