DISCARDED: Tales From the Threat Research Trenches AI as a Tool, Not a Replacement: Malware Research in the Age of LLMs
Hello to all our Cyber Pals! Host Selena Larson and co-host, Sarah Sabotka, chat with Kyle Cucci, and Dr. Chris Wakelin, Threat Researchers from Proofpoint. They unpack how artificial intelligence is shaping modern malware analysis and detection workflows.
The conversation explores how large language models are already embedded in day-to-day security operations—from accelerating rule creation and tooling development to helping analysts quickly interpret complex malware behavior.
Drawing on real-world examples from the team’s work, the episode highlights both the promise and the limitations of AI in cybersecurity. Chris and Kyle share how AI can streamline tedious reverse-engineering tasks, compare malware variants, and surface insights faster—while emphasizing the ongoing need for expert validation, thoughtful prompting, and a human-in-the-loop approach to ensure accuracy and reliability.
We also discuss:
- Practical ways AI is used today to support malware reverse engineering and detection development
- Prompting strategies that help reduce hallucinations and improve analysis outcomes
- The role of MCP (model context protocol) and emerging agentic AI concepts in security tooling
- Indicators and characteristics of AI-assisted malware development
- Real-world examples of prompt injection attempts within malicious code
- Whether AI-generated malware meaningfully changes defender workflows or primarily increases speed and scale
- How defenders and threat actors alike are leveraging the same AI capabilities across the threat landscape
Ultimately, this episode offers a balanced look at AI’s growing influence in cybersecurity—showing how intelligent tools can amplify analyst effectiveness while reinforcing that expertise and critical thinking remain central to effective malware defense.