// Comparison

Sandworm vs The Cuckoo's Egg: Which Should You Read?

Two cybersecurity books on Threat Intelligence, compared honestly: who each is for, what each does best, and which to read first.

Beginner

5/52019

Sandworm

A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers

Andy Greenberg

Long-form journalism on the GRU's hacking operations, the best non-technical book on what state-level cyber actually looks like.

Beginner

5/51989

The Cuckoo's Egg

Tracking a Spy Through the Maze of Computer Espionage

Clifford Stoll

Clifford Stoll's first-person account of investigating a 75-cent accounting discrepancy at LBNL that turned into a year-long pursuit of a KGB-paid intruder across early-internet networks.

Read this if

Anyone who wants to understand the strategic context their day job sits inside, defenders, policy people, students choosing a path.

Anyone new to security who wants to feel why this work matters. The book that quietly recruited a generation into the field, written by an astronomer who became, almost reluctantly, the world's first detection engineer.

Skip this if

Readers wanting deep technical detail. The forensic granularity exists, but the book lives at the operational and political levels.

Readers expecting modern tradecraft. The protocols, tooling, and threat actors all date to the late 1980s. Treat it as a primary historical source, not a current operations manual.

Key takeaways

NotPetya was not a ransomware accident; it was a wartime weapon that overshot.
Attribution is slow, contested, and political, but it is also possible and increasingly precise.
The line between cybercrime and statecraft is thinner than the threat-intel literature suggests.

Detection starts with anomaly curiosity, not with rules: the entire investigation begins because Stoll cares about a 75-cent error nobody else noticed.
Cross-organisational coordination (FBI, NSA, CIA, telco, foreign intelligence) was already the bottleneck in 1986 and it's still the bottleneck today.
The narrative invented the genre that Sandworm, Countdown to Zero Day, and Tracers in the Dark now occupy.

How they compare

Sandworm and The Cuckoo's Egg are both rated 5/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target beginner-level readers, so the choice is about topic, not difficulty.

Sandworm and The Cuckoo's Egg both cover Threat Intelligence, Narrative, so reading them in sequence reinforces the same material from different angles.

Keep reading