Tomer Agayev leads a security team that keeps our hard-earned savings safe from fraudsters.

As threat research team lead at IBM Trusteer, Tomer guards the gateway to threats both known and unknown. His team’s responsibility is to monitor new and emerging threats, understand them intimately, and feed information to the cybersecurity protection content development teams so they know how to best defend against financial fraud.

The products developed by Tomer’s Trusteer colleagues are deployed by the world’s biggest financial institutions to protect their clients against malware, phishing, social engineering and more, and their success is largely thanks to Tomer’s penchant for figuring out what makes threat actors tick.

The World of Security Is ‘Pretty Amazing’

Tomer previously served in the Israeli Defense Forces and spent his last year of service as a system administrator and IT team leader. So when he entered the civilian workforce, information security was an obvious first port of call.

Tomer joined Trusteer in March 2013 as a help desk representative, but it wasn’t long before he felt he needed a change.

“I wanted to expand my knowledge, especially in a company like this that deals with information security at its heart,” he said. “That whole world is pretty amazing, and I knew there was more to learn and accomplish.”

So he spoke to managers and human resources, eager for an opportunity to grow and “make myself something bigger.” Luckily, Trusteer is a supportive and nurturing environment to work in, Tomer emphasized, and he soon began a new role as a security threat researcher.

Social Security: How Tomer Educates the Masses

One of the most common types of attack Tomer’s team encounters is social engineering.

“Most of the time, the threats will target the bank’s customers themselves; it’s the most popular attack,” he said.

He mentioned the work his team has done in Brazil to combat phone-based schemes: Fraudsters call businesses, introduce themselves as bank employees, and then trick customers into installing malware on their machines or prompt them to disclose their credentials.

It’s difficult to combat social engineering because it comes down to education, Tomer explained. Still, his team works tirelessly to research these cases and feed banks information to educate their customers about threats. By analyzing the malware, he said, the team can protect against malicious action regardless of social engineering.

“Even if the fraudster tries an attack, it would fail because our products are better and more powerful,” he said.

Still, it’s impossible for any mere human to keep up with the ever-evolving threat landscape, which is why the Trusteer team works with many automated processes. Tomer spoke proudly of its lab, which analyzes around half a million malware samples every year. As valuable as automation is, however, this analysis is augmented by manual hunting.

“This is one of the strengths of our threat research team,” he said. “We need to be in the trenches to know what’s going on, even if it’s not coming from the threat intelligence feeds we established,” he said.

Even if a threat hasn’t yet targeted the financial world, it’s still on Tomer’s radar; the Trusteer team often sees techniques shared across threat actors, he said.

A Threat Researcher Never Stops Learning

The life of a threat researcher is fast-paced and high-stakes, and there are new and unprecedented challenges to overcome every day. But that doesn’t bother Tomer in the slightest.

“It’s a lot of fun,” he said. “You need to learn all the time, which is something very important to me. When I’m stuck in one place that doesn’t challenge me, it’s a problem.”

In his free time, Tomer prefers quieter pursuits, such as nature photography and spending time with his wife.

“It’s the quiet; it’s very peaceful,” Tomer said of his photography hobby. “A lot of times, I find nature more fascinating than even a beautiful city landscape. It’s just so big and vast.”

Why You Should Always Be Suspicious

To work as a threat researcher, Tomer emphasized, you need to be curious, suspicious and ready to question what other people say. While conducting forensic analyses, threat researchers strive to “collect all the pieces of the puzzle” in order to recreate the entire scenario enacted by the fraudsters. Tomer likened this aspect of the job to solving a new mystery with each instance of fraud.

“In order to understand fraud, sometimes you need to think like a fraudster,” he said. “We need to try to understand how the other side would think to better understand how to combat them.”

Tomer also wants to make sure his friends and family are educated and aware of how to spot the fraud schemes that his team encounters so often.

“It’s a bit harsh to say, but the internet is not a safe place,” he said. “People just need to be aware that not everything that shines is a diamond.”

Meet Fraud Specialist Danna Pelleg