Stay Current

Cyber security moves fast enough that a course finished six months ago is already missing things.

You don't fix that by reading everything. You fix it by having a handful of good sources running in the background and letting osmosis do the work — not by treating this page as homework.

How to actually do this

Pick a feed reader (something like FreshRSS, which is free and self-hostable, or a hosted one like Feedly) and add a handful of the sources below. Skim headlines. Click through when something's actually relevant to what you're learning. That's it.

Start here

These are written for a general audience, not just practitioners — good for building the habit before the jargon gets heavier.

• Krebs on Security — deep, patient investigative reporting from Brian Krebs, one of the most respected names in the field
• Bleeping Computer — fast, readable coverage of breaches, malware and vulnerabilities as they happen
• The Hacker News — high-volume, easy-to-read roundup of what's currently going on
• Have I Been Pwned — latest breaches — see new breaches land in the same tool from the Security Tools page

Once you want more depth

Still readable, but assumes a bit more background.

• Risky Business News — a newsletter-style weekly wrap that's genuinely good at explaining why something matters, not just that it happened
• The Register – Security — sharp, often funny, and doesn't take vendor marketing at face value
• Troy Hunt's blog — the person behind Have I Been Pwned, writing about breaches, passwords and the state of the industry generally

Know these exist, even if you don't read them daily

Not reading material so much as reference lists — worth knowing where they are for when you actually need them.

• CISA Known Exploited Vulnerabilities (KEV) catalog — the US government's list of vulnerabilities that are actually being exploited right now, not just theoretically dangerous. Ties directly into the risk-based thinking in Think Like a Security Person — a KEV listing is one of the strongest "yes, patch this now" signals there is
• ASD's ACSC alerts — the Australian Signals Directorate's Cyber Security Centre, the local equivalent for anyone in Australia
• Ransomware.live — tracks ransomware group activity and victims as it's reported

Further down the line

More technical, more niche, and easy to bounce off early on — worth coming back to once the fundamentals from Get the Foundations and Learn to Investigate have settled in.

• Checkpoint Research and ESET WeLiveSecurity — vendor research teams publishing detailed malware and campaign analysis
• Microsoft Threat Intelligence — Microsoft's own threat research, given the sheer amount of the internet running on their platforms
• Watchtowr Labs — offensive security research, written for people who already know their way around a vulnerability report

---

If a term in any of these stops making sense, that's what the Cyber & IT Glossary is for.