My reading list.
This is the reading behind the work. First, the books in my own library, grouped by subject. Then some I'd add if you're building yours. Then recent research on the subjects I write about, so you can go past my take and read the evidence yourself.
From my library
The books I keep on hand and go back to. They're tools, not trophies. Some are field manuals, some are history, a few are about how to think and write clearly.
- Incident response & security operations
- Threat intelligence & hunting
- Forensics & investigation
- Offensive security & adversary emulation
- AI, machine learning & security
- Phishing, fraud & social engineering
- Cloud, software & security engineering
- Network security
- Cryptography, privacy & identity
- Critical infrastructure & OT
- Cyber conflict, national security & intelligence
- Governance, risk & leadership
- Research, writing & thinking
- Other
Incident response & security operations 6
- Beginning Elastic StackIntroduction to Elasticsearch, Logstash, Kibana and Beats for log collection, analysis, and visualization.
- Cybersecurity Incident Response: How to Contain, Eradicate, and Recover from IncidentsBuilding and running an incident response program, from preparation through containment, eradication and recovery.
- Handbook on Information Security Operations CenterHandbook on planning, implementing and operating a security operations center for banks.
- Incident Response & Computer ForensicsThird edition; investigating intrusions, collecting evidence, and conducting forensic analysis and remediation.
- Mastering Splunk: Optimize Your Machine-Generated Data Effectively by Developing Advanced Analytics with SplunkAdvanced Splunk usage: searching, reporting, dashboards and analytics on machine data.
- Security Surveillance Centers: Design, Implementation, and OperationDesigning, building and operating security surveillance and monitoring centers.
Threat intelligence & hunting 7
- Collaborative Cyber Threat Intelligence: Detecting and Responding to Advanced Cyber Attacks at the National LevelEdited volume on national-level threat intelligence sharing, situational awareness, legal aspects, and collaborative incident response.
- Cyber Adversary Characterization: Auditing the Hacker MindFrameworks for profiling cyber attackers' motivations, capabilities, and behavior to inform defense and attribution.
- Cyber Threat IntelligenceResearch chapters on threat intelligence, malware analysis and attack detection.
- Huntpedia: Your Threat Hunting Knowledge CompendiumVendor-published compilation of practitioner chapters on threat hunting theory, models and techniques.
- Intelligence-Driven Incident Response: Outwitting the AdversaryIntegrating threat intelligence into incident response using the F3EAD cycle and analytic methods.
- Mining the Social Web: Third EditionTechniques for collecting and analyzing data from Facebook, Twitter, LinkedIn, Instagram and other social platforms.
- Open Source Intelligence Methods and Tools: A Practical Guide to Online IntelligencePractical guide to OSINT techniques, tools and online investigation methodology.
Forensics & investigation 20
- Accelerated Windows Malware Analysis with Memory DumpsTraining course on detecting and analyzing malware in Windows process, kernel and complete memory dumps using WinDbg.
- Bloodstain Pattern Analysis with an Introduction to Crime Scene ReconstructionThird edition covering bloodstain pattern classification, interpretation, documentation, and crime scene reconstruction methods.
- Combating Human Trafficking: A Multidisciplinary ApproachEdited volume on human trafficking forms, victims, investigation, prosecution, and prevention strategies.
- Computer Forensics: Hard Disks and Operating SystemsEC-Council forensics text on disk structures, file systems and OS-level investigation.
- Computer Forensics and Cyber Crime: An Introduction (Third Edition)Introductory textbook on computer crime, digital forensics and related law.
- Cyber Crime Investigations: Bridging the Gaps Between Security Professionals, Law Enforcement, and ProsecutorsGuide to investigating cybercrime and coordinating between security teams, police and prosecutors.
- Cyber CriminologyEdited research collection on cybercrime, its causes, investigation and prevention.
- Cyber Forensics: From Data to Digital EvidenceExplains data fundamentals and how digital data becomes forensic evidence.
- Cybervetting: Internet Searches for Vetting, Investigations, and Open-Source IntelligenceSecond edition; methods, law and ethics of using internet searches for background vetting and investigations.
- Digital Evidence and Computer Crime: Forensic Science, Computers, and the Internet (Third Edition)Textbook on digital evidence handling, forensic examination and investigating computer-related crime.
- Digital Forensics with Open Source ToolsPerforming forensic analysis of Windows, Linux and Mac systems using open source tools.
- Get the Truth: Former CIA Officers Teach You How to Persuade Anyone to Tell AllFormer CIA officers explain interview and elicitation techniques for obtaining truthful information.
- Guide to Computer Forensics and Investigations: Sixth EditionTextbook on digital forensic procedures, tools, and investigation of computer systems.
- Interviewing and Interrogation for Law Enforcement: Second EditionLaw-enforcement guide to investigative interviewing and interrogation techniques.
- Practical Handbook for Private InvestigatorsHandbook on private investigation practice, techniques and business operations.
- Spy the Lie: Former CIA Officers Teach You How to Detect DeceptionFormer CIA officers explain a methodology for detecting deception in interviews and conversation.
- The Forensic Psychologist's Casebook: Psychological Profiling and Criminal InvestigationEdited casebook on offender profiling, investigative psychology and their use in criminal investigations.
- The International Trafficking of Human Organs: A Multidisciplinary PerspectiveMultidisciplinary examination of the illegal international trade in human organs.
- The Psychology of Death Investigations: Behavioral Analysis for Psychological Autopsy and Criminal ProfilingBehavioral analysis methods for psychological autopsy and criminal profiling in death investigations.
- Tracking Humans: A Fundamental Approach to Finding Missing Persons, Insurgents, Guerillas, and Fugitives from the LawFundamentals of man-tracking for search and rescue, law enforcement and military use.
Offensive security & adversary emulation 21
- Advanced Penetration Testing: Hacking the World's Most Secure NetworksScenario-driven guide to simulating advanced persistent threats: payload delivery, command and control, and exfiltration.
- Advanced Penetration Testing for Highly-Secured EnvironmentsSecond edition covering advanced penetration testing methodology, lab building, exploitation, pivoting and evasion techniques.
- Advanced Persistent Threat Hacking: The Art and Science of Hacking Any OrganizationExplains APT-style attacker methodology, from reconnaissance and social engineering to persistence, for organizational defense.
- Beginning Ethical Hacking with Kali Linux: Computational Techniques for Resolving Security IssuesIntroductory ethical hacking with Kali Linux: networking basics, Python, information gathering, and exploitation tools.
- CEH v10: EC-Council Certified Ethical Hacker Complete Training Guide with Practice LabsCertified Ethical Hacker v10 exam workbook covering reconnaissance, scanning, system hacking, malware, web and wireless attacks.
- CompTIA PenTest+ Study Guide: Exam PT0-001Certification study guide covering penetration testing planning, techniques and reporting.
- Cyber Operations: Building, Defending, and Attacking Modern Computer NetworksSecond edition hands-on guide to building, defending, and attacking Windows and Linux networks and services.
- Ethical Hacking 101: How to Conduct Professional Pentestings in 21 Days or Less!Introductory penetration testing guide: reconnaissance, scanning, exploitation and reporting.
- Gray Hat Hacking: The Ethical Hacker's HandbookFifth edition; exploit development, reverse engineering, and advanced offensive security techniques.
- Hacking APIs: Breaking Web Application Programming InterfacesHands-on guide to testing web APIs: reconnaissance, fuzzing, authentication and access-control attacks.
- Hacking Exposed Malware & Rootkits: Malware & Rootkits Security Secrets & SolutionsExplains malware and rootkit techniques and how to detect and defend against them.
- Hacking For DummiesSixth edition; introduction to ethical hacking and vulnerability testing of networks, systems and applications.
- Kali Linux Cookbook: Over 70 recipes to help you master Kali Linux for effective penetration security testingRecipe-style guide to penetration testing tasks using Kali Linux tools.
- Kali Linux Revealed: Mastering the Penetration Testing DistributionOfficial guide to installing, configuring and administering the Kali Linux distribution.
- Kali Linux Wireless Pentesting and Security for BeginnersBeginner guide to Wi-Fi penetration testing and wireless security with Kali Linux.
- Professional Red Teaming: Conducting Successful Cybersecurity EngagementsPlanning, executing and managing professional red team and penetration testing engagements.
- Real-World Bug Hunting: A Field Guide to Web HackingWeb vulnerability classes illustrated with real bug bounty reports.
- Red Team: How to Succeed by Thinking Like the EnemyExamines red teaming practices in military, intelligence, homeland security and business.
- The Hacker Playbook: Practical Guide to Penetration TestingSports-themed, step-by-step guide to penetration testing tools and techniques.
- The Hardware Hacker: Adventures in Making and Breaking HardwareEssays on hardware manufacturing, reverse engineering, and open hardware from Shenzhen to silicon.
- Violent Python: A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security EngineersWriting Python tools for penetration testing, forensic investigation, network traffic analysis, wireless and web attacks.
AI, machine learning & security 11
- Advanced Data Analytics Using Python: With Machine Learning, Deep Learning and NLP ExamplesPython techniques for data analytics, including ETL, supervised and unsupervised learning, deep learning, NLP and time series.
- AI Superpowers: China, Silicon Valley, and the New World OrderExamines US-China competition in artificial intelligence and its economic and social effects.
- Applied Deep Learning: A Case-Based Approach to Understanding Deep Neural NetworksCase-based introduction to deep neural networks using TensorFlow, covering optimization, regularization, and hyperparameter tuning.
- Building Chatbots with Python: Using Natural Language Processing and Machine LearningHands-on guide to building chatbots in Python using NLP and machine learning.
