// Comparison

Hacking et Cyberdéfense vs Windows Security Internals: Which Should You Read?

Two cybersecurity books on Offensive, compared honestly: who each is for, what each does best, and which to read first.

Advanced

4/52026

Auditer son environnement Windows

Jacques Beirnaert-Huvelle, Guillaume Morelle

Two working pentesters who also teach the material walk through the full Active Directory kill chain, offense and defense both, in an expert-level French-language audit manual.

Advanced

5/52024

Windows Security Internals

A Deep Dive into Windows Authentication, Authorization, and Auditing

James Forshaw

Forshaw takes apart the Windows security model from the SRM and access tokens up through Kerberos, with live PowerShell you can run against your own machine. The most authoritative single source on how Windows actually decides who can do what.

Read this if

French-speaking Windows administrators and security practitioners who already know the basics and want one book covering the whole Active Directory attack lifecycle, enumeration, exploitation, privilege escalation, lateral movement, persistence, and trust-relationship abuse, paired with the Tier-based defenses that actually stop it.

Vulnerability researchers, red teamers, and platform security engineers who need ground truth on tokens, SDs, logon, and the kernel security reference monitor.

Skip this if

Readers who don't read French, or beginners without prior Windows/AD or pentesting fundamentals; the publisher pitches this explicitly as an expert-level text, not an introduction.

Anyone after a high-level overview or defensive playbook. This is mechanism, not policy, and it assumes you want to read SDDL by hand.

Key takeaways

Has readers build a disposable AD lab (GOAD, NetExec-Lab) so every attack chapter is run hands-on instead of read as theory.
Covers the full AD attack lifecycle end to end, from LDAP/Kerberos fundamentals through post-exploitation and trust-relationship abuse.
Pairs the offense with a dedicated defense chapter on Tier architecture, AGDLP, and risk-prevention policy, making it as much an audit manual as an attack manual.

Windows authorization is one coherent system once you see the SRM, tokens, and security descriptors as a single pipeline.
The author's NtObjectManager PowerShell toolkit turns abstract security theory into something you can poke at interactively.
Most Windows privilege-escalation bugs come from misunderstanding this model, not from exotic memory corruption.

How they compare

We rate Windows Security Internals higher (5/5 against 4/5 for Hacking et Cyberdéfense). For most readers, that means Windows Security Internals is the primary pick and Hacking et Cyberdéfense is a useful follow-up.

Both books target advanced-level readers, so the choice is about topic, not difficulty.

Hacking et Cyberdéfense and Windows Security Internals both cover Offensive, Windows Internals, so reading them in sequence reinforces the same material from different angles.

Keep reading

Hacking et Cyberdéfense

→ Alternatives to Hacking et Cyberdéfense → What to read after Hacking et Cyberdéfense