The 38-year-old's research focusses on web and data security. His aim is to identify security vulnerabilities, understand them and develop countermeasures to protect against such attacks.

At the beginning of his research work, he investigated risks that can arise from data formats such as JSON and XML. These formats are used by internet users every day in the background - for example when surfing the web with a web browser. If such data formats are processed insecurely, this can have serious consequences: Attackers could, for example, impersonate someone else and access other people's websites to steal personal data.

His most recent research focusses on security vulnerabilities in the handling of digitally signed PDF documents. In a joint project with colleagues from Ruhr University Bochum back in 2019, he showed how a random Amazon invoice was converted into a refund of over 1 trillion dollars. Even Amazon's digital signature remained valid in the manipulated refund, even though the purpose of the signature is to recognise such manipulations. He also investigates the embedding and execution of programme code in Office documents, which is often used as the basis for malware attacks.