- Deep Learning in Python: Master Data Science and Machine Learning with Modern Neural Networks written in Python, Theano, and TensorFlowIntroductory guide to neural networks, backpropagation, and Theano/TensorFlow implementations.
- Developing Bots with Microsoft Bots Framework: Create Intelligent Bots using MS Bot Framework and Azure Cognitive ServicesBuilding conversational bots with Microsoft Bot Framework and Azure Cognitive Services.
- Intelligent Methods for Cyber WarfareEdited volume applying computational intelligence techniques to cyber warfare, cyber defense and threat analysis.
- International Conference on Applications and Techniques in Cyber Security and Intelligence: Applications and Techniques in Cyber Security and IntelligenceConference proceedings on applied cyber security and intelligent computing techniques (Advances in Intelligent Systems and Computing 580).
- Machine Learning: Step-by-Step Guide to Implement Machine Learning Algorithms with PythonShort introduction to machine learning concepts and implementing common algorithms in Python.
- Mastering Machine Learning with Python in Six Steps: A Practical Implementation Guide to Predictive Data Analytics Using PythonPractical guide to machine learning and predictive analytics with Python libraries.
- Python Machine Learning Case Studies: Five Case Studies for the Data ScientistApplied machine learning in Python through five worked case studies.
Phishing, fraud & social engineering 12
- Dark Psychology: The Practical Uses and Best Defenses of Psychological Warfare in Everyday LifePopular guide to recognizing and defending against manipulation, deception and covert persuasion.
- Detecting Phishing Attacks: A Comprehensive ApproachPhD dissertation on machine-learning and heuristic techniques for detecting phishing web pages and emails.
- Ghost in the Wires: My Adventures as the World's Most Wanted HackerMemoir of Kevin Mitnick's hacking and social engineering exploits and his years as a fugitive.
- Internet Crimes, Torts and Scams: Investigation and RemediesLegal guide to investigating online crimes, torts and scams and pursuing remedies.
- Investigating White-Collar Crime: Evaluation of Fraud ExaminationsEvaluates private fraud examination reports into white-collar crime cases.
- Money Laundering: A Guide for Criminal Investigators (3rd ed.)Investigator's guide to money laundering methods, financial investigations and related law.
- Phishing: Cutting the Identity Theft LineExplains phishing attacks and identity theft and how to defend against them.
- Phishing Dark Waters: The Offensive and Defensive Sides of Malicious E-mailsHow phishing attacks work and how organizations can train and defend against them.
- Phishing ExposedTechnical examination of phishing techniques, infrastructure and countermeasures.
- Phishing for Phools: The Economics of Manipulation and DeceptionEconomic analysis of how markets reward manipulation and deception of consumers.
- The Art of Deception: Controlling the Human Element of SecurityClassic account of social engineering attacks and how organizations can defend against them.
- Why They Do It: Inside the Mind of the White-Collar CriminalExamines why executives commit fraud and white-collar crime, drawing on interviews with offenders.
Cloud, software & security engineering 19
- Amazon Web Services in ActionSecond edition introducing core AWS services, infrastructure automation, networking, storage, security and scalable architectures.
- Automate the Boring Stuff with Python: Practical Programming for Total BeginnersBeginner Python programming focused on automating everyday computer tasks.
- Bad Programming Practices 101: Become a Better Coder by Learning How (Not) to ProgramTeaches good coding habits by examining common bad programming practices.
- Becoming a Better Programmer: A Handbook for People Who Care About CodePractical advice on code quality, software craftsmanship, learning, teamwork and professional development for programmers.
- Beginning Serverless Computing: Developing with Amazon Web Services, Microsoft Azure, and Google CloudBuilding serverless applications using AWS Lambda, Azure Functions, and Google Cloud Functions.
- CompTIA Linux+ Powered by Linux Professional Institute Study Guide: Exam LX0-103 and Exam LX0-104Certification study guide covering Linux command line, administration and LPI exam objectives.
- Cyber Security on Azure: An IT Professional's Guide to Microsoft Azure Security CenterSecuring Microsoft Azure workloads using Azure Security Center, identity controls and cloud monitoring.
- Design It!: From Programmer to Software ArchitectPractical introduction to software architecture: design thinking, risk-driven methods and collaborative workshops.
- Designing Embedded Systems and the Internet of Things (IoT) with the ARM MbedPractical introduction to embedded and IoT system design using ARM Mbed.
- Elasticsearch: The Definitive GuideGuide to the Elasticsearch search and analytics engine: indexing, querying, aggregations and cluster management.
- Good Habits for Great Coding: Improving Programming Skills with Examples in PythonLessons on writing clear, correct and efficient code, illustrated with Python examples.
- Google Cloud Platform in ActionPractical guide to Google Cloud Platform computing, storage and data services.
- Handbook of Big Data and IoT SecurityEdited research chapters on security, forensics and malware threats in big data and IoT environments.
- Handbook on Data CentersComprehensive reference on data center architecture, networking, energy efficiency, management and security.
- Modern Linux Administration: How to Become a Cutting-Edge Linux AdministratorEarly-release guide to modern Linux system administration, automation, containers and DevOps tooling.
- Python Programming: Practical Python Programming for Beginners and ExpertsShort introductory guide to Python programming fundamentals.
- The Hitchhiker's Guide to Python: Best Practices for DevelopmentBest practices for Python development: environment setup, code style, project structure and libraries.
- The Linux Command Line: A Complete Introduction (2nd ed.)Comprehensive introduction to the Linux shell, command-line tools and shell scripting.
- VMware vSphere 6.5 Cookbook: Third EditionTask-oriented recipes for installing, configuring and managing VMware vSphere 6.5.
Network security 12
- 5G LTE Narrowband Internet of Things (NB-IoT)Technical overview of 3GPP NB-IoT: architecture, physical and protocol layers, and procedures for cellular IoT.
- A Comprehensive Guide to 5G SecurityEdited volume on 5G security threats, architectures, SDN/NFV security, privacy, and mobile network defenses.
- Attacking Network Protocols: A Hacker's Guide to Capture, Analysis, and ExploitationCapturing, analyzing and reverse engineering network protocols, and finding and exploiting protocol vulnerabilities.
- Botnets: The Killer Web AppExplains botnet architecture, command and control, detection techniques, and countermeasures for network defenders.
- CompTIA Security+ Guide to Network Security FundamentalsTextbook covering network security fundamentals mapped to CompTIA Security+ exam objectives.
- Computer Network Security and Cyber EthicsFourth edition introduction to network security threats, defenses, and the ethical and social issues of cyberspace.
- Defensive Security Handbook: Best Practices for Securing InfrastructurePractical blue-team guidance on building security programs and hardening enterprise infrastructure.
- Hands-On Enterprise Automation with Python: Automate Common Administrative and Security Tasks with PythonUsing Python to automate network, system administration and security tasks in enterprise environments.
- Internet Infrastructure: Networking, Web Services, and Cloud ComputingTextbook on internet networking protocols, web servers, web services and cloud computing infrastructure.
- Linux All-in-One Desk Reference For DummiesSecond edition; broad reference on installing, administering, networking and securing Linux systems.
- Mike Meyers’ CompTIA Security+ Certification Guide: Second Edition (Exam SY0-501)Certification guide covering CompTIA Security+ SY0-501 exam objectives.
- Wireshark for Security Professionals: Using Wireshark and the Metasploit FrameworkUsing Wireshark for packet analysis, attack diagnosis and offensive security with Metasploit.
Cryptography, privacy & identity 16
- Cracking Codes with Python: An Introduction to Building and Breaking CiphersTeaches Python programming by implementing and breaking classical ciphers through to public-key cryptography.
- Crypto Revolution: Bitcoin, Cryptocurrency and the Future of MoneyInvestor-oriented introduction to Bitcoin, blockchain, and cryptocurrencies and their implications for money.
- CryptographyUndergraduate mathematics text on classical and modern cryptography, number theory, RSA, and elliptic curves.
- Cryptography and Network SecurityTextbook on cryptographic algorithms, public-key infrastructure, authentication, and network and internet security protocols.
- Data and Goliath: The Hidden Battles to Collect Your Data and Control Your WorldHow governments and corporations conduct mass surveillance, its costs, and proposals for reform.
- Hacklog Volume 1: Anonymity: IT Security & Ethical Hacking HandbookFree handbook on online anonymity tools and techniques, including proxies, VPNs and Tor.
- Hands-On Cryptography with Python: Leverage the Power of Python to Encrypt and Decrypt DataPractical introduction to encryption, hashing and cryptographic attacks implemented in Python.
- Hands-On Cybersecurity with Blockchain: Implement DDoS Protection, PKI-based Identity, 2FA and DNS Security using BlockchainApplying blockchain technology to DDoS protection, identity, two-factor authentication and DNS security.
- Hardware-Based Computer Security Techniques to Defeat Hackers: From Biometrics to Quantum CryptographyHardware security approaches including biometrics, tokens, trusted hardware and quantum cryptography.
- History of Cryptography and Cryptanalysis: Codes, Ciphers, and Their AlgorithmsHistory of codes, ciphers and codebreaking from antiquity to modern public-key cryptography.
- How to Disappear: Erase Your Digital Footprint, Leave False Trails, and Vanish without a TraceSkip tracer's guide to protecting privacy, reducing traceability and disappearing from records.
- How to Disappear and Start a New Life: How to Get a Complete New Identity Legally, How to Delete Yourself from the InternetShort guide to personal privacy, reducing digital footprint and relocating.
- How to Disappear from the Internet Completely While Leaving False Trails: How to Be Anonymous OnlineShort guide to reducing one's online footprint and maintaining anonymity.
- Serious Cryptography: A Practical Introduction to Modern EncryptionPractical introduction to modern cryptographic primitives, protocols and their pitfalls.
