Links I’ve saved over the years while working in security, prepping for interviews, and mentoring at the Lakota Cyber Academy. Grouped by topic, not ranked.
Getting into security
- Security Certification Roadmap - Paul Jerimy
- So You Want To Work in Cyber Security? - Jack Hacks
- The Cybersecurity Career and Job Hunting Guide - cyberhuntingguide
- NICE Framework - CISA
- The Security Engineer Handbook - securityhandbook.io
- The Cyber Plumber’s Handbook - opsdisk
- Linux Journey - LabEx
- CompTIA Security+ SY0-701 Course - Professor Messer
- The Missing Semester of Your CS Education - MIT
- Wizard Zines - Julia Evans
- Awesome Security - sbilly
CTFs and competitions
- picoCTF (now CyLab Security Academy) - Carnegie Mellon University
- CyberPatriot - Air & Space Forces Association
- CSAW - NYU Tandon
- The Flare-On Challenge - Mandiant FLARE
- National Collegiate Cyber Defense Competition (CCDC)
- PlaidCTF - Plaid Parliament of Pwning
- DEF CON
- Holiday Hack Challenge - SANS
- CTFtime: CTF Calendar and Team Rankings
- Wargames - OverTheWire
- TryHackMe
- Hack The Box
- pwn.college - Arizona State University
- Blue Team Labs Online
- CyberDefenders
- LetsDefend
- Competition Manual - National Cyber League
- Practice Resources - National Cyber League
- NCL Coaching Guide: Selected Challenges for Practice - CryptoKait
- Incorporating the NCL into an Intro to Computer Security Class - Adobe Express
- 101 on Code Execution Basics - Cyber Skyline Trove
- Manipulating Cookies - Cyber Skyline Trove
- CyberChef - GCHQ
- SQLite Viewer - inloop
Interviewing and career growth
- Security Engineering at Google: My Interview Study Notes - gracenolan
- Security Engineer Interview Prep - Amazon
- Interview Prep Path - Google Tech Dev Guide
- Interview Warmup - Google
- Software Engineering Interview Guide - Tech Interview Handbook
- Salary Negotiation: Make More Money, Be More Valued - Kalzumeus
- My Ten Rules for Negotiating a Job Offer - Haseeb Qureshi
- Levels.fyi
- Systematic Career Documentation: Hall of Fame Guidance - Manager Tools
- Get Your Work Recognized: Write a Brag Document - Julia Evans
- StaffEng
- Irrational Exuberance - Will Larson
- Effectively Asking for Help - Nick Groenen
- How to Be a 10x Developer - Chelsea Troy
- All-Remote Guide - GitLab Handbook
- Remote Team Management - Coursera
Coding and system design interviews
- Leetcode Patterns - Sean Prashad
- Grind 75 - Tech Interview Handbook
- Algorithms Study Cheatsheet - Tech Interview Handbook
- The Definitive Way on How to LeetCode Properly - r/cscareerquestions
- Leetcode Cheatsheet - dennyzhang
- Leetcode Questions by Company - duanehutchins
- SQLBolt
- System Design Primer - donnemartin
- System Design Interview - checkcheckzz
- Systems Design Interview Guide - Patrick Halina
- Preparing for the Systems Design and Coding Interviews - The Pragmatic Engineer
- What Happens When - alex
- Distributed Systems for Fun and Profit - Mikito Takada
- High Scalability
Threat detection
- Lessons Learned in Detection Engineering - Ryan McGeehan
- Prioritizing Detection Engineering - Ryan McGeehan
- Alerting and Detection Strategy Framework - Palantir
- Alerting and Detection Strategy Framework - Palantir GitHub
- On Detection: Tactical to Functional, Part 1 - Jared Atkinson, SpecterOps
- Detection Engineering Maturity Matrix - Kyle Bailey
- Sigma - SigmaHQ
- Detection Rules - Elastic
- Splunk Security Content
- ATT&CK Navigator - MITRE
- DeTT&CT - Rabobank CDC
- Awesome Threat Detection - 0x4D31
- Leveling Up Your Detection Engineering - Mandiant
