The Pegasus Project revealed how spyware sold by the cybersurveillance company NSO Group to state clients has been used to target activists, journalists, lawyers, and politicians. In this briefing document, Amnesty International outlines key measures urgently needed to ensure greater regulation over the cybersurveillance industry, accountability for human rights violations and more independent oversight over this opaque industry. Given the wide-ranging impact of these revelations, we would urge the EU and its member states to draw on both their internal and foreign policy instruments to address these abuses, and ensure robust and meaningful regulation over the cybersurveillance industry.