- The Deep Web Superpack: The Ultimate Anonymous CollectionCollection of guides on online anonymity, Tor, darknet markets and privacy tools.
- Weaving the Dark Web: Legitimacy on Freenet, Tor, and I2PStudy of the history, culture and legitimacy of the Freenet, Tor and I2P dark webs.
Critical infrastructure & OT 5
- Cyber-Physical Attacks: A Growing Invisible ThreatAttacks that cross from cyberspace into the physical world, with case studies and defensive approaches.
- Cyber-Physical Security: Protecting Critical Infrastructure at the State and Local LevelEdited volume on cyber-physical threats to utilities and public infrastructure at state and local government level.
- Cyber-security of SCADA and Other Industrial Control SystemsEdited volume on ICS/SCADA architectures, threats, vulnerability assessment, intrusion detection and defense.
- Cybersecurity: Protecting Critical Infrastructures from Cyber Attack and Cyber WarfareEdited volume on cyber threats to critical infrastructure, cyber warfare, and policy and defensive responses.
- Internet-of-Things (IoT) Systems: Architectures, Algorithms, MethodologiesOverview of IoT system architectures, algorithms, safety and security methodologies.
Cyber conflict, national security & intelligence 33
- A New Understanding of Terrorism: Case Studies, Trajectories and Lessons LearnedEdited case studies of terrorist attacks and organizations, analyzing trajectories and lessons for counterterrorism and policing.
- A Wolf in Military Clothing: A Case Study Examination of Lone Wolf Terrorism and the Roles and Responsibilities of Government AgenciesMaster's thesis examining lone wolf terrorism case studies and the responsibilities of government agencies.
- Bytes, Bombs, and Spies: The Strategic Dimensions of Offensive Cyber OperationsEssays on the strategy, policy, intelligence and escalation dynamics of offensive cyber operations.
- China’s World: What Does China Want?Analysis of Chinese foreign policy, decision-making and global ambitions.
- Computational Propaganda: Political Parties, Politicians, and Political Manipulation on Social MediaCountry case studies of bots, algorithms and social-media manipulation in politics.
- Cyber Dragon: Inside China's Information Warfare and Cyber OperationsAnalysis of Chinese military and political thinking on information warfare, cyber operations, and information dominance.
- Cyber Terrorism: Political and Economic ImplicationsExamines cyber terrorism threats, vulnerabilities of information infrastructure, and their political and economic consequences.
- Cyber Terrorism: Research ReviewResearch review of cyber terrorism concepts, terrorist use of the internet, and countermeasures, prepared for the Korean Institute of Criminology.
- Cyber Warfare: A Reference HandbookReference handbook on cyber warfare history, issues, key actors, documents and resources.
- Cyber Warfare: A Multidisciplinary AnalysisEdited volume on interstate cyber aggression from computer science, strategy, international law, politics and ethics perspectives.
- Cyber Warfare: Building the Scientific FoundationResearch chapters toward a scientific basis for cyber warfare, covering attribution, modeling, deception and defense.
- Cyber Warfare: Its Implications on National SecurityIndian perspective on cyberspace, critical information infrastructure protection and a model for cyber war.
- Cyber Warfare and Cyber TerrorismEdited reference on cyber warfare and terrorism threats, methods and defenses.
- Cyber-Enabled Economic Warfare: An Evolving ChallengeResearch report examining how cyber means can be used to attack national economies, with policy recommendations.
- Cybersecurity: Geopolitics, Law, and PolicyLegal and policy dilemmas of cybersecurity explored through expert interviews and scenario vignettes.
- Digital Security: Cyber Terror and Cyber SecurityIntroductory volume in The Digital World series on cyber threats, cyber terrorism and protective measures.
- Encyclopedia of TerrorismRevised edition; A-to-Z reference on terrorist groups, incidents, people and counterterrorism concepts.
- Future Crimes: Everything Is Connected, Everyone Is Vulnerable and What We Can Do About ItSurvey of emerging technology-enabled crime and security threats, with recommended responses.
- Guerrillas in the Mist: A Battlefield Guide to Clandestine WarfareFormer Marine's field guide to guerrilla and clandestine warfare tactics.
- Information Technology for Peace and Security: IT Applications and Infrastructures in Conflicts, Crises, War, and PeaceTextbook on IT in conflict and peace: cyber warfare, arms control, crisis informatics and resilient infrastructure.
- Intelligence Matters: The CIA, the FBI, Saudi Arabia, and the Failure of America's War on TerrorSenator Graham's account of the 9/11 congressional inquiry and US intelligence failures.
- KGB/CIA: Intelligence and Counter-Intelligence OperationsIllustrated history of KGB and CIA intelligence and counter-intelligence operations.
- Managerial Guide for Handling Cyber-Terrorism and Information WarfareManagement-oriented guide to cyber terrorism, information warfare threats and organizational defenses.
- Public International Law of CyberspaceApplication of public international law to cyberspace: sovereignty, jurisdiction, human rights and cyber warfare.
- Spy Schools: How the CIA, FBI, and Foreign Intelligence Secretly Exploit America's UniversitiesInvestigation of intelligence agency recruitment and espionage activity at American universities.
- The Future of Terrorism: ISIS, Al-Qaeda, and the Alt-RightAnalysis of the evolution of jihadist and far-right terrorism and its likely future.
- The History of Terrorism: From Antiquity to al QaedaHistorical survey of terrorism from ancient times through anarchism, revolutionary movements, and al Qaeda.
- The Russians Are Coming, Again: The First Cold War as Tragedy, the Second as FarceCritical history of US-Russia Cold War tensions and their contemporary revival.
- The Unending Game: A Former R&AW Chief's Insights into EspionageFormer Indian intelligence chief reflects on tradecraft, surveillance and the role of intelligence.
- The Weapon Wizards: How Israel Became a High-Tech Military SuperpowerHow Israel developed advanced military technologies including drones, missile defense and cyber.
- Thwarting Enemies at Home and Abroad: How to Be a Counterintelligence OfficerFormer CIA officer's practical guide to counterintelligence tradecraft, operations, and the counterintelligence officer's role.
- Waging Insurgent Warfare: Lessons from the Vietcong to the Islamic StateAnalysis of insurgent strategy and tactics from Vietnam to the Islamic State.
- Who Becomes a Terrorist and Why: The Psychology and Sociology of TerrorismLibrary of Congress study of terrorist psychology and sociology, reissued with a foreword by Malcolm Nance.
Governance, risk & leadership 16
- 2019 TAG Cyber Security Annual: Practical Handbook and Reference Guide for the Working Cyber Security ProfessionalAnnual reference surveying fifty enterprise security control areas, trends, and the cybersecurity vendor landscape.
- A Data-Driven Computer Defense: A Way to Improve Any Computer DefenseThird edition; prioritizing security defenses based on data about the root causes of successful attacks.
- Achieving and Sustaining Secured Business Operations: An Executive's Guide to Planning and ManagementExecutive guide to planning, implementing and managing enterprise security programs aligned with business operations.
- Building a HIPAA-Compliant Cybersecurity Program: Using NIST 800-30 and CSF to Secure Protected Health InformationApplying NIST SP 800-30 risk assessment and the Cybersecurity Framework to protect health information under HIPAA.
- Chief Information Security Officer HandbookHandbook for U.S. federal CISOs on roles, risk management, NIST frameworks, requirements, workforce and contracting.
- CISSP All-in-One Exam GuideEighth edition study guide covering all eight CISSP domains with practice questions.
- CompTIA Security+ Certification Practice ExamsThird edition practice questions with explanations for the CompTIA Security+ SY0-501 exam.
- CompTIA Security+: Get Certified Get Ahead: SY0-501 Study GuideStudy guide for CompTIA Security+ SY0-501 covering threats, technologies, architecture, identity, risk and cryptography.
- Cyber Security: Analytics, Technology and AutomationEdited volume on cyber security strategy, analytics, technologies and automation.
- Cyber Threat!: How to Manage the Growing Risk of Cyber AttacksExecutive-level guide to understanding and managing organizational cyber attack risk.
- Cyberjutsu: Cybersecurity for the Modern NinjaMaps historical ninja tactics and scrolls onto modern threat modeling and security controls.
- Investigating Cyber Law and Cyber Ethics: Issues, Impacts and PracticesEdited research collection on cyber law and ethics and their societal impact.
- Investigating Human Error: Incidents, Accidents, and Complex Systems (2nd ed.)Methods for investigating human error in incidents and accidents within complex systems.
- Private Security: An Introduction to Principles and PracticeIntroductory textbook on private security industry, law, risk and practice.
- The Starfish and the Spider: The Unstoppable Power of Leaderless OrganizationsHow decentralized, leaderless organizations operate and challenge traditional hierarchies.
- Tribe of Hackers: Cybersecurity Advice from the Best Hackers in the WorldInterviews with dozens of security practitioners answering common questions on careers, skills, and industry advice.
Research, writing & thinking 10
- Authoring a PhD: How to Plan, Draft, Write and Finish a Doctoral Thesis or DissertationPractical guide to planning, structuring, drafting and completing a doctoral thesis.
- Basic Statistics for Social ResearchIntroductory statistics for social science research, from the Research Methods for the Social Sciences series.
- How to Write a Better ThesisGuide to structuring, writing and revising a research thesis.
- Introduction to Qualitative Research Methods: A Guidebook and Resource (4th ed.)Guidebook to qualitative research: participant observation, in-depth interviewing, analysis and writing.
- Research Design: Quantitative, Qualitative, Mixed Methods, Arts-Based, and Community-Based Participatory Research ApproachesGuide to designing research projects across major methodological approaches.
