Alex Matrosov and the trouble before the screen lights up

A computer can be betrayed while it is still introducing itself. Before the desktop appears, before a browser opens, a manufacturer’s logo flashes across the screen. It is the sort of image most of us watch without seeing. Alex Matrosov and his colleagues at Binarly examined the machinery behind that small ceremony. The welcome screen turned out to have rather a lot to confess.

Their LogoFAIL research investigated the programs that read those images inside UEFI firmware, the software involved in starting a modern computer. A malformed picture could exploit errors in those programs and redirect execution during boot. Branding had acquired a second occupation as an attack surface. The finding made a familiar object strange: the logo was doing more than reassuring you that you had bought the correct laptop.

For Matrosov, the discovery belonged to a longer professional pursuit. He has worked on reverse engineering, malware analysis and firmware security for more than two decades. Across ESET, Intel, Cylance, NVIDIA and the company he founded in 2021, his work has repeatedly returned to the layers beneath ordinary software. The recurring question is precise: what is the machine actually doing before we decide to trust it?

A career spent underneath the floorboards

His earlier research dealt with malicious software that was already operating in the world. At ESET’s Moscow research center, he worked with Eugene Rodionov. In 2012, delegates at the AVAR conference in Hangzhou selected the pair as best presenters for their analysis and investigation of the Festi botnet. The subject was technical; the recognition also rewarded their ability to make an investigation intelligible to other researchers.

The career that followed carried him into the organizations that make the components other people depend on. At Intel’s Security Center of Excellence, he served as a principal security researcher and led BIOS security for client platforms. By Black Hat USA 2017, he was a principal research scientist at Cylance, presenting a talk called “Betraying the BIOS: Where the Guardians of the BIOS are Failing.” Even the title suggests a researcher disinclined to accept a guardian’s job description as proof of competence.

At NVIDIA, his role was chief offensive security researcher. In 2020, he gave a WOOT invited talk titled “Hardware Security Is Hard: How Hardware Boundaries Define Platform Security.” It examined firmware mitigations and the complications of protecting execution environments. The trajectory matters: long before Binarly became a business, Matrosov was addressing the difficult relationship between a security boundary on paper and a boundary that survives contact with code.

The book beside the disassembler

One way to recognize a working researcher is to look at what they leave for the next person. Matrosov coauthored Rootkits and Bootkits with Eugene Rodionov and Sergey Bratus. Published by No Starch Press in May 2019, the 448-page book moves through the Windows boot process, protections such as Secure Boot, and the analysis of real malware. Its examples include Festi, the botnet he and Rodionov had investigated years earlier.

The book asks readers to get their hands dirty with reverse engineering and forensic techniques. It covers static and dynamic analysis, emulation and tools such as IDA Pro. Those are ways of following a program’s behavior when its original source code is unavailable or its purpose is concealed. Reading the machine’s instructions can be slow, detailed work. A malicious program is under no obligation to provide a helpful introduction.

Matrosov also helped develop HexRaysCodeXplorer, an open-source plug-in for the Hex-Rays decompiler. The project provides code navigation, type reconstruction and other facilities useful during analysis. His Black Hat biography records a Hex-Rays award for the plug-in. Publishing a book and building a tool both address the same practical difficulty: expertise becomes more useful when somebody else can apply it. The work extends beyond the person who first solved the puzzle.

A surfer’s name for a very serious problem

Binarly’s name has a small joke built into it. Matrosov is a surfer; “gnarly” supplied the other half of “binary.” His 2023 Binary Analysis Research keynote slides included a line about dedicating his free time to surfing. It is a welcome detail in a professional vocabulary otherwise crowded with firmware, exploitation and reverse engineering. The company name lets a little seawater into the server room.

The business began in 2021 around a specific frustration with scale. Manual program analysis required specialists to repeat demanding work. Matrosov wanted to bring more transparency to the software supply chain by examining compiled programs. In his April 2024 explanation of the Transparency Platform’s second version, he argued that recognizing fixed byte patterns or checking component integrity could leave defenders ill-equipped for unknown risks and recompiled code.

The distinction has commercial consequences. An enterprise receives finished software from suppliers, often without the source code needed to inspect it in the usual way. Binarly’s approach examines the binary artifact that actually arrives. On March 26, 2024, the company announced a $10.5 million seed round led by Two Bear Capital, with Cisco Investments among the participants. The stated plan was to expand engineering and adoption by enterprises and device manufacturers.

