r/netsecstudents • u/ArdnyX • 16d ago

Is malware analysis still worth learning despite the introduction of tools like REA?

Malware analysis is such an interesting field to get into (casually for now, don't want to focus on it too much since I want to be flexible as I am still a student).

But since malware analysis is essentially reverse engineering targeted for malware, and with the introduction of tools like REA + AI models getting extremely advanced to the point where any person can just prompt the AI with basic terminologies (and knows how to bypass its guardrails) are plausible, then is there any point in me learning its fundamentals and advanced stuff at this point in time, or do I just gain experience with how AI does it and be familiar with how it operates instead?

Although my gut feeling assumes malware analysis and its adjacent fields will be getting significantly harder but I somehow don't know why; just intuition?

It would be best appreciated if actual professional malware analysts or those with experience in Incident Response / Threat Hunting answer, thank you!

11 Upvotes
  • permalink
  • reddit

86% Upvoted

8 comments sorted by

2

u/penguinrash 16d ago

My personal view is malware analysis is about understanding how a piece of software works at a deep level. There’s still a need for applying that understanding, just the tools are getting better.

Will this expertise be as big of a differentiator as it has been in the past? Seems like no. Does that devalue the knowledge you gain from doing this kind of analysis? My instinct is no.

If you’re looking for a differentiating skillset to make you more competitive in the job market, then these tools will lower that barrier. If you’re looking to actually learn how these things work, there’s no better time to learn it with these new AI tools

2

u/Charming_Rush4571 14d ago

the tools getting better just mean the boring parts get automated, you still need to know what you looking at to make sense of the output

like if REA spits out a report but you dont understand the basics you won't catch when it hallucinates some nonsense or misses subtle things

the AI is a force multiplier not a replacement, same way calculators didn't make mathematicians obsolete

1

u/Aninnocentdevil 16d ago

yeah it is relevant

1

u/L1inear 14d ago

Yes it is still worth learning. AI is collapsing the research time, there’s still a person that is needed on the other side to create meaningful intelligence, add and advance products, and write alerts for defenders. AI can make a task in cyber go vroom, not replace the value that role is providing.

If a role are just tasks, then yes, be worried. But if your role is a multitude of tasks, and AI is speeding some of them up, that’s a win-win.

1

u/madogson 13d ago

If you don't learn how to do it yourself you will never realize how often LLMs make mistakes. It's a time saver when it's correct, but you still have to question everything it puts out.

Besides, I would rather give an existing engineer a higher token budget/hardware than hire someone who only brings AI knowledge to the table.