// What to read next
What to read after Windows Security Internals
Where to go after Windows Security Internals, picked from our catalog. The next step up from advanced level, weighted toward the topics this book covers.
01 · 2026
Hacking et Cyberdéfense
Two working pentesters who also teach the material walk through the full Active Directory kill chain, offense and defense both, in an expert-level French-language audit manual.
Advanced4/5Jacques Beirnaert-Huvelle, Guillaume Morelle02 · 2017
Windows Internals, Part 1
The canonical Microsoft Press reference on Windows internals: how processes, threads, memory and system services are actually implemented in the modern Windows kernel. User-mode focus in this volume.
Advanced5/5Pavel Yosifovich, Alex Ionescu, Mark Russinovich, David Solomon03 · 2017
Attacking Network Protocols
James Forshaw, Project Zero veteran, on how to capture, parse, and break protocols from the wire up to the application layer, with a strong focus on building reusable analysis tooling.
Advanced5/5James Forshaw04 · 2006
The Art of Software Security Assessment
The 1200-page reference on auditing C/C++ codebases for security: parsing complex memory and integer interactions, language pitfalls, and how vulnerabilities arise from interactions between layers.
Advanced5/5Mark Dowd, John McDonald, Justin Schuh05 · 2024
Evading EDR
A component-by-component teardown of how modern EDR sensors actually collect telemetry, and where each data source can be starved, blinded, or bypassed.
Advanced4/5Matt Hand06 · 2026
Practical AI Security
The founder of an AI-security firm, with a PhD in adversarial machine learning, walks from how models fail to how they're exploited to how they're defended and audited, with over 30 hands-on Python demos.
Advanced4/5Harriet Farlow07 · 2014
Practical Reverse Engineering
A working reverser's textbook from three Microsoft / Quarkslab veterans, covering the architectures and toolchain you'll actually meet on real targets, including the Windows kernel and modern obfuscation patterns.
Advanced4/5Bruce Dang, Alexandre Gazet, Elias Bachaalany08 · 2019
Rootkits and Bootkits
Matrosov, Rodionov and Bratus on persistent, deeply-embedded malware: kernel rootkits, MBR/UEFI bootkits, and the forensic techniques that surface them. Strongly Windows-internals oriented.
Advanced4/5Alex Matrosov, Eugene Rodionov, Sergey Bratus