Tomer Agayev leads a security team that keeps our hard-earned savings safe from fraudsters.

As threat research team lead at IBM Trusteer, Tomer guards the gateway to threats both known and unknown. His team’s responsibility is to monitor new and emerging threats, understand them intimately, and feed information to the cybersecurity protection content development teams so they know how to best defend against financial fraud.

The products developed by Tomer’s Trusteer colleagues are deployed by the world’s biggest financial institutions to protect their clients against malware, phishing, social engineering and more, and their success is largely thanks to Tomer’s penchant for figuring out what makes threat actors tick.

The World of Security Is ‘Pretty Amazing’

Tomer previously served in the Israeli Defense Forces and spent his last year of service as a system administrator and IT team leader. So when he entered the civilian workforce, information security was an obvious first port of call.

Tomer joined Trusteer in March 2013 as a help desk representative, but it wasn’t long before he felt he needed a change.

“I wanted to expand my knowledge, especially in a company like this that deals with information security at its heart,” he said. “That whole world is pretty amazing, and I knew there was more to learn and accomplish.”

So he spoke to managers and human resources, eager for an opportunity to grow and “make myself something bigger.” Luckily, Trusteer is a supportive and nurturing environment to work in, Tomer emphasized, and he soon began a new role as a security threat researcher.

Social Security: How Tomer Educates the Masses

One of the most common types of attack Tomer’s team encounters is social engineering.

“Most of the time, the threats will target the bank’s customers themselves; it’s the most popular attack,” he said.

He mentioned the work his team has done in Brazil to combat phone-based schemes: Fraudsters call businesses, introduce themselves as bank employees, and then trick customers into installing malware on their machines or prompt them to disclose their credentials.

It’s difficult to combat social engineering because it comes down to education, Tomer explained. Still, his team works tirelessly to research these cases and feed banks information to educate their customers about threats. By analyzing the malware, he said, the team can protect against malicious action regardless of social engineering.

“Even if the fraudster tries an attack, it would fail because our products are better and more powerful,” he said.

Still, it’s impossible for any mere human to keep up with the ever-evolving threat landscape, which is why the Trusteer team works with many automated processes. Tomer spoke proudly of its lab, which analyzes around half a million malware samples every year. As valuable as automation is, however, this analysis is augmented by manual hunting.

“This is one of the strengths of our threat research team,” he said. “We need to be in the trenches to know what’s going on, even if it’s not coming from the threat intelligence feeds we established,” he said.

Even if a threat hasn’t yet targeted the financial world, it’s still on Tomer’s radar; the Trusteer team often sees techniques shared across threat actors, he said.

A Threat Researcher Never Stops Learning

The life of a threat researcher is fast-paced and high-stakes, and there are new and unprecedented challenges to overcome every day. But that doesn’t bother Tomer in the slightest.

“It’s a lot of fun,” he said. “You need to learn all the time, which is something very important to me. When I’m stuck in one place that doesn’t challenge me, it’s a problem.”

In his free time, Tomer prefers quieter pursuits, such as nature photography and spending time with his wife.

“It’s the quiet; it’s very peaceful,” Tomer said of his photography hobby. “A lot of times, I find nature more fascinating than even a beautiful city landscape. It’s just so big and vast.”

Why You Should Always Be Suspicious

To work as a threat researcher, Tomer emphasized, you need to be curious, suspicious and ready to question what other people say. While conducting forensic analyses, threat researchers strive to “collect all the pieces of the puzzle” in order to recreate the entire scenario enacted by the fraudsters. Tomer likened this aspect of the job to solving a new mystery with each instance of fraud.

“In order to understand fraud, sometimes you need to think like a fraudster,” he said. “We need to try to understand how the other side would think to better understand how to combat them.”

Tomer also wants to make sure his friends and family are educated and aware of how to spot the fraud schemes that his team encounters so often.

“It’s a bit harsh to say, but the internet is not a safe place,” he said. “People just need to be aware that not everything that shines is a diamond.”

Meet Fraud Specialist Danna Pelleg

More from Banking & Finance

How to Spot a Nefarious Cryptocurrency Platform

Do you ever wonder if your cryptocurrency platform cashes in ransomware payments? Maybe not, but it might be worth investigating. Bitcoin-associated ransomware continues to plague companies, government agencies and individuals with no signs of letting up. And if your platform gets sanctioned, you may instantly lose access to all your funds. What exchanges or platforms do criminals use to cash out or launder ransomware payments? And what implications does this have for people who use exchanges legitimately? Blacklisted Exchanges and Mixers…

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…