Cybersecurity as an object of study in International Relations is crossed by both the strengths and limitations of the discipline. The theorisations on agency traditionally found in IR devote too much focus to humans, so that they place the relevance of non-humans in the background. This has important implications for the study of cybersecurity, which is based on a mélange of interacting humans and non-humans. This paper draws on contributions from Actor-Network Theory (ANT) and Science and Technology Studies (STS) in order to demonstrate how non-human entities can also be agents of cybersecurity. I use the follow the actors methodology to trace the associations made by Pegasus spyware, arguing that the virus should be seen as more than a tool, and can be considered an actor and agent of cybersecurity and International Politics.