- Research Design: Qualitative, Quantitative, and Mixed Methods Approaches (4th ed.)Textbook on designing qualitative, quantitative and mixed methods research.
- Research Methodology: A Step-by-Step Guide for Beginners (3rd ed.)Step-by-step introduction to planning and conducting a research study.
- Storycraft: The Complete Guide to Writing Narrative NonfictionGuide to the craft of narrative nonfiction: structure, character, scene and voice.
- The Thinker's Thesaurus: Sophisticated Alternatives to Common WordsThesaurus offering sophisticated alternatives to common English words with usage examples.
- Writing a Proposal for Your Dissertation: Guidelines and ExamplesStep-by-step guidance for writing dissertation proposal chapters, with annotated examples across research designs.
Other 12
- An Introduction to Writing for Electronic Media: Scriptwriting Essentials Across the GenresIntroduction to scriptwriting formats and techniques for radio, television, film, and interactive electronic media.
- Blueprints for a SaaS Sales OrganizationFramework for structuring SaaS sales teams, customer journey, sales processes, tooling, and data-driven sales operations.
- Candlesticks, Fibonacci, and Chart Pattern Trading Tools: A Synergistic Strategy to Enhance Profits and Reduce RiskTechnical-analysis trading strategy combining candlestick, Fibonacci and chart-pattern tools.
- Casarett & Doull's Toxicology: The Basic Science of PoisonsComprehensive reference on toxicology principles, toxic agents, target-organ toxicity, and environmental and applied toxicology.
- CompTIA A+ Complete Study Guide: Exams 220-901 and 220-902Third edition study guide for CompTIA A+ hardware, operating systems, networking, troubleshooting and security exams.
- Destiny Disrupted: A History of the World Through Islamic EyesWorld history narrated from the perspective of the Islamic world, from its origins to the present.
- Evil: The Science Behind Humanity's Dark SidePsychologist examines the science of why people commit harmful acts and what 'evil' means.
- Hacking Electronics: Learning Electronics with Arduino and Raspberry PiSecond edition; hands-on hobby electronics projects using Arduino and Raspberry Pi.
- Islamophobia in Cyberspace: Hate Crimes Go ViralEdited collection on online anti-Muslim hate crime, social media and policy responses.
- MCSA Windows 10 Complete Study Guide: Exams 70-698 and 70-697Certification study guide covering Windows 10 installation, configuration and management.
- Spy Secrets That Can Save Your Life: A Former CIA Officer Reveals Safety and Survival Techniques to Keep You and Your Family ProtectedPersonal safety and situational-awareness techniques drawn from intelligence tradecraft.
- The Strategy and Tactics of Pricing: A Guide to Growing More Profitably (5th ed.)Strategic pricing framework covering value creation, price structure and pricing policy.
More I'd recommend
Books I'd put next to those if you're serious about this field, including some of the best recent ones.
- Incident response & security operations
- Threat intelligence & hunting
- Forensics & investigation
- Offensive security & adversary emulation
- AI, machine learning & security
- Phishing, fraud & social engineering
- Cloud, software & security engineering
- Network security
- Cryptography, privacy & identity
- Critical infrastructure & OT
- Cyber conflict, national security & intelligence
- Governance, risk & leadership
Incident response & security operations 2
- Crafting the InfoSec Playbook: Security Monitoring and Incident Response Master PlanCisco CSIRT veterans explain building data-driven detection playbooks and a repeatable security monitoring operation.
- Security Chaos Engineering: Sustaining Resilience in Software and SystemsApplies resilience engineering and experimentation to security programs so systems withstand and recover from attacks.
Threat intelligence & hunting 3
- Attribution of Advanced Persistent Threats: How to Identify the Actors Behind Cyber-EspionageSystematic framework for attributing state-linked intrusions, covering evidence types, analytic methods, and communication.
- Practical Threat Intelligence and Data-Driven Threat Hunting: A hands-on guide to threat hunting with the ATT&CK™ Framework and open source toolsConnects threat intelligence to hypothesis-driven hunting using MITRE ATT&CK, data modeling, and open-source tooling.
- Threat Hunting in the Cloud: Defending AWS, Azure and Other Cloud Platforms Against CyberattacksPractical approaches to proactive threat hunting across AWS, Azure, and hybrid cloud environments.
Forensics & investigation 3
- Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious SoftwareHands-on training in static and dynamic malware analysis, debugging, and reverse engineering.
- The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac MemoryDefinitive reference on volatile memory analysis from the Volatility Framework developers.
- The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer EspionageClassic true account of an astronomer tracing a 75-cent accounting error to a KGB-linked hacker.
Offensive security & adversary emulation 3
- Black Hat Python: Python Programming for Hackers and Pentesters, 2nd EditionBuilds offensive tooling in Python 3: sniffers, trojans, web attacks, and post-exploitation techniques.
- Hacking: The Art of Exploitation, 2nd EditionFoundational tour of programming, memory corruption, networking attacks, shellcode, and cryptanalysis from the attacker's view.
- Tribe of Hackers Red Team: Tribal Knowledge from the Best in Offensive CybersecurityInterviews with prominent red teamers on careers, adversary emulation, and working with defenders.
AI, machine learning & security 3
- Machine Learning and Security: Protecting Systems with Data and AlgorithmsApplies machine learning to anomaly detection, malware analysis, network defense, and fraud, including adversarial pitfalls.
- Not with a Bug, But with a Sticker: Attacks on Machine Learning Systems and What To Do About ThemAccessible account of adversarial machine learning, real AI system attacks, and organizational defenses.
- The Developer's Playbook for Large Language Model Security: Building Secure AI ApplicationsOWASP Top 10 for LLMs lead explains prompt injection, data leakage, and securing LLM applications.
Phishing, fraud & social engineering 3
- Fancy Bear Goes Phishing: The Dark History of the Information Age, in Five Extraordinary HacksYale law professor examines five landmark hacks to explain why cybersecurity is a human problem.
- Social Engineering: The Science of Human Hacking, 2nd EditionExplains pretexting, influence, elicitation, and phishing techniques, plus how organizations can defend against them.
- Spam Nation: The Inside Story of Organized Cybercrime—From Global Epidemic to Your Front DoorInvestigative reporting on Russian spam and pharma-fraud networks and the underground economy behind them.
Cloud, software & security engineering 4
- Alice and Bob Learn Application SecurityApproachable guide to secure design, coding, testing, and building an application security program.
- Building Secure and Reliable Systems: Best Practices for Designing, Implementing, and Maintaining SystemsGoogle engineers integrate security and site reliability engineering across design, code, operations, and recovery.
- Security Engineering: A Guide to Building Dependable Distributed Systems, Third EditionComprehensive reference on designing systems that resist error and malice, spanning technology, economics, and psychology.
- Threat Modeling: Designing for SecurityPractical methods, including STRIDE, for finding and addressing security flaws during system design.
Network security 2
- The Practice of Network Security Monitoring: Understanding Incident Detection and ResponseExplains collecting and analyzing network data to detect and respond to intrusions using open-source tools.
- Zero Trust Networks: Building Secure Systems in Untrusted Networks, 2nd EditionUpdated guide to zero trust architecture: identity, device trust, policy enforcement, and migration scenarios.
Cryptography, privacy & identity 1
- Real-World CryptographyExplains how cryptographic protocols are used in practice, from TLS and messaging to cryptocurrencies and hardware.
Critical infrastructure & OT 4
- Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital WeaponInvestigative history of Stuxnet, the cyberweapon that sabotaged Iran's uranium enrichment centrifuges.
- Countering Cyber Sabotage: Introducing Consequence-Driven, Cyber-Informed Engineering (CCE)Presents Idaho National Laboratory's CCE methodology for protecting critical infrastructure against high-consequence attacks.
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, Second EditionHands-on coverage of ICS architecture, security monitoring, threat hunting, and assessments in OT environments.
- Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous HackersChronicles Russia's GRU hacking unit, from Ukrainian grid attacks to the NotPetya outbreak.
Cyber conflict, national security & intelligence 3
- The Hacker and the State: Cyber Attacks and the New Normal of GeopoliticsArgues that states use cyber operations mainly to shape geopolitics through espionage, sabotage, and destabilization.
- The Perfect Weapon: War, Sabotage, and Fear in the Cyber AgeNew York Times correspondent traces how cyber operations became central instruments of national power.
- This Is How They Tell Me the World Ends: The Cyberweapons Arms RaceJournalist's account of the zero-day exploit market and its role in the global cyberweapons race.
Governance, risk & leadership 4
- How to Measure Anything in Cybersecurity Risk: Second EditionReplaces qualitative risk matrices with quantitative, probabilistic methods for measuring and communicating cyber risk.
- Measuring and Managing Information Risk: A FAIR ApproachIntroduces the FAIR model for analyzing information risk in financial terms.
- The Phoenix Project: A Novel about IT, DevOps, and Helping Your Business Win (5th Anniversary Edition)Business novel showing how DevOps principles align IT operations, security, and business outcomes.
- Tribe of Hackers Security Leaders: Tribal Knowledge from the Best in Cybersecurity LeadershipInterviews with CISOs and security leaders on building teams, programs, and careers.
Academic journals and conference papers
Recent journal articles and conference papers, newest first within each topic. Conference papers are marked. Links lead to the DOI record or the conference publisher's page. The one-line notes are mine: why I think a security leader should read it.
- Incident response & recovery
- Security operations & detection
- Forensics & investigation
- AI security
- Phishing, fraud & social engineering
- Cloud, identity & network security
- Software & supply chain security
- Critical infrastructure, OT & IoT
- Cyber conflict & threat intelligence
- Governance, risk & economics
- Privacy & cryptography
- People, training & human factors
Incident response & recovery 16
- Cyber incident prevention and response for small and medium sized enterprises: A scoping review Open accessReviews 195 studies and finds SME research skews to prevention over response; useful for leaders supporting smaller subsidiaries or suppliers.
