- Audience 1st
- Posts
- Why Malware Researchers Are More Than Just Analysts: Recognizing Their Strategic Role in Cybersecurity
Why Malware Researchers Are More Than Just Analysts: Recognizing Their Strategic Role in Cybersecurity
The reality of malware research—the intense mental fortitude, the relentless strategic thinking—is often far less romantic and far more essential than we give it credit for. Here’s why.
Dani Woolf
21 Nov • Read Time: 17 minutes
This episode is presented together with
We love to glamorize the adversary-chasing, midnight-oil-burning cybersecurity lifestyle.
I’ll admit, even I do it sometimes.
But the reality of malware research—the intense mental fortitude, the relentless strategic thinking—is often far less romantic and far more essential than we give it credit for.
Malware researchers aren’t just fighting sophisticated adversaries.
They’re engaged in a high-stakes, invisible chess game where each move reveals a little more of a hidden enemy.
The most significant challenge, however, isn’t the malware itself.
It’s likely the disconnect between the critical work of these researchers and the perception—and support—they receive from leadership.
That gap isn’t just unfortunate; it’s a vulnerability that leaves companies exposed in ways many don’t even realize.
Despite its impact, malware research remains one of the most misunderstood and demanding roles in cybersecurity.
In this episode, I spoke with Michael Gorelik, CTO of Morphisec, and his insights offered a rare glimpse into a job that’s less about reacting to the latest threats and more about building a proactive defense—a foundation that keeps companies several steps ahead.
From firefighting immediate threats to pioneering innovative defense strategies, Michael’s work underscores the essential, often-overlooked nature of malware research.
If you’re in cybersecurity, leadership, or simply curious about what it truly takes to protect an organization, Michael’s journey reveals what most people never see: the hidden world of malware research and the urgent need for organizations to understand and value it.
Let’s go.
Before we dive in, don’t forget to subscribe to join 1700+ cybersecurity marketers and sales pros mastering customer research. You’ll get notified whenever a new episode and buyer insights summary drops.
The Role of a Malware Researcher
When we think of malware research, we tend to view it as purely technical.
But talking to Michael completely shatters that perception.
For him, malware research goes way beyond identifying threats—it’s the connective tissue holding an organization’s security, product, and even brand reputation together.
He’s not just a security expert; he’s a linchpin across multiple functions.
Whether it’s supporting product development, guiding marketing on threat intel, or jumping into incident response, his work touches every corner of the business.
"A lot of times, it’s underestimated—their work is underappreciated and not really seen as the backbone for a lot of things. It’s not only marketing, it’s not only protection, it’s not only product development. It’s saving your customers and providing additional revenue... and somehow it’s underappreciated."
The role of the malware researcher isn’t just about technical defense; it’s about strategic value.
When malware researchers identify new threats, it’s not only an exercise in technical prowess but also an act of preserving trust.
Every insight they gather can help shape a security product, refine marketing messages, and even drive customer loyalty.
When customers understand the depth of protection behind a product, they’re more likely to see it as essential.
Their expertise also directly contributes to brand credibility and revenue protection—an overlooked fact that executive teams need to understand.
For GTM teams, leveraging the value of malware researchers can make for powerful, trust-building messaging that resonates with clients who value a proactive approach to cybersecurity.
Career Path and Motivation—Curiosity Fuels the Journey
Michael’s journey in cybersecurity is defined by one main driver: curiosity.
It’s not just a job for him; it’s a personal quest to understand, break down, and solve complex problems.
From building his expertise in cybersecurity labs to leading teams at Morphisec, he thrives on diving into the unknown and pushing boundaries.
And it’s not just him—he believes that curiosity is a fundamental trait for anyone entering malware research.
"I was the one writing the drivers, writing the product, doing the first supply chain detection...it’s all about that curiosity and finding joy in understanding what’s out there."
In an industry where threats evolve constantly, technical skills alone won’t cut it.
Hiring for innate curiosity and resilience builds a team that can keep up with and even anticipate new types of attacks.
For cybersecurity leaders, this is a reminder that fostering curiosity within your teams can be just as valuable as investing in training or certifications.
And for GTM teams, emphasizing the unique expertise and dedication behind a product can help build trust with customers who may not understand the technical details but can appreciate the human drive behind it.
Creativity as a Core Competency in Malware Research
Creativity and malware research might not seem like natural partners, but for Michael, they’re inseparable.
As cyber threats evolve and become more sophisticated, so must the approaches to counter them.
His team uses AI and generative tools to think outside the box, reverse-engineering malware faster, and finding innovative ways to spot emerging threats.
"Creativity, wow, so much creativity...My guys adapted to [AI] very quickly, using it to reverse different malware, Python codes, etc. We definitely leverage that to improve our times."
This level of creativity gives companies a competitive edge in security, but it also sends a powerful message to customers and stakeholders: we’re not just reactive; we’re proactive.
When GTM teams talk about their cybersecurity product, they can lean into this creativity angle, emphasizing that their approach is forward-thinking.
For internal teams, encouraging creative problem-solving can lead to breakthrough solutions and drive a culture that values innovation over routine.