- Detection Engineering in Modern Day Security Organization - YouTube
- A Serverless SIEM: Detecting All Baddies on a Budget - DEF CON 29
- How Google Does It: Modernizing Threat Detection - Google Cloud
- Syscall Auditing at Scale - Slack Engineering
- What is Threat Detection and Response (TDR)? - Microsoft
- Living Off the Living Off the Land - lolol.farm
- Atomic Red Team - Red Canary
- Atomic Red Team Wiki - Red Canary
Threat hunting
- Huntpedia - Sqrrl
- Hunt Evil: Your Practical Guide to Threat Hunting - Sqrrl
- PEAK Threat Hunting Framework - Splunk
- What is Threat Hunting? - Splunk
- What is Threat Hunting? - CrowdStrike
- Threat Hunting - IBM
- Threat Hunter Playbook + Mordor Datasets + BinderHub - Threat Hunters Forge
- Setting Up a Threat Hunting Lab - Cyber Wardog
- What a Cluster: How Industry Groups and Names Threat Activity Clusters - Shinigami42
Frameworks
- MITRE ATT&CK
- MITRE ATT&CK Enterprise Matrix
- MITRE ATT&CK Enterprise Mitigations
- MITRE ATT&CK Data Sources
- MITRE Cyber Analytics Repository
- OWASP Top Ten
- The Five Stages of CTEM - CTEM.org
Threat modeling
- Threat Modeling Manifesto
- Threat Modeling - OWASP
- Threat Modeling Process - OWASP
- Threat Modeling Cheat Sheet - OWASP
- STRIDE Threat Modeling for Beginners - YouTube
- Threat Modeling Using STRIDE and Attack Trees - YouTube
- Secure Code Day 04: Threat Modeling - YouTube
- Threat Modeling an LLM System - AI Village
- Awesome Threat Modelling - hysnsec
- Awesome Threat Modeling - redshiftzero
- Threat Modeling - shellsharks
Incident response and forensics
- An Incident Response Plan for Startups - Ryan McGeehan
- Security Incident Response Guide - GitLab Handbook
- Responding to Ransomware - GitLab Handbook
- Accelerating Incident Response Using Generative AI - Google Security Blog
- Practical Incident Response: Active Directory - nxb1t
- What is Incident Response? - Microsoft
- SecTemplates: Open Source Templates for Security Programs
- Lookyloo: Website Capture and Domain Tree Analysis - CIRCL
- LacusCore: Capture Engine Behind Lookyloo - AIL Project
- The DFIR Report
- 13Cubed - YouTube
- Posters and Cheat Sheets - SANS
- Velociraptor
- Volatility 3 - Volatility Foundation
- Eric Zimmerman’s Tools
Threat intelligence
- A Cyber Threat Intelligence Self-Study Plan - Katie Nickels
- CTI Self Study Plan Tracker - mattreduce
- Known Exploited Vulnerabilities Catalog - CISA
- Malpedia - Fraunhofer FKIE
- abuse.ch
Security logging
- Logging Cheat Sheet - OWASP
- Logging Vocabulary Cheat Sheet - OWASP
- C9: Implement Security Logging and Monitoring - OWASP Proactive Controls
- Awesome Security: Monitoring and Logging - sbilly
- pfelk: pfSense/OPNsense + ELK
- CyberBlue: Containerized Blue Team Platform - cyberblu3s
Endpoint security
macOS
- Objective-See
- LuLu - Objective-See
- Escaping the Microsoft Office Sandbox - Objective-See
- FOR518: Mac and iOS Forensic Analysis and Incident Response - SANS
- macOS Matrix - MITRE ATT&CK
- Launch Agent - MITRE ATT&CK
- Launch Daemon - MITRE ATT&CK
- macOS Detection Rules - Elastic
- A SOC Team’s Guide to Detecting macOS Atomic Stealers 2024 - SentinelOne
- Migraine: New macOS Vulnerability Could Bypass SIP - Microsoft
- Protecting Against Malware in macOS - Apple
- Endpoint Security Framework - Apple
- XPC - Apple
- Configuring the macOS App Sandbox - Apple
- Creating Launch Daemons and Agents - Apple
- Script Management with launchd - Apple
- PlistBuddy Guide - bravewaffles
- plutil man page - keith
Windows
- How User Account Control Works - Microsoft
- Exploit Protection - Microsoft Defender for Endpoint
