As a demand centre, production hub and regulatory frontier, outcomes in the Indo‑Pacific will determine whether global efforts can constrain spyware proliferation — with consequences for governments, civil society and criminal networks alike.
A fragmented market and new production hubs
The landscape for commercial cyber intrusion capabilities (CCICs) has shifted from a small, bespoke ecosystem into a sprawling, fragmented industry. The number of actors producing exploits and malware tooling has expanded to include smaller firms and independent researchers, and capability production is no longer concentrated among a handful of bespoke vendors. New hubs in India have emerged alongside established third‑party suppliers in Malaysia and Singapore, positioning the region as an important node in global supply chains, brokerage and capability development. That diffusion is driven by growing demand in the region and by tighter regulation elsewhere, particularly in Europe.
How technology accelerates proliferation
Emerging technologies are lowering the barriers to entry. Advances in artificial intelligence are described as reducing the cost of exploiting vulnerabilities, while online marketplaces make malicious tools easier to distribute. Those trends blur the distinction between “state‑grade” spyware and criminal malware, expanding both the scale and accessibility of intrusion capabilities. Weak controls increase the chance that tools will be leaked, repurposed or resold — risks the source warns are already being realised by non‑state actors.
Misuse by non‑state actors and porous boundaries
The risks are not theoretical. The source documents that groups linked to Islamic State and transnational criminal networks such as Mexican cartels have used commercially available tools to support surveillance. As the CCIC market grows, the dynamics that enable such misuse — informal supply chains, opaque resale and weak end‑use monitoring — are likely to intensify. The report calls attention to non‑state proliferation as a central policy problem, arguing that governance must treat state and criminal uses as part of the same continuum rather than separate categories.
The Pall Mall Process and the 2025 Code of Practice for States
Britain and France have launched a joint effort known as the Pall Mall Process to create rules for states and the software industry. The 2025 Code of Practice for States sets out voluntary commitments across the development, export, procurement and use of CCICs. It encourages governments to establish rules for suppliers, clarify conditions for state use, strengthen oversight and provide remedies for victims, and it rests on principles of accountability, precision, oversight and transparency.
But the code’s limitations are explicit. It is non‑binding, contains no formal enforcement or monitoring mechanisms, and much of its scrutiny is carried out by civil‑society organisations on an ad hoc basis. The code relies heavily on “responsible use” — an expectation that developers, providers and users follow ethical rules, safety standards and applicable legal regimes — even as interpretations of legitimate use vary significantly across jurisdictions. Participation is also uneven: many countries in South and Southeast Asia, where demand is rising, are not yet part of the process, and the source notes that the issue has not been fully contextualised regionally.
There are early signs of operational planning. Discussions are reportedly under way to establish working groups focused on implementation, threat research and impact assessment, and the next phase is turning to industry to develop guidelines on due diligence, vendor vetting and redress mechanisms, expected to culminate in a set of industry guidelines in 2026.
What this means for policymakers, vendors, and non‑state actors
- Policymakers and regulators: They will be pressed to translate voluntary principles into practical tools — procurement standards, licensing frameworks and technical expertise — and to create independent oversight capable of monitoring CCIC use and end‑use.
- Vendors and suppliers (including new hubs in India, Malaysia and Singapore): Firms will face growing pressure to adopt industry due diligence and vendor‑vetting practices as the Pall Mall Process and its 2026 industry guidelines push private‑sector responsibilities to the fore.
- Non‑state actors (terrorist groups and transnational criminal networks): The market’s diffusion, aided by AI and online distribution, increases access to intrusion capabilities already documented as supporting groups linked to Islamic State and Mexican cartels.
A narrow window for regional ownership
The source concludes that governance will succeed only if it engages the realities of the Indo‑Pacific: new vendors, informal supply chains and rising demand. It argues for regional ownership — local actors who can translate global principles into domestic practice — and for capacity‑building that moves beyond high‑level commitments to practical procurement and oversight mechanisms. Without stronger, locally grounded approaches, the spread of CCICs in the Indo‑Pacific will continue to accelerate, testing the limits of voluntary codes and civil‑society scrutiny alike. The immediate watchpoints are the working groups under the Pall Mall Process and the expected 2026 industry guidelines: those deliverables will show whether the rhetoric of accountability can be turned into enforceable practice in a fast‑moving market.
