Stay Current

Cyber security moves fast enough that a course finished six months ago is already missing things.

You don't fix that by reading everything. You fix it by having a handful of good sources running in the background and letting osmosis do the work — not by treating this page as homework.

How to actually do this

Pick a feed reader (something like FreshRSS, which is free and self-hostable, or a hosted one like Feedly) and add a handful of the sources below. Skim headlines. Click through when something's actually relevant to what you're learning. That's it.

Start here

These are written for a general audience, not just practitioners — good for building the habit before the jargon gets heavier.

• Krebs on Security — deep, patient investigative reporting from Brian Krebs, one of the most respected names in the field
• Bleeping Computer — fast, readable coverage of breaches, malware and vulnerabilities as they happen
• The Hacker News — high-volume, easy-to-read roundup of what's currently going on
• Have I Been Pwned — latest breaches — see new breaches land in the same tool from the Security Tools page

If reading isn't your thing

Most cyber security podcasts haven't landed for the person writing this page — but Darknet Diaries is the exception. Real hacking and breach stories, told well, with no assumed background knowledge. Worth a genuine recommendation, not just a list-filler.

Once you want more depth

Still readable, but assumes a bit more background.

• Risky Business News — a newsletter-style weekly wrap that's genuinely good at explaining why something matters, not just that it happened
• The Register – Security — sharp, often funny, and doesn't take vendor marketing at face value
• Troy Hunt's blog — the person behind Have I Been Pwned, writing about breaches, passwords and the state of the industry generally

Know these exist, even if you don't read them daily

Not reading material so much as reference lists — worth knowing where they are for when you actually need them.

• CISA Known Exploited Vulnerabilities (KEV) catalog — the US government's list of vulnerabilities that are actually being exploited right now, not just theoretically dangerous. Ties directly into the risk-based thinking in Think Like a Security Person — a KEV listing is one of the strongest "yes, patch this now" signals there is
• ASD's ACSC alerts — the Australian Signals Directorate's Cyber Security Centre, the local equivalent for anyone in Australia
• Ransomware.live — tracks ransomware group activity and victims as it's reported

Further down the line

More technical, more niche, and easy to bounce off early on — worth coming back to once the fundamentals from Get the Foundations and Learn to Investigate have settled in.

• Checkpoint Research and ESET WeLiveSecurity — vendor research teams publishing detailed malware and campaign analysis
• Microsoft Threat Intelligence — Microsoft's own threat research, given the sheer amount of the internet running on their platforms
• Watchtowr Labs — offensive security research, written for people who already know their way around a vulnerability report

Broader tech culture — not security-specific, but worth having in the mix

None of these are security content. But a lot of people in this industry stay switched on partly by keeping an ear on general tech news — hardware, industry drama, whatever the latest dumpster fire is — and that context spills into security more often than you'd think.

• WAN Show — Linus Tech Tips' weekly, unscripted, genuinely long news chat. Casual, sometimes a tangent-fest, but a good pulse check on the industry
• TechLinked — LTT's sister channel, same news but tighter and faster if the full WAN Show is too much of a time investment
• Level1Techs — Wendell's channel, more enterprise/prosumer hardware and Linux-flavoured, a step more technical than the other two

Not core learning material — just good company while you're doing something else.

---

If a term in any of these stops making sense, that's what the Cyber & IT Glossary is for.