- Sysmon - Sysinternals
- sysmon-config - SwiftOnSecurity
- sysmon-modular - Olaf Hartong
- Sysinternals - Microsoft
- Windows Security Log Encyclopedia - Ultimate Windows Security
- LOLBAS
Linux
Malware analysis and reverse engineering
- Practical Malware Analysis - No Starch Press
- Effective C - No Starch Press
- x86 Assembly Guide - University of Virginia
- Beej’s Guides
- Offensive Security and Reverse Engineering Course - Ali Hadi
- Offensive Software Exploitation Course - YouTube
- Strelka - Target
- Laika BOSS - Lockheed Martin
- CAPEv2 Sandbox
- CAPE Sandbox Book
- Ghidra - NSA
- Reverse Engineering 101 - Malware Unicorn
- Nightmare - guyinatuxedo
- OALabs - YouTube
Offensive security tools
- ffuf
- subfinder - ProjectDiscovery
- nuclei - ProjectDiscovery
- Nuclei Templates
- interactsh - ProjectDiscovery
- Empire - BC Security
- crt.sh: Certificate Transparency Search
- Game Hacking - dsasmblr
- Harnessing the Hive Mind: How Semgrep and Nuclei Are Shaping the Future of Security Engineering - Travis Biehn
- Hacking 700 Million Electronic Arts Accounts - Sean Kahler
Web application security
- Web Security Academy - PortSwigger
- Juice Shop - OWASP
- Application Security Verification Standard (ASVS) - OWASP
- Cheat Sheet Series - OWASP
- HackTricks
- PayloadsAllTheThings - swisskyrepo
Secure design and infrastructure
- Building Secure and Reliable Systems - Google
- The Five Factors Used to Secure Systems - Ryan McGeehan
- DevSec Hardening Framework
- Network Segmentation Cheat Sheet - sergiomarotco
- Virtual Local Area Networks (VLANs) - Home Network Guy
- How to Configure VLANs in OPNsense - Home Network Guy
- Server-Side Sandboxing: An Introduction - Figma
- CORS - Kevin Cox
- One-Woman Infra - shh (archived)
- Secure FastAPI with eBPF - InfoSec Write-ups
- MarkupSafe - Pallets
Cloud and container security
- Container Security Fundamentals - Datadog
- Linux Capabilities - Datadog
- What is Container Runtime Security? - CrowdStrike
- Open Source CWPP Solutions - Cloud with JK
- Security Best Practices - Flux
- Kubernetes Hardening Guidance - NSA and CISA
- CIS Benchmarks - Center for Internet Security
- flAWS - Scott Piper
- flAWS 2 - Scott Piper
- Hacking the Cloud
- CloudGoat - Rhino Security Labs
- Kubernetes Goat - Madhu Akula
Source control and supply chain
- About Authentication to GitHub - GitHub Docs
- Generating a New GPG Key - GitHub Docs
- Sign Git Commits with SSH - 1Password Developer
- Secure Use Reference for GitHub Actions - GitHub Docs
- Using Artifact Attestations - GitHub Docs
- Verifying Signatures with Cosign - Sigstore
- zizmor: GitHub Actions Static Analysis
- gitleaks
- Malicious Pull Requests - Datadog Engineering
Secrets and passwords
- Emergency Kit - 1Password
- How to Generate a Strong Account Password - 1Password
- Secret References - 1Password CLI
- Notice of Recent Security Incident - LastPass
- Vault - HashiCorp
- AWS Systems Manager
- Secret Manager - Google Cloud
TLS
- Transport Layer Security - High Performance Browser Networking
- OpenSSL Essentials: Working with SSL Certificates, Private Keys and CSRs - DigitalOcean
- mkcert - Filippo Valsorda
Security, data science and AI
- Awesome ML for Cybersecurity - jivoi
- Awesome Adversarial Machine Learning - yenchenlin
- Awesome RL for Cybersecurity - Kim Hammar
- Build Machine Learning Models for the SOC - Google Cloud
- AI Total: Analyzing Security ML Models with Imperfect Data in Production - arXiv
- SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity - SANS
- MSTICPy Notebooks - Microsoft
- MSTIC Notebooklets Release 0.2 - MSTICPy