The logo that asked an awkward question

LogoFAIL offered a compact demonstration of why those lower layers deserve attention. Firmware vendors supplied image parsers that device makers could use to display customized boot logos. A visual flourish depended on code with privileges far beyond those of an ordinary picture viewer. The research crossed organizational boundaries because the same underlying components appeared in products from different manufacturers.

At Black Hat Europe in December 2023, the team described testing those parsers with fuzzing, a technique that feeds software varied inputs to expose mistakes. Their presentation reported crashes across the parsers they tested, with some appearing after seconds. Some even crashed on images downloaded from the internet. It is difficult to imagine a more economical editorial comment on elaborate security promises than a startup routine defeated by a picture.

The researchers’ six-month retrospective explained the significance of execution during UEFI’s Driver Execution Environment phase: an attacker could gain control of memory and disk before the operating system started. The report also documented vendor responses and released detection rules for the free FwHunt scanner. Discovery led to a less theatrical question: had the fixes reached the machines that needed them? For a supply-chain researcher, the announcement is only one point in the investigation.

A key with its own warning label

In July 2024, Binarly published PKfail, an investigation into the Platform Keys used by UEFI Secure Boot. These keys help establish which software a machine will trust during startup. The team found test keys in production firmware, including certificates carrying the labels “DO NOT TRUST” and “DO NOT SHIP.” The warning had survived the journey into the finished product. The intended precaution had not.

The researchers also found a leaked private key protected by a four-character password. Their investigation traced affected firmware back to May 2012 and forward to June 2024. Reuse across products and vendors made the issue a supply-chain problem rather than an isolated configuration mistake. The PK.fail scanning service gave people a way to submit firmware and check for non-production keys. A system that says Secure Boot is enabled still depends on the trustworthiness of the keys underneath it.

By September, the free service had received 10,095 unique firmware images. Binarly reported 791 containing an untrusted Platform Key. That is about 7.8 percent of those submissions, a rate describing uploaded images rather than every computer in circulation. The follow-up documented collaboration with CERT/CC and advisories from multiple manufacturers. Here was the quieter side of offensive research: vendors, researchers and coordinators working through the consequences after the dramatic name had made the news.

Beyond firmware, the same demand for evidence

The work also moved into software outside device firmware. After Andres Freund disclosed the XZ Utils backdoor on March 29, 2024, Binarly released a free detector. The company said its tool had appeared within 24 hours of the discovery. Its approach sought recognizable behavior in the compiled code, with the aim of identifying related implantation techniques rather than relying solely on a known sample’s identity.

That response fits the business Matrosov had been describing: inspect what runs, then make the findings useful to the people responsible for fixing it. A vulnerability report can be technically correct and still leave a customer asking what to do on Monday morning. Matrosov has argued that a verdict of maliciousness needs an explanation if the people receiving it are going to fix the problem. The insistence on explanation gives the automation an accountable purpose.

His more recent public work includes sbom-tools, linked from his GitHub profile. The open-source Rust command-line project compares software bills of materials, enriches component information with vulnerability data and checks inventory quality. A bill of materials is an account of a software product’s ingredients. Comparing those accounts makes changes visible. It gives a familiar supply-chain question a practical form: what changed between the software we approved and the software we received?

“You still need to understand why it is malicious”Alex Matrosov · 2024

A new role, an old question

The present-day biography has moved on from the founder-and-CEO label. In March 2026, Binarly announced that Matrosov had joined its board and Gwenyth Castro had become chief executive. Castro came from Bishop Fox, where she had served as chief of staff to the CEO. The announcement placed her remit around enterprise growth, customers and partners, while recognizing the program analysis and vulnerability research underlying Binarly’s platform.

Matrosov’s public LinkedIn profile now identifies him as a member of technical staff at Anthropic, and his GitHub profile lists the same organization and San Francisco. In February 2026, his published LinkedIn articles addressed machine-speed code, end-of-life components and SBOM quality. His professional attention continues to follow the relationship between software production and the evidence needed to assess its consequences.

The change in title leaves a recognizable body of work: investigations of malware, tools for reverse engineers, a book about concealed threats, and a company built to inspect the software customers actually receive. The amusement of a surfer’s company name sits comfortably beside a researcher’s suspicion of reassuring labels. A boot logo can be a program’s input. A trusted key can be a test key. The computer has already begun making decisions while the person at the keyboard is still waiting for it to start.