- Cybercrime investigations in practice: Insights from the LockerGoga ransomware attack on Norsk Hydro Open accessCase study of Norway's investigation of the Norsk Hydro attack, arguing for pre-agreed information sharing and structured case management.
- Inside ransomware groups: An analysis of their origins, structures, and dynamics Open accessSystematic review of Conti, LockBit and BlackCat/ALPHV showing business-like operations, RaaS models and multi-level extortion.
- Say less: Reframing the risks of ransomware negotiation Open accessAnalysis of 318 negotiations: talking usually cuts ransoms over 60% but creates nearly a 50% risk of extra data-leak channels.
- Sequence Learning over Behavioral Attack Patterns for Early Detection of Human-Operated Ransomware Open accessModels ATT&CK technique sequences from 15 recent ransomware families to flag human-operated ransomware early in the attack chain.
- When crisis communication meets forensics: managing narratives in ransomware, third-party, and nation-state attacks Open accessPractitioner interviews show crisis communication becomes an operational tool during incidents, varying by ransomware, third-party or nation-state attack.
- From cyber security incident management to cyber security crisis management in the European Union Open accessExplains how EU law defines a cyber crisis versus an incident and how new rules expand mandatory incident reporting.
- Learning from safety science: designing incident reporting systems in cybersecurity Open accessBorrows from safety science to fix under-reporting: report near misses and weak controls, with nonpunitive, independent reporting and feedback.
- Modelling and simulating organizational ransomware recovery: structure, methodology, and decisions Open accessSimulation models compare how different organizational recovery solutions affect resilience to ransomware, to inform recovery investment decisions.
- Deception in double extortion ransomware attacks: An analysis of profitability and credibility Open accessGame-theory model suggests criminals will often claim data theft whether or not it happened, which matters when weighing extortion demands.
- Economics of incident response panels in cyber insurance Open accessShows how insurers' panels of incident response firms work economically, including bait-and-switch risks, before you rely on your policy's IR provider.
- Enabling per-file data recovery from ransomware attacks via file system forensics and flash translation layer data extraction Open accessProposes restoring individual ransomware-encrypted files on flash storage, rather than whole disk images, at negligible performance cost.
- Between a rock and a hard(ening) place: Cyber insurance in the ransomware era Open accessInterviews 96 experts on whether cyber insurance helps against ransomware; market hardening raises standards but can leave some uninsurable.
- Moving towards agile cybersecurity incident response: A case study exploring the enabling role of big data analytics-embedded dynamic capabilities Open accessCase-study framework of five analytics capabilities across four maturity stages for making incident response faster, more flexible and learning-driven.
- Operations-informed incident response playbooks Open accessProposes linking playbook steps to a model of business operations so responders see operational impact; demonstrated on a ransomware playbook.
- Understanding How National CSIRTs Evaluate Cyber Incident Response Tools and Data: Findings from Focus Group Discussions Open accessFocus groups with 15 national CSIRTs reveal no standard way to evaluate IR tools and data, and propose candidate criteria.
Security operations & detection 16
- MotifTrace: multi-stage attack investigation via automated stage discovery and path reconstruction on provenance graphs Open accessAutomatically splits multi-stage attacks into stages and reconstructs full attack paths from provenance data without labelled training data.
- Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities Open accessIdentifies four root causes of SOC alert fatigue, where current fixes fall short, and how human-AI collaboration could help.
- Building a Better SOC: Towards the Ontology for Security Operations Center Assistance and Replication (OSCAR) Open accessExpert-informed ontology of the people, processes and technology a SOC needs, aimed at a unified approach to building one.
- Threat Hunting the Shadows: Detecting Adversary Lateral Movement With Elasticsearch Open accessHands-on hunt for lateral movement and credential access using a custom Elasticsearch SIEM with KQL/Lucene queries against simulated adversary TTPs.
- A Machine Learning and Optimization Framework for Efficient Alert Management in a Cybersecurity Operations Center Open accessFilters benign alerts, clusters similar ones and routes them by analyst expertise, cutting backlog about 60% per shift on real SOC data.
- Alert Prioritisation in Security Operations Centres: A Systematic Survey on Criteria and Methods Open accessSystematic survey of the criteria and methods SOCs use to prioritise alerts, weighing automation against human-AI teaming.
- Enhancements to Threat, Vulnerability, and Mitigation Knowledge for Cyber Analytics, Hunting, and Simulations Open accessMerges five public threat, vulnerability and mitigation sources into one linked graph that hunters can traverse from indicators to threats and back.
- Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance Conference paper Open accessHost intrusion detection over provenance graphs that scores anomalous events and reconstructs attacks into compact summaries analysts can act on quickly.
- On the inadequacy of open-source application logs for digital forensicsTests logs from 60 open-source apps and finds many lack timestamps and identifiers needed for incident timelines and correlation.
- Towards Human-AI Teaming to Mitigate Alert Fatigue in Security Operations Centres Open accessFramework for SOCs to shift between automated, augmented and collaborative decision modes so analysts are not overwhelmed by alert volume.
- Unveiling the Hunter-Gatherers: Exploring Threat Hunting Practices and Challenges in Cyber Defense Conference paper Open accessInterviews 22 experienced threat hunters on how they work, finding mixed methods catch subtle threats and challenges are as organisational as technical.
- A systematic method for measuring the performance of a cyber security operations centre analyst Open accessExpert-derived, weighted method (SOC-AAM), trialled in two SOCs, for quantifying analyst performance and incident report quality.
- Alert Alchemy: SOC Workflows and Decisions in the Management of NIDS Rules Conference paper Open accessInterviews 17 practitioners on how SOCs create and tune detection rules, recommending feedback loops and capturing tacit knowledge to improve alert quality.
- AMiner: A Modular Log Data Analysis Pipeline for Anomaly-based Intrusion Detection Open accessPresents an open-source pipeline for fast log parsing, anomaly detection and alerting, shown in three use cases.
- SoK: History is a Vast Early Warning System: Auditing the Provenance of System Intrusions Conference paperSystematizes provenance-based auditing and shows log reduction plus compression can cut telemetry retention costs by orders of magnitude, with detection trade-offs.
- Technical performance metrics of a security operations center Open accessFinds most SOC metrics are operational, not technical, and offers a framework for metrics that show a SOC's real defensive impact.
Forensics & investigation 7
- Forensic system bias: Systemic factors shaping digital forensic decision-making Open accessIdentifies ten organisational factors across five European countries that introduce bias into digital forensic decisions, arguing for system-level fixes.
- A scenario-based quality assessment of memory acquisition tools and its investigative implications Open accessEvaluates open-source and commercial RAM acquisition tools across four investigative scenarios; all have weaknesses, though milder than expected.
- From IaC to IoC—Using Infrastructure as Code (IaC) to Generate Synthetic Datasets of Compromised (IoC) Linux Systems for Use in Digital Forensics Open accessUses infrastructure-as-code to generate realistic compromised Linux images for training incident responders and testing forensic tools.
- Leveraging LLMs for Memory Forensics: A Comparative Analysis of Malware Detection Open accessCompares GPT-4o, o1, Gemini and Grok 3 on memory dumps; reasoning models do better but false positives remain high.
- Limits to the Forensic Analysis of Container Applications in Cloud Environments Open accessShows critical forensic evidence is often unavailable to responders in AWS EKS, Fargate and ECS deployments, especially at lower access levels.
- A comprehensive analysis of the role of artificial intelligence and machine learning in modern digital forensics and incident response Open accessReviews how AI and machine learning could make DFIR investigations faster and more precise, while noting adoption is still early.
- volGPT: Evaluation on triaging ransomware process in memory forensics with Large Language Model Open accessPairs an LLM with Volatility to spot masquerading ransomware processes in memory, reporting high accuracy across five ransomware families.
AI security 26
- AI Agents Under Threat: A Survey of Key Security Challenges and Future PathwaysFrames agent security around unpredictable inputs, opaque execution, changing environments and untrusted external entities; useful for agentic AI threat modeling.
- AI governance: a systematic literature review Open accessSynthesizes who is accountable, what is governed, when and how, across team-to-international levels; a quick map for building AI governance.
- Generative AI in cybersecurity: A comprehensive review of LLM applications and vulnerabilities Open accessOpen-access review covering both defensive LLM applications in security and the vulnerabilities of LLMs themselves.
- Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road AheadReviews how LLMs are used to find and fix software vulnerabilities and where results fall short; informs AppSec tooling decisions.
- Large Language Models for Cyber Security: A Systematic Literature ReviewSystematic review of how LLMs are applied to security tasks such as vulnerability detection, malware analysis and incident response, with open challenges.
- Responsible artificial intelligence governance: A review and research framework Open accessReviews responsible-AI governance research and organizes it into structural, relational and procedural practices organizations can adopt.
- Security and Privacy Challenges of Large Language Models: A SurveyBroad, heavily cited map of LLM attack surfaces (jailbreaks, poisoning, data leakage, privacy) and defenses; a solid baseline for LLM risk assessments.
- "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models Conference paperLarge study of real jailbreak prompts shared online, how they evolve, and how well current LLM safeguards resist them.
- A survey of large language models for cyber threat detectionHighly cited survey of using LLMs for threat detection; useful for judging where LLM-based detection tooling is mature.
- A Survey on Evaluation of Large Language ModelsComprehensive guide to what, where and how to evaluate LLMs, including robustness and trustworthiness; grounds model-acceptance testing.
- A survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly Open accessWeighs how LLMs help security, how attackers misuse them, and where models themselves are vulnerable, in one open-access survey.
