Dataflow Security: Italian exploit firm with Israeli intelligence executives
Dataflow Security, founded in 2019 in Italy by Luca Todesco, develops exploits for computers and smartphones and posted nearly 63 million euros in revenue over three years. Since 31 December 2025 former Mossad official Eyal Tsir Cohen has run its two Israeli subsidiaries.
Founding and Israel desk
Dataflow Security was founded in 2019 in Bassano del Grappa, Italy, by Luca Todesco, then 22. It develops exploits for computers and smartphones. Buyers include governments, intelligence agencies, and spyware vendors.
From 31 December 2025, former senior Mossad official Eyal Tsir Cohen has directed the two Israeli companies Dataflow controls: DF Security Israel Ltd and Random Research Ltd. In 2025 Israeli Prime Minister Benjamin Netanyahu listed Cohen among candidates to head Shin Bet, the domestic security service.
IrpiMedia reported that the firm holds an important place in Israel's offensive cyber industry. Staff include veterans of Israeli military and intelligence units and former NSO Group employees.
Over three years Dataflow recorded nearly 63 million euros in revenue, most of it from counterparties outside the European Union.
Headquarters occupy an unmarked building in Bassano del Grappa's historic center, near the Brenta river. A small paper by the doorbell names the company.
It has five foreign subsidiaries: two in Israel, one in Spain, two in the United States. About 63 percent of three-year revenue came from outside the EU. Italy accounted for 11 percent.
Named advisers include Rob Bertholee, former head of the Dutch intelligence service; Ralph Goff, a CIA veteran; and Robin Louise Fontes, former deputy commander for operations at U.S. Army Cyber Command.
On 20 April 2026, U.S. contractor Parsons Government Services awarded Dataflow a $122,500 software subcontract on a U.S. Air Force-funded research project.
On paper the Italian company started with 2,500 euros of capital and Todesco as sole shareholder. The investigation found an Italy-Israel link from early in the firm's life.
Todesco
Todesco, known online as qwertyoruiop, works on software bugs and exploit code, with a focus on Apple products.
In 2016 he posted a video on Twitter, now X, showing unauthorized software on a then-current iPhone. In 2017 Forbes listed the then-19-year-old on its Europe 30 Under 30 ranking as one of the best-known iPhone hackers.
Documents obtained by IrpiMedia show he was a director of four software and consulting firms in Timisoara, Romania, that together posted about 6.32 million euros in net profit from 2017 to 2022.
He told the PoC 2024 conference in Seoul that Dataflow was formed when Apple work required a team.
Shareholders and NSO alumni
Eleven months after founding, Israeli investor Ofer Cohen, no relation to Eyal Tsir Cohen, acquired 22.62 percent and remains the second-largest shareholder after Todesco. Ofer Cohen lists service in Mamram, the IDF unit for IT and communications, then serial cyber entrepreneurship. Dataflow's website dates the company to 2020 rather than 2019.
On Sam.gov he is listed as contact and managing partner of Dataflow Security US. In 2023 he established DF Security Israel and Random Research in Herzliya.
Company records show a split: Random Research has two shareholders who are not in DF Security's ownership. One is Ofer Cohen, who holds a personal stake in addition to the Italian parent. The other appeared weeks after Tsir Cohen's director appointment, behind trustee Sagi Ra'anan, a partner at Herzog Fox & Neeman who works on national security, export controls, defense trade, and international sanctions.
Minority shareholders include Bar Avraham Matityahu, who lists more than six years in Unit 8200, and Itay Rotem, who says he was a developer in that unit.
At least six former NSO Group employees now work at Dataflow, including Korin Shapira Sharir, who did branding for both companies, and Itzik Kauffman, who after three and a half years at NSO leads a Dataflow research and development team.
An Israel-based industry source told IrpiMedia that Dataflow is part of Israel's offensive cyber research apparatus and works alongside official bodies. The source said Dataflow focuses on the attack component of surveillance platforms rather than a full ready-to-use suite, which sets it apart from better-known platform vendors.
Allowlists and Italian export licenses
People familiar with the company said it presents itself as an ethical supplier and that its ambition is to become "the new NSO." Until three months before the report, Todesco ran a Mastodon account that mocked NSO Group. In February 2025, after Paragon ended its relationship with the Italian government following findings on journalists' and activists' phones, he wrote that industry should respond to abuse that way. In 2024 he said the firm had long operated on a strict allowlist and was removing almost all private companies from its customer list. Those statements were not independently verified.
Italy's Uama issues export licenses for cyber-intrusion technology. Italy no longer grants new licenses to export that technology to Israel. Uama has not said whether already issued licenses remain usable, suspended, revoked, or limited. Italy publishes some destination, category, value, and company data for conventional arms. It does not publish matching figures for cyber-surveillance products. Only EU-level aggregates are available.