// What to read next
What to read after Alice and Bob Learn Application Security
Where to go after Alice and Bob Learn Application Security, picked from our catalog. The next step up from beginner level, weighted toward the topics this book covers.
01 · 2021
Real-World Cryptography
David Wong's hands-on tour of the cryptographic primitives, protocols and pitfalls that show up in actual production systems, with deliberate attention to TLS, Noise, modern AEAD, and post-quantum.
Intermediate5/5David Wong02 · 2026
Maîtriser la cryptographie d'aujourd'hui et de demain
A cryptography engineer specializing in information-system security mechanisms, who also teaches the subject, builds from cryptography's mathematical foundations up to today's post-quantum standards.
Intermediate4/5Mbaye Ngom03 · 2005
Reversing
The book that taught a generation how software actually looks once you strip away the source. Still the clearest on-ramp to thinking in assembly, even with dated tools.
Intermediate4/5Eldad Eilam04 · 2018
Social Engineering
Christopher Hadnagy's broad procedural reference on social engineering as a discipline — recon, pretexting, elicitation, microexpressions, and the structured engagement model his consultancy operationalized.
Intermediate4/5Christopher Hadnagy05 · 2010
Understanding Cryptography
A genuinely teachable intro to modern cryptography that derives the math instead of hand-waving it, covering symmetric and public-key primitives without drowning you in proofs.
Intermediate4/5Christof Paar, Jan Pelzl06 · 2021
Designing Secure Software
Loren Kohnfelder, the original PKI author, on how to weave security thinking through requirements, design, implementation and operations rather than bolt it on at the end.
Intermediate5/5Loren Kohnfelder07 · 2014
Threat Modeling
Adam Shostack's practitioner-oriented introduction to threat modeling: STRIDE, attack trees, and how to fit the practice into a real software-development lifecycle.
Intermediate5/5Adam Shostack08 · 2023
Black Hat GraphQL
Aleks and Farhi on attacking GraphQL specifically: introspection abuse, batching, depth and complexity attacks, auth flaws, and the differences from REST that make GraphQL pentests their own discipline.
Intermediate4/5Nick Aleks, Dolev Farhi