Paragon Spyware CEO Admits Company Cannot Detect Customer Misuse, Dropped Italy Contract Without Investigation
Paragon CEO Andrew Boyd says the spyware maker cannot technically see whom Graphite targets or what data it extracts. The firm dropped two Italian government contracts without investigating allegations involving journalists and activists, after WhatsApp reported more than 60 infections across 20+ countries.
The CEO of US spyware firm Paragon Solutions has acknowledged in an exclusive interview with WIRED, published in October 2026, that the company has no technical ability to monitor how customers use its Graphite spyware — and that it dropped its Italian government contracts not after an investigation, but simply because the relationship was no longer worth the risk.
Andrew Boyd, CEO of Paragon and its parent company REDLattice, told WIRED that Paragon cannot see who its customers target or what data they extract from compromised devices. The company can only learn of misuse if a customer admits to it or a third party exposes it. Boyd credited WhatsApp and the University of Toronto’s Citizen Lab for doing the company “a great service” when they publicly alleged misuse last year.
The admission follows a significant controversy. Shortly after Paragon — then Israeli-owned — was acquired by US equity firm AE Industrial Partners in December 2024 and merged with REDLattice, an American offensive cyber firm that has since announced plans to go public, WhatsApp alleged that Paragon’s Graphite spyware had been used to infect the phones of more than 60 individuals across more than 20 countries, including journalists and activists. Citizen Lab identified two journalists and two activists in Italy as targets. Italian authorities denied any misuse.
Despite a stated zero-tolerance policy for customer abuse, Paragon did not investigate the allegations before canceling its two contracts with Italian intelligence agencies. Boyd said the company also did not follow up with WhatsApp or Citizen Lab to obtain details about alleged abuse in other named countries.
Boyd further revealed that Paragon has no kill switch to immediately disable a customer’s access. The company can only cut off technical support and software updates — but Boyd said those updates are frequent and essential, rendering the spyware ineffective within roughly 12 hours without them.
The disclosures may raise questions about the enforceability of Paragon’s promise to prevent its tools from being used against journalists, dissidents, and other non-legitimate targets — a pledge that has been central to the company’s positioning in the commercial spyware market.