- A survey on large language model based autonomous agents Open accessWidely cited primer on how LLM agents are built, applied and evaluated; helps leaders understand what autonomy they are being asked to secure.
- Accountability in artificial intelligence: what it is and how it works Open accessDefines AI accountability as answerability and offers a seven-feature framework covering compliance, reporting, oversight and enforcement goals.
- Auditing large language models: a three-layered approach Open accessProposes coordinated governance, model and application audits for LLMs; a practical template for structuring AI assurance programs.
- Backdoor Learning: A SurveyStandard taxonomy of backdoor (trojan) attacks and defenses in deep learning; relevant when sourcing third-party or outsourced models.
- Formalizing and Benchmarking Prompt Injection Attacks and Defenses Conference paper Open accessGives a formal framework and open benchmark for prompt injection attacks and defenses across models; useful for testing LLM-integrated apps.
- Managing extreme AI risks amid rapid progressLeading AI researchers set out large-scale risks from autonomous AI and call for urgent technical safety work and adaptive governance.
- PentestGPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing Conference paper Open accessFinds LLMs handle pentest subtasks well but lose overall context, and shows a modular LLM tool that completes more real-world tests.
- Poisoning Web-Scale Training Datasets is Practical Conference paperShows attackers can cheaply poison popular web-scraped training datasets, e.g. by buying expired domains; a wake-up call on AI supply chains.
- Risk Management in the Artificial Intelligence Act Open accessInterprets the EU AI Act's Article 9 risk-management requirements, helping providers of high-risk AI systems plan for compliance.
- Defending ChatGPT against jailbreak attack via self-remindersMeasures how jailbreak prompts bypass ChatGPT safeguards and tests a simple system-prompt 'self-reminder' that sharply cuts success rates.
- From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacy Open accessWidely cited look at ChatGPT jailbreaks, offensive misuse and defensive uses of generative AI; a good executive-level orientation.
- I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and DefencesExplains how attackers clone models behind paid prediction APIs and which defenses still hold up; key for protecting model IP.
- Large Language Models for Code: Security Hardening and Adversarial Testing Conference paperShows code assistants can be steered to produce more secure or deliberately vulnerable code; relevant to any AI coding-tool rollout.
- The Threat of Offensive AI to OrganizationsCatalogs how adversaries can use AI against organizations and ranks the threats with input from industry and academia.
- Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data PoisoningReviews 100+ papers on training-data poisoning, organizing threat models, attacks and matching defenses; essential for securing ML data pipelines.
Phishing, fraud & social engineering 11
- Examining newly registered phishing domains at scale Open accessTracks 15,000+ new phishing domains living about 8.6 days on average; supports registrar-level and early-blocking defenses against impersonation.
- Deepfake Detection: A Comprehensive Survey from the Reliability PerspectiveAssesses deepfake detectors on transferability, interpretability and robustness, and proposes a reliability metric for real-world and legal use.
- Human Performance in Deepfake Detection: A Systematic Review Open accessReviews 40 studies: human deepfake detection varies widely, interventions give mixed results, and human-AI teaming looks promising.
- Understanding the Efficacy of Phishing Training in Practice Conference paperLarge field study in a healthcare organization finding annual and embedded phishing training produce little measurable reduction in click rates.
- Devising and Detecting Phishing Emails Using Large Language Models Open accessCompares LLM-written and human-crafted phishing emails on real users and tests LLMs as detectors; shows how AI cuts attacker costs.
- Digital deception: generative artificial intelligence in social engineering and phishing Open accessShows generative AI boosts social engineering through realistic content, sharper targeting and automated infrastructure, with a framework and countermeasures.
- Exploring the evidence for email phishing training: A scoping review Open accessReview of 42 studies finds phishing training gives short-term gains but little evidence of lasting behavior change; informs awareness budgets.
- Human performance in detecting deepfakes: A systematic review and meta-analysis of 56 papers Open accessAcross 86,000+ participants, people detect high-quality deepfakes at roughly chance level; training and AI support help only modestly.
- The health belief model and phishing: determinants of preventative security behaviors Open accessSurvey finds perceived barriers, self-efficacy and prior experience predict safe email behavior, guiding how to design phishing-resilience programs.
- The human factor in phishing: Collecting and analyzing user behavior when reading emailsCollects how different user groups judge phishing versus legitimate emails, pointing to email features that should shape tailored training.
- Warning: Humans cannot reliably detect speech deepfakes Open accessExperiment shows listeners miss a large share of synthetic voices even after training; directly relevant to voice-based CEO fraud.
Cloud, identity & network security 19
- Exploiting Kubernetes’ Image Pull Implementation to Deny Node Availability Open accessDemonstrates how Kubernetes' blind spot on image downloads lets attackers starve worker nodes, and offers an eBPF-based detection stopgap.
- KubeSec: Automatic Detection of Takeover Risks Introduced by Third-Party Apps in the Kubernetes EcosystemShows over-permissioned third-party Kubernetes apps enable cluster takeover; automated analysis found hundreds of insecure access patterns and 21 new CVEs.
- Trust Quantification on Zero Trust Architecture: A Survey Open accessSurveys how to score user, device and session trust for dynamic zero-trust access decisions, with evaluation criteria tied to core ZTA tenets.
- Usable authentication: Are we there yet? Open accessTraces authentication from passwords to passkeys, finding progress but fragmented, ecosystem-bound and exclusionary solutions; argues for continuous, user-choice approaches.
- A Survey on Explainable Artificial Intelligence for Internet Traffic Classification and Prediction, and Intrusion Detection Open accessArgues security teams need to understand why AI flags traffic, reviewing explainable-AI methods for traffic classification and intrusion detection.
- An In-Depth Analysis of Password Managers and Two-Factor Authentication ToolsUses the Bonneau framework to compare password managers and 2FA tools, weighing the security-usability trade-offs of combining them.
- Network intrusion datasets: A survey, limitations, and recommendationsCompares 89 public intrusion-detection datasets on 13 properties, exposing limitations that matter when judging vendor or in-house NIDS accuracy claims.
- Online Network DoS/DDoS Detection: Sampling, Change Point Detection, and Machine Learning Methods Open accessReviews real-time DoS/DDoS detection methods, their efficiency-accuracy trade-offs and deployment challenges, and proposes a unified detection framework.
- Reinforcement-Learning-Based Intrusion Detection in Communication Networks: A Review Open accessSurveys deep reinforcement learning for intrusion detection across IoT, industrial control and smart-grid networks, with datasets, metrics and reported gains.
- Towards Understanding and Defeating Abstract Resource Attacks for Container PlatformsFinds 501 shared-kernel resources unprivileged containers can exhaust across clouds, a multi-tenant denial-of-service risk, and proposes a low-overhead confinement fix.
- Unveiling the Covert Vulnerabilities in Multi-Factor Authentication Protocols: A Systematic Review and Security Analysis Open accessSystematically evaluates MFA protocols against eight criteria, exposing design-level flaws and mitigations relevant to anyone assuming MFA equals strong security.
- A Hybrid System Call Profiling Approach for Container ProtectionCombines static and dynamic analysis to build per-phase system-call allowlists for containers, sharply shrinking kernel attack surface across 193 Docker images.
- An Automated Multi-Layered Methodology to Assist the Secure and Risk-Aware Design of Multi-Factor Authentication Protocols Open accessOffers an iterative, automated way to assess MFA designs against risk, regulation and usability, demonstrated on a national government identity use case.
- Why Aren't We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication Conference paper Open accessInterviews 28 security leaders and FIDO2 experts on passkey deployment barriers, including account recovery, user friction, regulation and culture, with recommendations.
- A Comprehensive Framework for Migrating to Zero Trust Architecture Open accessSynthesizes published research into a process-driven reference framework for migrating an enterprise to zero trust, and flags gaps in current approaches.
- Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive SurveyExplains how barely altered traffic can evade deep-learning intrusion detectors, with a taxonomy of attacks and defences; widely cited.
- FIDO Gets Verified: A Formal Analysis of the Universal Authentication Framework ProtocolFormally verifies FIDO UAF, pinpoints assumptions each security goal depends on, and reveals practical attacks on popular Android apps with fixes.
- Security Misconfigurations in Open Source Kubernetes Manifests: An Empirical StudyCatalogues 11 categories of Kubernetes manifest misconfigurations across 92 open-source repositories and argues for security-focused review and static analysis of manifests.
- SoK: Run-time security for cloud microservices. Are we there yet? Open accessReviews 807 papers and 30+ industry tools on microservice run-time security, concluding the field is immature with notable gaps and misleading claims.
Software & supply chain security 15
- A Systematic Literature Review on Detecting Software Vulnerabilities with Large Language ModelsMaps 263 studies (2020–2025) on LLM-based vulnerability detection, with a taxonomy, dataset review and limitations useful for assessing AI code-scanning claims.
- Implicit security requirements classification with large language models using the OWASP application security verification standard: a shift-left approach Open accessShows LLMs can flag hidden security requirements against OWASP ASVS categories nearly as well as fine-tuned models, supporting shift-left security.
- Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers Open accessAnalyzes 1,899 open-source MCP servers, finding MCP-specific vulnerabilities and tool-poisoning exposure; essential before connecting AI agents to enterprise tools.
- Package Hallucinations as Phantoms in Open-source Software Supply Chains: An Empirical Security AnalysisShows AI coding assistants recommend nonexistent packages that attackers can register; real developers installed them, and search augmentation did not help.
- Large Language Model Supply Chain: A Research Agenda Open accessMaps the LLM supply chain from infrastructure to foundation models to applications, with security and privacy risks at each layer.