- Infosec Jupyterthon
- Utilizing Generative AI and LLMs to Automate Detection Writing - Dylan Williams
- Top 10 for LLM Applications - OWASP GenAI
- LLM01: Prompt Injection - OWASP GenAI
- ATLAS - MITRE
- The Lethal Trifecta for AI Agents - Simon Willison
- Embrace The Red - Johann Rehberger
- Gandalf and Other AI Hacking Games - Lakera
- Security Risks with RAG Architectures - IronCore Labs
- AI SecOps - Wiz Academy
- What is Agentic Security? - Prophet Security
- Risks and Mitigations for Copilot Coding Agent - GitHub Docs
AI and agentic engineering
Agent design and harnesses
- Building Effective Agents - Anthropic
- How We Built Our Multi-Agent Research System - Anthropic
- Scaling Managed Agents: Decoupling the Brain from the Hands - Anthropic
- Multi-Agents: What’s Actually Working - Cognition
- The Anatomy of an Agent Harness - LangChain
- Skill Issue: Harness Engineering for Coding Agents - HumanLayer
- The Claude Code SDK and the Birth of HaaS (Harness as a Service) - vtrivedy
- Harness Engineering - Agentic AI Knowledge Base
- Agentic AI Knowledge Base
- Terminal-Bench
Agent safety
- How We Built Claude Code Auto Mode: A Safer Way to Skip Permissions - Anthropic
- An AI Agent Deleted Our CI System While I Was on the Runway at Heathrow - HelixML
Claude Code
- Claude Code Documentation - Anthropic
- Subagents - Claude Code Docs
- Agent Teams - Claude Code Docs
- Permission Modes - Claude Code Docs
- Writing a Good CLAUDE.md - HumanLayer
- The /grill-me Skill - AI Hero
- Subagent-Driven Development Skill - obra/superpowers
- How I Use Claude Code Subagents to Make My Claude Pro Limits Last Longer - Andrea Grandi
- How Building Software Is Changing at Anthropic - The Pragmatic Engineer
Prompting
- Prompt Engineering Overview - Anthropic
- Prompt Engineering Guide - DAIR.AI
- Prompt Engineering Guide - DAIR.AI GitHub
- Awesome Prompt Engineering - promptslab
- Prompt Engineering Techniques - NirDiamant
- Whitepaper Companion Podcast: Foundational LLMs and Text Generation - Kaggle 5-Day Gen AI Course
Frameworks and tools
- Model Context Protocol
- Awesome MCP Clients - punkpeye
- Playwright MCP - Microsoft
- Agents - LangChain Docs
- Deep Agents Overview - LangChain Docs
- GPT Researcher - assafelovic
- Aider
- Open WebUI Docs
- LocalAI - mudler
- Rivet - Ironclad
- AI Engineer Roadmap - roadmap.sh
People to follow
- Simon Willison
- Addy Osmani
- Beyond Vibe Coding - Addy Osmani
- Andrej Karpathy
- Armin Ronacher
- Hamel Husain
- Chip Huyen
- Lil’Log - Lilian Weng
- Shreya Shankar
- Latent Space
News, newsletters and podcasts
- tl;dr sec - Clint Gibler
- Risky Bulletin - Risky Business Media
- Unsupervised Learning - Daniel Miessler
- CloudSecList - Marco Lancini
- Talkback
- Detection Engineering Weekly - Zack Allen
- Vulnerable U - Matt Johansen
- The Pragmatic Engineer - Gergely Orosz
- Starting Up Security - Ryan McGeehan
- System Overlord
- Red Canary Blog
- Recorded Future Blog
- Cisco Talos Blog
- Mandiant Blog
- Unit 42 Threat Research - Palo Alto Networks
Podcasts
People to follow
- Katie’s Five Cents - Katie Nickels
- Kelly Shortridge
- 0-days In-the-Wild Tracker - Maddie Stone, Google Project Zero
- Zero Day - Kim Zetter
Books
- Threat Modeling: Designing for Security in an AI World, 2nd Edition - Adam Shostack
- Hacking: The Art of Exploitation, 2nd Edition - Jon Erickson, No Starch Press
- Practical Binary Analysis - Dennis Andriesse, No Starch Press
- Intelligence-Driven Incident Response, 2nd Edition - Rebekah Brown and Scott J. Roberts, O’Reilly
- Security Engineering, 3rd Edition - Ross Anderson