Third-party brokers are systematically routing commercial spyware (including tools reported to be linked to NSO Group and Intellexa per media sources) to buyers who would fail direct vendor due diligence or government export licensing review. Regulatory enforcement stops at the first transaction; actual deployment happens two or more intermediary steps downstream, outside visibility. Organizations face elevated supply chain and insider threat risk from spyware that may reach employees, executives, or vendors regardless of whether the organization itself is a sanctioned target.