- Research Directions in Software Supply Chain SecurityFrames the three main supply chain attack vectors (dependencies, build infrastructure, developer social engineering) and the research agenda to counter them.
- Software Security Analysis in 2030 and Beyond: A Research Roadmap Open accessLeading researchers chart how security analysis must evolve for interconnected and AI-co-written code to find deeply hidden vulnerabilities.
- BOMs Away! Inside the Minds of Stakeholders: A Comprehensive Study of Bills of Materials for Software Systems Conference paper Open accessSurveys 138 practitioners on creating and using SBOMs, identifying 12 adoption challenges and four actionable solutions.
- Dependabot and security pull requests: large empirical study Open accessLarge study of automated dependency-update pull requests, showing how developers handle them and how long vulnerabilities linger before fixes merge.
- Testing RESTful APIs: A SurveyReviews 92 studies on automated REST API testing and fuzzing, mapping what works and the many open problems in verifying APIs.
- Journey to the Center of Software Supply Chain Attacks Open accessPractitioner-oriented taxonomy of open-source supply chain attacks with matching safeguards and Risk Explorer, a tool for exploring the risks.
- OpenSSF Scorecard: On the Path Toward Ecosystem-Wide Automated Security Metrics Open accessApplies OpenSSF Scorecard across npm and PyPI to compare security practices and gaps, informing how to vet open-source dependencies at scale.
- SLR: From Saltzer and Schroeder to 2021…47 Years of Research on the Development and Validation of Security API Recommendations Open accessReviews 883 recommendations for making security and crypto APIs usable, finding few are empirically validated; informs secure-by-default platform choices.
- Software Bills of Materials Are Required. Are We There Yet?Distills the top five benefits and challenges of SBOM adoption following US Executive Order 14028, drawn from 200 industry articles.
- SoK: Taxonomy of Attacks on Open-Source Software Supply Chains Conference paper Open accessAttack tree of 107 open-source supply chain attack vectors linked to 94 incidents and 33 safeguards, with practitioner ratings of safeguard cost and utility.
Critical infrastructure, OT & IoT 15
- Evaluating the characteristics and impacts of cyberattacks on healthcare facilities: Insights from the European repository of cyber incidents (EuRepoC) Open accessCompares 2023-2025 attacks on hospitals with other sectors, finding credential and public-app exploitation; recommends drills and early intelligence sharing.
- Exploring dimensions and metrics of cyber-to-physical impact: A systematic review Open accessOffers a seven-dimension model and metric framework for measuring how cyber incidents translate into physical ICS consequences.
- From backup restoration to Minimum Viable Factory Recovery: A systematization of ransomware recovery in manufacturing systems Open accessShows why OT ransomware recovery is more than restoring backups and proposes restoring a minimum trusted production capability first.
- Sunspec Modbus Based Smart Inverter Cyber-Attack Modeling and Mitigation SchemeDemonstrates how insecure Modbus links to grid-support inverters can be attacked, and tests a lightweight cryptographic fix on a testbed.
- A case of smart devices that compromise home cybersecurity Open accessFinds new CVE-rated flaws in a popular consumer smart-device line using only freeware, a reminder of weak IoT baseline security.
- Cyber vulnerabilities and technical regulation of China-made CCTV IoT surveillance cameras in Australia Open accessFinds exploitable vulnerabilities in CCTV cameras in government buildings and argues current regulation leaves gaps needing mandatory guidelines.
- From Dis-empowerment to empowerment: Crafting a healthcare cybersecurity self-assessment Open accessPilots a healthcare self-assessment index that pairs technical checks with staff empowerment, raising awareness and ownership of security.
- Measuring the Security Posture of IEC 61850 Smart Grid Substations Against Supply Chain Attacks Open accessDefines risk metrics for substation devices compromised before shipment, folding vendor assessment into smart-grid supply-chain risk.
- Situation Awareness for Cyber Resilience: A review Open accessReviews how situation awareness underpins cyber resilience in critical infrastructure, with a taxonomy of what resilient monitoring needs.
- A Survey of IoT Privacy Security: Architecture, Technology, Challenges, and Trends Open accessBroad survey of IoT security and privacy risks from firmware flaws to hospital deployments, plus testing methods and legal developments.
- Detection and Analysis of Broken Access Control Vulnerabilities in App–Cloud Interaction in IoTShows that app-to-cloud access-control flaws expose IoT devices, finding nine vulnerabilities across four manufacturers' ecosystems.
- Improving IoT Security With Explainable AI: Quantitative Evaluation of Explainability for IoT Botnet DetectionEvaluates how trustworthy explanations from IoT botnet-detection models are, useful for leaders demanding explainable AI in security tooling.
- Knowledge-based Cyber Physical Security at Smart Home: A Review Open accessReviews smart-home threats, vulnerabilities and knowledge-driven countermeasures, mapping where current defenses and evaluations fall short.
- Spatial-Temporal Data-Driven Model for Load Altering Attack Detection in Smart Power Distribution NetworksDetects and localizes attacks that manipulate high-wattage loads on distribution grids, outperforming prior models on IEEE benchmarks.
- Threat modeling of industrial control systems: A systematic literature review Open accessSurveys ICS threat-modeling methods, favouring structured frameworks covering safety and security, and flags that many remain unvalidated.
Cyber conflict & threat intelligence 26
- Adaptive machine learning based cyber threat intelligence in industrial control systems: A systematic literature review Open accessFinds ML-driven ICS threat intelligence lacks integrated cross-layer defense, citing data scarcity and trust gaps, and proposes an architecture.
- Deception and Detection: Why Artificial Intelligence Empowers Cyber Defense over Offense Open accessArgues AI favours defenders because it excels at pattern recognition but struggles with the creative deception offense requires.
- Private regulation of cyber proliferation: from norm entrepreneurship to a quasi-export control regime Open accessExplains how tech firms now enforce norms against offensive-tool proliferation through attribution reports and service denial.
- State-sponsored cyber conflict: How Russia responds to election interference allegations on social mediaAnalyses Russia-linked proxy accounts' tactics for discrediting election-interference accusations and deepening social divisions.
- Unpacking state-sponsored cyber conflict: Intelligence-driven strategic competition in cyberspaceFrames state cyber campaigns as intelligence-driven strategic competition, with implications for deterrence, persistent engagement and resilience.
- A Comprehensive Survey of Threat Intelligence Research: A Measurement-Based Study Open accessReviews 200+ threat-intelligence studies from 2001-2025 and measures dataset quality problems that limit CTI programs.
- Automated ATT&CK Technique Chaining Open accessOpen-source tools that predict an adversary's preceding and next ATT&CK techniques to help incident responders anticipate moves.
- Going public about cyber attacks: public threat sensitivity and support for escalation in the United States and Russia Open accessSurvey experiments show how public attribution of cyberattacks shapes citizen support for escalation, including kinetic responses.
- Minding the gap? The strategic logic of cyber coercion in theory and practiceExamines why US policymakers still pursue cyber coercion despite scholarly doubts, and how to bridge theory and practice.
- Non-kinetic naval strategy: the role of cyber operations in modern maritime conflict Open accessArgues cyberattacks on maritime assets are deliberate gray-zone strategy for intelligence, signaling and shaping below armed conflict.
- Stuxnet revisited: From cyber warfare to secret statecraftReinterprets Stuxnet as covert diplomacy and secret statecraft rather than warfare, reframing how to read state cyber operations.
- The rise of responsible behavior: Western commercial reports on Western cyber threat actors Open accessShows vendor threat reporting on Western actors declined 2010-2022 and became geopolitically biased, a caution for CTI consumers.
- Unveiling Cyber Threat Actors: A Hybrid Deep Learning Approach for Behavior-Based Attribution Open accessProfiles threat actors from command-execution behavior for 'soft attribution', potentially cutting incident-response analyst workload.
- A systematic literature review on advanced persistent threat behaviors and its detection strategy Open accessPRISMA review of APT detection, recommending multi-stage behavior detection combined with vulnerability and attack-path analysis.
- Improving Automated Labeling for ATT&CK Tactics in Malware Threat Reports Open accessShows simple NLP feature selection beats embeddings for auto-tagging malware reports with MITRE ATT&CK tactics.
- Narrow windows of opportunity: the limited utility of cyber operations in war Open accessUses the Russo-Ukrainian war to show cyber operations rarely deliver physical destruction but can target critical infrastructure strategically.
- TTPXHunter: Actionable Threat Intelligence Extraction as TTPs from Finished Cyber Threat Reports Open accessAutomatically extracts ATT&CK TTPs from finished threat reports with high accuracy, turning prose intelligence into actionable data.
- A Review on C3I Systems' Security: Vulnerabilities, Attacks, and Countermeasures Open accessCatalogues vulnerabilities, attacks and countermeasures for civil and military command-and-control systems, with a countermeasure taxonomy.
- Authoritarian multilateralism in the global cyber regime complex: The double transformation of an international diplomatic practice Open accessExplains authoritarian states' push for multilateral cyber governance and how democracies responded with multistakeholder approaches.
- Cybersecurity in UK Universities: mapping (or managing) threat intelligence sharing within the higher education sector Open accessMaps fragmented threat-intelligence sharing among universities and the insurance and reputational barriers holding it back.
- Dark Web Marketplaces: Data for Collaborative Threat Intelligence Open accessReleases a multi-year dataset of cyber-related dark web listings and the scraping methods, supporting OSINT-driven threat intelligence.
- Maximizing the benefits from sharing cyber threat intelligence by government agencies and departments Open accessModels the economic value of government-shared CTI, showing benefits are greatest where an organization underestimates its threat level.
- Saving face in the cyberspace: Responses to public cyber intrusions in the Gulf Open accessIdentifies how Gulf states rhetorically manage reputational damage after public intrusions, beyond simply attributing the attack.
