diff --git a/clusters/surveillance-vendor.json b/clusters/surveillance-vendor.json
index b6e4f34..ff058e6 100644
--- a/clusters/surveillance-vendor.json
+++ b/clusters/surveillance-vendor.json
@@ -33,15 +33,15 @@
         "official-refs": [
           "https://www.nsogroup.com/"
         ],
+        "products": [
+          "PEGASUS"
+        ],
         "refs": [
           "https://en.wikipedia.org/wiki/NSO_Group"
         ],
         "synonyms": [
           "Q-Cyber",
           "Circles"
-        ],
-        "products": [
-          "PEGASUS"
         ]
       },
       "uuid": "49d8e89f-401d-4d3d-9155-5758a346a4a1",
@@ -191,6 +191,9 @@
     {
       "description": "Cytrox’s Israeli companies were founded in 2017 as Cytrox EMEA Ltd. and Cytrox Software Ltd. Perhaps taking a page from Candiru’s corporate obfuscation playbook, both of those companies were renamed in 2019 to Balinese Ltd. and Peterbald Ltd., respectively. We also observed one entity in Hungary, Cytrox Holdings Zrt, which was also formed in 2017.",
       "meta": {
+        "products": [
+          "DevilsTongue"
+        ],
         "refs": [
           "https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/"
         ],
@@ -200,9 +203,6 @@
           "Balinese Ltd.",
           "Peterbald Ltd.",
           "Cytrox Holdings Zrt"
-        ],
-        "products": [
-          "DevilsTongue"
         ]
       },
       "uuid": "4dbfa61e-0cf5-4142-babf-3cdce348568d",
@@ -211,6 +211,9 @@
     {
       "description": "RCS Lab S.p.A., Italian vendor likely using Tykelab Srl as a front company.",
       "meta": {
+        "products": [
+          "Hermit"
+        ],
         "refs": [
           "https://www.rcslab.it/en/index.html",
           "https://www.lookout.com/blog/hermit-spyware-discovery",
@@ -218,9 +221,6 @@
         ],
         "synonyms": [
           "RCS Lab"
-        ],
-        "products": [
-          "Hermit"
         ]
       },
       "uuid": "28ed79b6-a11d-4e41-af80-ece8f0e0c2d3",
@@ -252,18 +252,18 @@
     {
       "description": "The Intellexa alliance is an evolving group of companies and brands that have been involved in developing and marketing a wide range of surveillance products including advanced spyware, mass surveillance platforms, and tactical systems for targeting and intercepting nearby devices. The corporate entities of the alliance span various jurisdictions, both within and outside the EU. The exact nature of links between these companies is shrouded in secrecy as corporate entities, and the structures between them, are constantly morphing, renaming, rebranding, and evolving.",
       "meta": {
-        "refs": [
-          "https://www.atlanticcouncil.org/wp-content/uploads/2021/11/Surveillance-Technology-at-the-Fair.pdf",
-          "https://securitylab.amnesty.org/latest/2023/10/technical-deep-dive-into-intellexa-alliance-surveillance-products/",
-          "https://www.spiegel.de/international/business/the-predator-files-european-spyware-consortium-supplied-despots-and-dictators-a-2fd8043f-c5c1-4b05-b5a6-e8f8b9949978",
-          "https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/"
-        ],
         "products": [
           "Nova",
           "Triton",
           "Helios",
           "ALIEN",
           "PREDATOR"
+        ],
+        "refs": [
+          "https://www.atlanticcouncil.org/wp-content/uploads/2021/11/Surveillance-Technology-at-the-Fair.pdf",
+          "https://securitylab.amnesty.org/latest/2023/10/technical-deep-dive-into-intellexa-alliance-surveillance-products/",
+          "https://www.spiegel.de/international/business/the-predator-files-european-spyware-consortium-supplied-despots-and-dictators-a-2fd8043f-c5c1-4b05-b5a6-e8f8b9949978",
+          "https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/"
         ]
       },
       "uuid": "1c909820-82eb-11ee-80c7-325096b39f47",