Cybersecurity books, reviewed honestly.

Thomas and Hunt's career-defining set of practical heuristics for writing software professionally — orthogonality, broken-windows, DRY, tracer bullets, and the underlying argument that craftsmanship is a posture, not a process.

A foundational text on memory-corruption exploitation across Linux, Windows, Solaris and embedded targets. Pre-modern-mitigations in spirit but still the canonical introduction to the techniques the modern toolchain is built to defeat.

The deepest book ever written on the strange, accreted security model of the web browser.

The exhaustive reference for web app pentesting, comprehensive but increasingly a historical document.

Nicole Perlroth's reporting on the global zero-day market: how exploits get bought, by whom, and how the gray-then-black market shapes which vulnerabilities get fixed and which get hoarded.

Adam Shostack's practitioner-oriented introduction to threat modeling: STRIDE, attack trees, and how to fit the practice into a real software-development lifecycle.

Andy Greenberg's investigative narrative of how Bitcoin's allegedly-anonymous public ledger became, in the hands of researchers and federal investigators, the most powerful OSINT tool of the last decade.

An interview anthology of practitioners answering the same set of career and craft questions, useful as a wide-angle view of how working security people actually think about the field.

Parmy Olson's reconstruction of LulzSec, AntiSec, and the early-2010s Anonymous moment — the chat logs, the infighting, the Sabu turn, and the FBI takedown that ended the era.

Malcolm McDonald's developer-side primer on the OWASP-class issues, framed around real attacks and defended with code patterns rather than vendor products.

The canonical Microsoft Press reference on Windows internals: how processes, threads, memory and system services are actually implemented in the modern Windows kernel. User-mode focus in this volume.

Evan Gilman and Doug Barth's pre-marketing-bubble treatment of zero-trust architecture — what it is when you actually implement it (trust evaluation, device identity, dynamic policy) versus what the vendor pitch turned it into.