Key Takeaways
- Mor Weinberger’s early fascination with “winning” computer games sparked a lifelong drive to understand systems deeply enough to make them behave in unintended ways.
- He has built a career spanning elite Israeli tech units, Microsoft cloud security, Argon/Aqua Security, and now leads Echo’s security‑research team.
- Echo’s research group is a small, senior “superstars” team that also serves as a CNA, allocating CVE IDs and shaping open‑source security.
- The team’s work is threefold: improving Echo’s product, positioning the company as a thought leader, and overseeing AI research agents that triage weaknesses.
- Research feeds product design early, ensuring defenses match real attack paths rather than theoretical ones.
- Notable achievements include co‑discovering a stealthy supply‑chain technique presented at Black Hat 2026 and helping remediate vulnerabilities in projects like Ollama.
- Weinberger’s “Moby Dick” is the trusted but unaudited infrastructure (signing, registries, platforms) whose compromise would have a massive blast radius.
- While competition for visibility exists, substantive collaboration—such as joint work with Microsoft—yields the best outcomes.
- AI agents augment research by scaling coverage, but human judgment remains essential for deciding what merits deep investigation.
Background and Motivation
As a teenager Mor Weinberger loved playing computer games, especially the thrill of winning them. That enjoyment led him to peek under the hood, experimenting with how systems could be made to behave in ways their creators never intended. The instinct to probe and repurpose systems never faded; it became the core driver of his career in cybersecurity. He describes this mindset as wanting to be “early enough that the attack never gets built,” rather than merely fast at responding after the fact.
Professional Journey
Weinberger’s formal path began with service in an elite Israeli technological unit, where he was honored as an outstanding soldier. The experience gave him breadth—understanding how systems work underneath and how defensive measures are applied in practice—followed by a BSc in Computer Science. He then joined Microsoft during its early cloud‑security days, working both on engineering detection pipelines that processed hundreds of millions of events daily and on writing the detections themselves. The constantly shifting attack surface (VMs, containers, serverless functions) kept the work fresh, and red‑team versus blue‑team exercises highlighted the real value of his detections. After Microsoft, he moved to Argon Security (later acquired by Aqua Security), where he led the Innovation Lab and began focusing on supply‑chain security, uncovering flaws that affected Fortune 100 companies and sparking his public‑speaking career. He later reunited with Argon’s founders at Echo to tackle a larger problem: securing the software supply chain at scale.
Echo Security Research Team Structure
At Echo, Weinberger leads a small, senior “superstars” team rather than a large “soccer team.” Every member graduated from top Israeli units (8200, 81, or 49) and possesses deep expertise in a specific domain—container and image layers, Kubernetes orchestration, low‑level OS/kernel work, or the open‑source ecosystem and dependencies. The team’s strength lies in the crossover: most findings emerge at the seams where a flaw in one layer becomes critical only because another layer consumes it. This structure enables both depth and breadth, allowing the group to spot high‑impact, cross‑component risks that larger, more fragmented teams might miss.
Research Process and AI Integration
The team’s workflow begins with threat modeling the open‑source components that the ecosystem implicitly trusts. They look for single flaws with a broad blast radius where they can actually improve the upstream project, not just report it. A continuous patch‑review engine scans a wide surface of upstream projects; the AI layer surfaces the small subset of items that warrant human attention. When something is flagged in a component the team already knows well, they dive deep and broad rather than merely applying a patch. Echo’s researchers also oversee AI research agents that triage every new weakness and author fixes; the humans build the tools and skills that push the agents’ autonomy further, while retaining final judgment on what constitutes a vulnerability.
Impact on Product and Strategy
Research sits under CTO Eylam and influences Echo far beyond publishing findings. Its internal role is to ensure the company builds defenses based on how the ecosystem actually breaks, not on assumed breakpoints. During product design, researchers are present early, raising real risks and gaps before architecture is locked. This serves two purposes: educating engineering about genuine attack paths and prioritizing limited defensive resources where they yield the highest return. The team also drives new initiatives—many of Echo’s protections started as research observations about where attackers are heading next. Day‑to‑day, the process is a loop: research informs product, product generates new data for research, and the CNA role places them inside the disclosure cycle, giving operational insight into how strained the vulnerability‑reporting ecosystem has become.
Notable Discoveries
One of the team’s headline achievements was the Black Hat 2026 research conducted jointly with Microsoft’s security researchers. They examined years of real supply‑chain attacks originating from GitHub—a blind spot for many organizations—and built early‑detection mechanisms. In the process, they uncovered a stealthy supply‑chain technique of their own that leaves almost no trace for defenders. Reporting it directly to GitHub’s security team enabled a platform‑wide fix, protecting all users, not just Echo’s customers. Beyond high‑profile conferences, Weinberger points to quieter but equally impactful work: collaborating with open‑source maintainers to patch long‑ignored issues and helping companies close gaps in dependencies before attackers could exploit them. Because these fixes reside deep in the supply chain, their avoided blast radius is enormous, even though they rarely make headlines.
Philosophy and Moby Dick
When asked about his “Moby Dick,” Weinberger rejects a single bug in favor of a category: the systems organizations trust without scrutiny—signing infrastructures, registries, platforms where code lives and gets built. These are treated like any third‑party service, assumed to be enterprise‑ready, yet they rarely undergo the rigorous audits applied to internal applications. An attacker who compromises one of these trusted hubs can affect every downstream consumer simultaneously, creating a massive blast radius. He is also drawn to sophisticated, quiet techniques that have not yet been widely used—risks that lie dormant but are “only a matter of time.” The goal is to reach them first and close them while the window remains open, embodying his ideal of preventing attacks before they are even built.
Competition and Collaboration
Weinberger acknowledges vigorous competition, especially within Israel’s dense community of strong research teams. Knowing each other and having worked together in the past raises the bar for everyone. Globally, the competition often centers on visibility—branding vulnerabilities, securing logos, and being first to publish—while he sees this as healthy pressure that drives deeper work and clearer communication. However, the most valuable dynamics are collaborative on substance. His Black Hat 2026 project with Microsoft exemplifies how complementary expertise yields results neither side could achieve alone. Another example involved Cyera’s discovery in Ollama: the CVE request lingered unresolved until Weinberger’s team, leveraging prior rapport, assigned it as a CNA and published the full record. The underlying pattern is competition for acclaim paired with cooperation to move critical fixes forward.
Future of the Human Security Researcher
Echo’s strategy leans heavily on AI agents that perform security‑research tasks—orchestrating tooling, probing vast surfaces, and triaging weaknesses. Weinberger confirms that AI has already transformed daily work, covering far more ground than a human could patiently scan. Yet AI does not decide what constitutes a vulnerability; that judgment remains a human function, supported by deterministic tools. Adversaries are beginning to employ AI that sets its own objectives and executes attacks with minimal human loop, a capability Echo’s defensive side has not yet matched. Regardless, Weinberger believes the human researcher will not disappear; instead, the role will evolve. Humans will continue to supply the critical judgment needed to decide which parts of the vast attack surface merit deep investment—decisions rooted in production experience and an understanding of where systemic assumptions grow thin. In this blended future, AI scales coverage while humans steer focus, ensuring that defensive efforts stay ahead of emerging threats.