Key Takeaways:
Patches often don't address vulnerabilities completely, sometimes creating new issues instead.
Custom forms in Outlook can be exploited for remote code execution (RCE) through form injection.
Synchronizing forms using Microsoft Exchange can expose systems to vulnerabilities due to complex configurations.
Recall message forms can be manipulated to execute malicious actions in a target environment.
Vulnerabilities in hyperlinks can be exploited by turning them into composite monikers, leading to NTLM leaks and RCE.
Balancing Immediate Threats and Long-Term Research
Michael’s world is a constant balancing act.
On the one hand, he’s handling urgent, immediate threats like ransomware attacks that demand quick action.
On the other, he’s conducting long-term research that could lead to future defenses.
This juggling requires his team to constantly adapt and prioritize, a skill not everyone recognizes or appreciates.
"The day starts with...analyzing customer incidents...then the week goes by and you have a ransomware all hands on deck...you have to prioritize a lot and reprioritize everything."
The ability to pivot between immediate response and deep analysis is essential, but it’s also taxing.
For organizations, this insight is a reminder to build flexibility into their cybersecurity resources and avoid a reactive-only approach.
For GTM teams, the agility of malware researchers is a point worth emphasizing to customers.
Showcasing the adaptability of the security team behind a product can build confidence in its reliability, especially for clients wary of new and evolving threats.
Ethical Dilemmas in Malware Research
Malware researchers face ethical gray areas daily.
Different countries have different regulations, which means the rules for handling threats and taking proactive measures can vary.
For example, researchers in Israel might have more latitude in countering threats than those in the United States, where regulations can be stricter.
"Ethical questions...come almost on a daily basis. And it changes between the country you are in. In Israel, the line can be a bit blurred...in the U.S., you have more restrictions on what you can do actively with regard to adversaries."
For companies and their security teams, this is a reminder that ethics are integral to security work, not just an afterthought, not just for reputation but also for legality.
Addressing ethical concerns upfront with customers can enhance trust, making the security offering more transparent and reassuring for those who prioritize data integrity and privacy.
GTM teams can highlight these ethical considerations as part of the value proposition, reinforcing that their approach to cybersecurity respects both technical and moral boundaries.
Communicating Malware Research Findings to Leadership
The work that malware researchers do is complex, and often leadership doesn’t fully understand it.
One of the biggest challenges is ensuring that malware research findings aren’t just noticed, but valued.
Transparent, consistent communication with executives helps highlight the impact of his work across functions.
"It’s underestimated...and it’s important to transparently share that information with executives, with the C-levels, even the board."
The gap between technical teams and leadership isn’t just a frustration—it’s a potential risk.
When executives don’t fully grasp the importance of malware research, it becomes easier to underfund these efforts, ultimately exposing the organization.
For GTM teams, this insight can drive messaging around the value of advanced malware protection to prospective clients.
For cybersecurity leaders, building structured communication channels to keep leadership in the loop can secure ongoing support and resources, ensuring that the team can operate effectively.
Key Takeaways:
Companies eagerly await Patch Tuesday updates for security fixes but realize these may not be comprehensive due to vendor urgency and brief disclosure periods.
Over time, techniques to bypass denial lists have evolved, demonstrating how attackers adapt to security patches.
NTLM vulnerabilities remain challenging to mitigate, leading to numerous moderate-severity reports due to the protocol's wide use.
Enabling specific flags to enforce validation and thwart malicious execution is critical for security.
Continuous collaboration with the researcher community and vendors like Microsoft is vital to improve security and address identified vulnerabilities promptly.
The Emotional and Physical Toll of Malware Research
Malware research isn’t just mentally exhausting—it’s physically and emotionally draining too.
The pressure of being “on” 24/7, especially when dealing with incidents that can hit at any time, takes a serious toll.
Michael often finds himself working through weekends and late nights, and it’s easy to see how burnout can become a risk in this line of work.
"The best thing you can do is come to them [the clients] and say, ‘Hey guys, I know. I saw that before. You’ll be fine. We know what we do.’ And within minutes, you become their best friend…but for us, it’s exhausting."
Companies must create support structures to help researchers manage workloads and recover between incidents.
For leaders, this insight underscores the need for support structures that allow researchers to recuperate and manage workloads sustainably.
For GTM teams, humanizing cybersecurity offerings by showcasing the dedication and resilience of their customer support teams can foster empathy and build trust with customers who may not grasp the personal sacrifices behind the work.
Routine as Both a Strength and a Weakness
Routine can be a double-edged sword in malware research.
It builds efficiency, allowing researchers to quickly respond to incidents.
But too much routine can lead to complacency, a risk Michael knows all too well.
He actively seeks to break the routine, injecting variety to keep his team’s perspectives fresh.
"Routine is good until it becomes bad. It’s important to break routine... At one point, we even started vulnerability research just to do something different."
Routine keeps day-to-day operations running smoothly, but introducing variety, such as new projects or research areas, can reinvigorate teams and keep them motivated.
For GTM teams, this insight is a valuable narrative for prospective clients.
By showing that the team isn’t just working on autopilot but is constantly innovating and adapting, companies can build customer confidence in their product’s resilience and relevance.
