Many states enhance their surveillance capabilities by buying spyware or other digital surveillance tools from surveillance companies. While governments claim to use these to fight crime and terrorism, many have used them to target human rights defenders, activists, journalists and members of civil society in violation of their internationally recognized human rights. Given the scale of disclosures revealed in the Pegasus Project, there is an urgent need for investors to assess risk of investments in the private surveillance industry. This briefing outlines the material risks, including reputational, financial, and legal risks facing companies and investors in this sector.