# Intrusion Tier **Entity class:** Concept or operational method **Domain:** Commercial Intrusion ## Definition The technical layer gives an operator remote access to device contents, communications, and associated context. It supplies a capability distinct from public-source analysis, purchased records, and interpersonal collection. ## Operational role Commercial intrusion supplies a technical information capability distinct from purchased records and open-source research. Products, customers, contracts, ownership, court decisions, and sanctions form the operating environment of this market. The article connects the tier with commissioned cyber service through the professional instruments governing authorized use. **Architecture connections:** [[wiki/Commercial Spyware|Commercial Spyware]] · [[wiki/Cyber Threat Intelligence|Cyber Threat Intelligence]] · [[wiki/SIGINT|SIGINT]]. ## Relationships - **article-linked mechanism or framework:** [[wiki/Device Communications and Social-Graph Access|Device Communications and Social-Graph Access]]. - **article-linked mechanism or framework:** [[wiki/Commercial Spyware|Mercenary Spyware]]. - **collection route:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]]. - **counterterrorism architecture:** [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]]. - **source article:** [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. ## Sources / Provenance - [[articles/The Coming Market for Civilian Spycraft#X. Mercenary Spyware and the Intrusion Tier|The Coming Market for Civilian Spycraft — X. Mercenary Spyware and the Intrusion Tier]] — October 2026 revision; immediate source for this entry’s place in the marketplace. - [SecurityWeek, NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million (October 2025).](https://www.securityweek.com/nso-ordered-to-stop-hacking-whatsapp-but-damages-cut-to-4-million/) - [Reuters via Yahoo News, Trump Administration Removes Three Spyware-Linked Executives from Sanctions List (December 30, 2025).](https://www.yahoo.com/news/articles/trump-administration-removes-three-spyware-233510700.html) - [Office of Senator Michael Bennet, Bennet, Warren, Colleagues Press Treasury and State to Explain Lifting of Sanctions on Three Enablers of Commercial Spyware (February 18, 2026).](https://www.bennet.senate.gov/2026/02/18/bennet-warren-colleagues-press-treasury-and-state-to-explain-lifting-of-sanctions-on-three-enablers-of-commercial-spyware-used-against-americans-journalists-and-dissidents/) ## Connected marketplace roles The source article connects this entry with [[wiki/Zero-Click Commercial Intrusion|Zero-Click Commercial Intrusion]], [[wiki/Commercial Intrusion in Domestic Enforcement|Commercial Intrusion in Domestic Enforcement]], [[wiki/Commercial Spyware|Mercenary Spyware]], [[wiki/Device Communications and Social-Graph Access|Device Communications and Social-Graph Access]], [[wiki/Spyware as Product to Cyber Effects as Service|Spyware as Product to Cyber Effects as Service]]. These routes locate the associated people, implementations, methods, and operational contexts in [[articles/The Coming Market for Civilian Spycraft|The Coming Market for Civilian Spycraft]]. **Collections:** [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]].