Adversaries Are as Sophisticated—and Organized—as Any Business
Cyber adversaries aren’t just random hackers; they’re highly organized, often working in specialized teams.
From initial access brokers to lateral movement experts, they operate like well-oiled machines, with each member playing a specific role.
"You have expertise everywhere. It’s not one player. At every stage of the ransomware operation, you have experts targeting your organization."
Cybersecurity teams need to be just as organized and specialized to match the sophistication of these threats and adversaries.
GTM teams can use this insight to educate customers on why a layered, multi-faceted approach is necessary—simple defenses won’t cut it against such organized adversaries.
For executives, this insight serves as a wake-up call to allocate resources and structure teams to address each phase of a ransomware attack systematically.
The Importance of Incident Response Preparedness
Michael stresses the importance of a comprehensive incident response (IR) plan.
From initial containment to final communication, a solid IR strategy ensures that teams aren’t scrambling when an incident hits.
This isn’t just about stopping the threat; it’s about knowing how to manage the aftermath and continue business as usual.
"We have IR plans...You need to know who to approach, whom to negotiate with, who’s responsible for the release to the media, and all those things."
Security doesn’t end with the threat neutralized. Companies need to think about the entire life cycle of an incident, from initial detection to final communication.
GTM teams can position their products as comprehensive solutions that don’t just react but provide ongoing support and guidance through the aftermath.
For cybersecurity leaders, investing in IR readiness, including regular scenario-based training, ensures teams can act with clarity under pressure, which can be a differentiator in moments of crisis.
The Emerging Role of AI and Automation in Malware Research
AI and automation have become indispensable tools in Michael’s team.
By speeding up analysis and identifying patterns, AI doesn’t replace researchers but augments their abilities, allowing them to tackle increasingly sophisticated threats more effectively.
"We’re using AI tools like ChatGPT to reverse different malware... It’s a productivity tool for us, helping us speed up analysis and identify patterns faster.”
AI in cybersecurity isn’t just about replacing human effort—it’s about enhancing it.
For cybersecurity teams, leveraging AI tools helps them stay competitive against adversaries who are also embracing automation.
For GTM teams, this is an opportunity to demonstrate how their products integrate AI in meaningful ways, positioning themselves as forward-thinking and equipped to handle future challenges.
Clients are increasingly interested in solutions that incorporate AI, and highlighting its application can make a solution more appealing.
Malware Researchers as the Bridge Between Tech and Business
Malware researchers often act as the bridge between the technical and business sides of the organization.
They need to understand both the intricacies of malware and the broader impact of their work on customers and revenue.
It’s this dual perspective that positions them as essential advocates for cybersecurity at the executive level.
"When I’m meeting customers, closing deals, or attending conferences, it’s all about understanding the real problems...It’s this kind of connection that lets me see the strategic side of my work."
For cybersecurity teams, recognizing the business implications of their work can lead to more strategic decision-making.
GTM teams can showcase this as an added value for clients: the security solution isn’t just technically robust but also strategically aligned with business priorities.
For executives, understanding the broader perspective of malware researchers can lead to more informed decisions about security investments, recognizing it as a driver of both security and business growth.
Morphisec’s Strategic Role in Malware Research and Proactive Defense
Morphisec’s approach to cybersecurity goes hand-in-hand with the strategic and often underappreciated role of malware researchers.
At its core, Morphisec integrates the expertise of their researchers to shape its solutions, turning complex threat analysis into proactive defense.
Malware researchers at Morphisec aren’t simply reacting to attacks as they come; they’re continually studying, anticipating, and designing methods to neutralize threats before they reach the organization to help their customers at the highest level.
A prime example of this proactive approach is Morphisec’s Automated Moving Target Defense (AMTD) technology.
Instead of waiting for a malware threat to emerge, AMTD creates a dynamic, constantly shifting attack surface that disrupts malware attempts to find and exploit vulnerabilities.
By morphing the attack surface in real time, Morphisec effectively prevents threats from gaining a foothold, protecting critical systems before any damage can be done.
This is more than just a defense mechanism—it’s a preemptive security solution that relies on the insights and foresight of their malware research team—the strategists whose work impacts every layer of cybersecurity, from product innovation to customer trust.
About Morphisec
Morphisec’s Anti-Ransomware Assurance Suite provides distinct layers of protection to preemptively reduce the organization’s exposure, and proactively prevent attacks at multiple phases, from early infiltration attempts to protecting critical system resources and data when ransomware attempts to execute.
Powered by Automated Moving Target Defense (AMTD), this streamlined solution effortlessly integrates with your current endpoint protection array, enhancing existing protection capabilities or standing strong independently when necessary.
Until next time,
Dani
Subscribe to Audience 1st Podcast Newsletter
Thanks for reading! If you like summaries like this, subscribe to Audience 1st Podcast Newsletter to get notified whenever a new episode drops.
Excited to collaborate? Let’s make it happen!
Check out our sponsorship details to connect with real security practitioners and showcase your brand to an engaged community of cybersecurity decision-makers giving and seeking real buyer insights.
Reply