- Strategic studies and cyber warfare Open accessTraces why the idea of cyber operations as 'warfare' fell out of favour in scholarship and what that means for strategy.
- The role of insurers in shaping international cyber-security norms about cyber-warUses NotPetya war-exclusion disputes to show how insurers shape norms and liability for state-sponsored cyberattacks.
- What Are the Attackers Doing Now? Automating Cyberthreat Intelligence Extraction from Text on Pace with the Changing Threat Landscape: A Survey Open accessSurveys automated CTI extraction from reports and articles, highlighting purposes, sources and the shortage of quality labeled data.
Governance, risk & economics 22
- A Qualitative Examination of Stressors Contributing to Burnout Among Chief Information Security Officers (CISOs)Interviews with 37 CISOs map six interacting stressor categories, from culture to resourcing to external pressure, that drive burnout in the role.
- Chief Information Security Officers on Top Management Teams: Impact on Firms’ InnovationEvidence that putting the CISO on the top management team boosts innovation by reducing risk, enabling cloud adoption and protecting IP.
- Cybersecurity leadership acceptance of frameworks and standards with UTAUT2 Open accessSurvey of 53 US security leaders finds habit, not perceived value, is the only significant driver of continued security-framework use.
- Disclosure of Cybersecurity Investments and the Cost of CapitalSEC filings from about 2,000 firms show specific, non-boilerplate disclosure of security investment lowers debt and equity costs.
- Do data localization policies really improve cybersecurity outcomes? Open accessGlobal econometric analysis finds data localization laws have no discernible effect on breach likelihood, informing regulatory and data-residency debates.
- A history of cyber risk transfer Open accessTraces how reinsurance, parametric cover, warranties and cyber cat bonds emerged, giving context for today's risk-transfer options.
- A strategic cybersecurity oversight framework: a board’s imperative Open accessGives boards a sensemaking framework for scanning, interpreting and acting on cyber threats across routine, attack and recovery phases, with real cases.
- Asymmetric Learning Effects of Chief Information Officer Outside Board Appointments: Cybersecurity Implications for Sender and Receiver FirmsFirms adding an outside CIO to their board see fewer breaches, while the CIO's home firm can face higher breach risk.
- Insurance versus digital harm: a content analysis of home and cyber insurance policies in the USA and UK Open accessContent analysis of 50 US/UK policies shows what home and cyber insurance actually cover, useful when reading your own policy wording.
- Promoting research on cyber threat intelligence sharing in ecosystems Open accessFrom 40 interviews, identifies ten factors that make threat-intelligence sharing succeed or stall, useful when designing ISAC and partner-sharing programmes.
- The effect of organizational cyber resilience on cyber incident outcomes Open accessSurvey of 110 practitioners: higher resilience scores did not predict better post-incident outcomes, a caution for anyone reporting resilience metrics to boards.
- Toward effective cybersecurity management: a hierarchical process model with performance assessment Open accessDelphi-built process and performance model that adds the structured measurement standards-based ISMS programmes lack, helping leaders gauge control effectiveness.
- Does Cyber Insurance Promote Cyber Security Best Practice? An Analysis Based on Insurance Application Forms Open accessMaps insurer application questions to ISO 27001, NIST CSF and Cyber Essentials, finding governance and recovery controls underrepresented.
- Economics and optimal investment policies of Attackers and Defenders in cybersecurity Open accessExtends the Gordon-Loeb model to a game where attacker and defender both optimise spend, framing how much to invest in security.
- Enhancing cyber insurance strategies: exploring reinsurance and alternative risk transfer approaches Open accessInterviews with 20 reinsurers explain why cyber capacity is tight and how ILS and public-private partnerships could expand it.
- Improving Threat Mitigation Through a Cybersecurity Risk Management Framework: A Computational Design Science Approach Open accessIntroduces ATT&CK-Link, linking hacker-community data to MITRE ATT&CK so risk management can prioritise threats, illustrated on hospital systems.
- The barriers to sustainable risk transfer in the cyber-insurance market Open accessMarket simulations show poor loss-data sharing raises premiums and shrinks capacity, explaining pricing pressures buyers face.
- ‘There was a bit of PTSD every time I walked through the office door’: Ransomware harms and the factors that influence the victim organization’s experience Open accessShows ransomware harms reach staff wellbeing and reputation, and that preparedness, leadership culture and crisis communication shape how organizations fare.
- Executive decision-makers: a scenario-based approach to assessing organizational cyber-risk perception Open accessScenario workshops with an executive team reveal how leaders perceive cyber risk, assign ownership and handle uncertainty before and during incidents.
- How cyber insurance influences the ransomware payment decision: theory and evidence Open accessGame theory plus 65 expert interviews show whether insured victims pay ransoms depends on attack severity and data exfiltration.
- Information Technology Innovativeness and Data-Breach Risk: A Longitudinal StudyFinds IT-innovative firms suffer more breaches, but managerial IT/security expertise and board connections weaken the link.
- Risk mitigation services in cyber insurance: optimal contract design and price structure Open accessModels when insurers should fund risk-mitigation services for policyholders, clarifying who ends up paying for prevention bundled into cyber policies.
Privacy & cryptography 13
- Cybersecurity in the quantum era: Assessing the impact of quantum computing on infrastructure Open accessEvaluates quantum threats to encryption across infrastructure layers including cloud, and proposes a nine-component blueprint for quantum-resilient defences.
- From Lines of Code to Lines of Policy? Exploring Software Developers’ Perceptions of Their Privacy Policy–Related Activities Open accessDeveloper interviews show how symbolic compliance opens gaps between published privacy commitments and what software actually does.
- Institutional Approaches to Post-Quantum Cryptography: A Comparative Analysis of Migration Frameworks Open accessCompares NIST, ANSSI, BSI, CRYPTREC and ENISA migration guidance and offers a 10-step PQC playbook including hybrid modes and crypto-agility.
- Post-Quantum Software Updates with Stateful Hash-Based Signatures and The Update FrameworkShows how to combine The Update Framework with stateful hash-based signatures to secure software updates through the post-quantum transition.
- Salt Typhoon and the Limits of "Quantum Security": A Technique-Level Audit Open accessAudit finds 79-93% of Salt Typhoon techniques exploited device weaknesses quantum security cannot fix, tempering quantum-security vendor claims.
- A Survey of Threshold Signatures: NIST Standards, Post-Quantum Cryptography, Exotic Techniques, and Real-World Applications Open accessSurveys conventional and post-quantum threshold signatures, including NIST efforts, relevant to custody of high-value signing keys.
- Evaluation framework for quantum security risk assessment: A comprehensive strategy for quantum-safe transition Open accessSTRIDE-linked framework for assessing quantum risk across algorithms, certificates and protocols before, during and after PQC migration.
- Making Web Applications GDPR Compliant: A Comparative Evaluation of GDPR-Enforcement Frameworks Open accessBenchmarks three technical GDPR-enforcement frameworks, finding each covers only a subset of requirements, a reality check for privacy engineering tooling.
- The Effect of Platform Policies on App Privacy Compliance: A Study of Child-Directed Apps Open accessAcross 7,377 child-directed apps, platform policy changes cut unconsented data flows, but third-party SDKs remain a persistent compliance risk.
- A Bilingual Longitudinal Analysis of Privacy Policies Measuring the Impacts of the GDPR and the CCPA/CPRA Open accessLongitudinal policy corpus shows CCPA duties were adopted only after CPRA, and growing reliance on legitimate interests under GDPR.
- Analyzing Cryptography in the Wild: A RetrospectiveTwo leading cryptographers reflect on finding flaws in deployed cryptography, offering lessons on how real-world crypto actually fails.
- “Those things are written by lawyers, and programmers are reading that.” Mapping the Communication Gap Between Software Developers and Privacy Experts Open accessInterviews reveal a one-way communication gap that makes privacy requirements feel like a hindrance to developers, with fixes for privacy programmes.
- Data Security on the Ground: Investigating Technical and Legal Requirements under the GDPR Open accessClusters GDPR Article 32 fines to show what regulators penalise as inadequate security, including cases with no actual incident.
People, training & human factors 8
- The Impact of Threatening Cybersecurity Situations on Employees: A Conceptualization of Security PerplexityDefines 'security perplexity', pressure plus confusion under ambiguous threats, and recommends procedural walkthroughs so staff act rather than avoid.
- What skills do cybersecurity professionals need?Analysis of 12,161 job ads and 49,002 Stack Overflow posts ranks communication and project management as top soft skills by role.
- Future skills of a cybersecurity defence teamPractitioner interviews forecast broader defence-team remits and heavier reliance on soft skills like critical thinking, guiding hiring and development.
- Redesigning cybersecurity awareness-raising and training programs: insights from professionals on knowledge, skills and educational practicesProfessionals say awareness programmes must be audience-tailored and designed by teams mixing technical depth with communication skills.
- Security awareness, decision style, knowledge, and phishing email detection: Moderated mediation analyses Open accessExperiment with 291 participants suggests knowledge combined with analytical thinking, not awareness alone, improves phishing detection.
- Shadow information security practices in organizations: The role of information security transparency, overload, and psychological empowerment Open accessSurvey of 433 workers: security overload and empowerment drive shadow security workarounds, while transparency about security reduces them.
- Assessing information security culture: A mixed-methods approach to navigating challenges in international corporate IT departments Open accessDemonstrates combining surveys and interviews to measure security culture in multinational IT teams, surfacing communication and training gaps.
- Cybersecurity when working from home during COVID-19: considering the human factors Open accessRemote-worker study shows psychological and social factors shape security behaviour, arguing against one-size-fits-all awareness programmes.