The definitive reading list
Twenty-four books that made the field.
Every title here is on a serious cyber program's reading list, in a senior researcher's recommended-books shelf, or both. Across seven categories: history + journalism, cryptography + systems, red team, blue team, web + AppSec, career + culture, policy + ethics. Read three. Pick the one closest to where you want to work.
::category 01
History + journalism
- 01
The Cuckoo's Egg
Cliff Stoll · 1989
An astronomer at Lawrence Berkeley Lab tracks a hacker selling US military data to the KGB. Reads like a detective novel and is true. The book that turned a generation of researchers into cyber-detectives.
- 02
Sandworm
Andy Greenberg · 2019
Definitive account of Russia's GRU Sandworm unit (Ukraine power grid, NotPetya). Greenberg's reporting at Wired is the public canon for nation-state offensive cyber.
- 03
Countdown to Zero Day
Kim Zetter · 2014
Definitive account of Stuxnet. Zetter spent years on this; every cyber-policy person cites it.
- 04
Cult of the Dead Cow
Joseph Menn · 2019
History of L0pht, cDc, the 90s hacker collectives that became the policy backbone of modern security.
- 05
This Is How They Tell Me the World Ends
Nicole Perlroth · 2021
Former NYT cyber reporter on the zero-day vulnerability market. Best journalism on the offensive economy in print.
- 06
Spam Nation
Brian Krebs · 2014
Krebs documents the rise of Russian-speaking cybercrime economy. Eastern European underground 101.
::category 02
Technical depth · cryptography + systems
- 01
Applied Cryptography
Bruce Schneier · 1996
The book that introduced a generation to crypto. Still required reading in many CS programs. Schneier's writing makes math accessible without becoming sloppy.
- 02
Serious Cryptography
Jean-Philippe Aumasson · 2017
Modern crypto handbook. AES, RSA, elliptic curves, post-quantum. Tighter and more current than Schneier's foundational text.
- 03
Security Engineering
Ross Anderson · 2008 / 2020 (3rd ed)
Cambridge professor's comprehensive textbook. Free PDF on his website. Covers everything from threat modeling to specific system case studies. Foundational.
- 04
Hacking: The Art of Exploitation
Jon Erickson · 2008 (2nd ed)
C, assembly, debugging, buffer overflows — Erickson teaches the underlying systems-level mechanics. Includes a live-Linux CD with the practice environment.
::category 03
Red team · pentesting + offensive
- 01
The Web Application Hacker's Handbook
Dafydd Stuttard + Marcus Pinto · 2011 (2nd ed)
Written by the creators of Burp Suite. Required reading for OSCP, OSWE, and every AppSec interview. Slightly dated on specifics — supplement with PortSwigger Web Security Academy.
- 02
The Hacker Playbook 3
Peter Kim · 2018
Practical penetration-testing methodology. Closer to a working playbook than a textbook. Useful for OSCP prep + early pentest careers.
- 03
Red Team Field Manual
Ben Clark · 2014
Pocket-reference of commands + syntax. Quick lookups during engagement work. Companion: Blue Team Field Manual.
- 04
Penetration Testing: A Hands-On Introduction
Georgia Weidman · 2014
Methodical step-through for the absolute beginner. Pairs well with TryHackMe's intro paths.
::category 04
Blue team · IR + detection
- 01
Practical Malware Analysis
Michael Sikorski + Andrew Honig · 2012
Definitive book on static + dynamic malware analysis. Used in every undergraduate reverse-engineering course. Pair with the labs that ship with the book.
- 02
The Art of Memory Forensics
Michael Hale Ligh + Andrew Case + Jamie Levy + Aaron Walters · 2014
The Volatility team's textbook. Memory forensics for IR, malware analysis, threat hunting. Required for the GREM cert pipeline.
- 03
Network Security Monitoring
Richard Bejtlich · 2013
Bejtlich's NSM doctrine remains canonical for blue-team detection engineering. Read before deploying Zeek/Suricata in production.
- 04
Intelligence-Driven Incident Response
Scott Roberts + Rebekah Brown · 2017 (2nd ed 2023)
The CTI + IR integration playbook. Lockheed-Martin Kill Chain + Diamond Model + ATT&CK woven into operational doctrine.
::category 05
Web + AppSec
- 01
Real-World Bug Hunting
Peter Yaworski · 2019
Tour of disclosed HackerOne bug bounty findings categorized by vulnerability class. Real reports + how they were found.
- 02
Bug Bounty Bootcamp
Vickie Li · 2021
Methodology + recon + write-up advice for bug bounty hunters. Pairs with hands-on HackerOne practice.
::category 06
Career + culture
- 01
Tribe of Hackers
Marcus J. Carey + Jennifer Jin (eds.) · 2019 + Red Team / Blue Team / Leaders editions follow
Long-form interviews with 70+ named cyber researchers. The fastest way to absorb the field's social context + career paths.
- 02
Sandworm
Andy Greenberg · 2019
(Listed in journalism too — also belongs here for career context: it's the book aspiring nation-state-cyber-defenders read to understand what they'd actually be defending against.)
- 03
Cyber Wars
Charles Arthur · 2018
British perspective on major cyber events. Lighter than Sandworm + Countdown but useful for breadth.
::category 07
Policy + ethics
- 01
The Perfect Weapon
David E. Sanger · 2018
Sanger is NYT national-security reporter who broke Stuxnet attribution. Definitive on US cyber strategy. Pairs with This Is How They Tell Me the World Ends.
- 02
Click Here to Kill Everybody
Bruce Schneier · 2018
Schneier on IoT security + policy. Anticipates the critical-infrastructure-as-cyber-target era. Reads like prophecy in 2026 retrospect.
- 03
A Hacker's Mind
Bruce Schneier · 2023
Schneier reframes 'hacking' as a general framework for finding system loopholes — applies cyber methodology to law, finance, politics. Brilliant + uncomfortable.
Three books, one summer.
The honest cyber-education move at 18-22: pick three books from this list (one history, one technical, one career), read them properly, then come back and pick three more. Beats 90% of online video courses for foundational understanding, and the social-context fluency you get from these named authors makes every interview and conference conversation downstream easier.