'The threat could be a large nation-state or a 12-year-old' - so is weaponizing malware and sending it back the right tactic?