14 newsletters, ranked by editorial quality and how recently they published. Looking for something more specific? Search instead.
A practitioner's blog on using LLMs and coding agents in detection engineering, covering query writing, a packaged rule-development workflow, and metrics for maintaining a detection catalog. Posts explain the reasoning behind each design choice and the failures that shaped it.
Long-form, first-person articles on security architecture and operations, covering topics such as read-only security visibility layers, break-glass access design, and identity lifecycle processes. Readers get practical design reasoning tied to standards like NIST SP 800-53 and to a real self-hosted security stack.
Practical articles for small cybersecurity teams working with limited time, budget and staff. Issues cover lightweight project management, incident response micro-automation and justifying security spending to management.
Magonia Research publishes practical essays for SOC and detection engineers, covering false positive rate math, the Mythos exploit debate, and operationalizing attack frameworks like ATT&CK, the Kill Chain and the Diamond Model. Readers get concrete reasoning from a practitioner with long experience running SOCs and writing detection logic.
A personal blog-style newsletter by a security analyst covering SOC alert investigations, certification study methods, and lessons drawn from tactical training. Posts walk through real investigations and experiences in first-person, with practical detail.
Practical, opinionated essays for blue teamers and SOC analysts on alert fatigue, detection design, and the trade-offs of security operations. Readers get concrete frameworks such as alert budgets and commentary on the state of AppSec and defensive strategy.
sentinel.blog publishes practical notes on Microsoft Sentinel and security operations, including previews and release notes for its Sentinel-as-Code tooling. It also runs occasional reflective essays on how security analysts investigate threats.
A hobbyist blog covering malware analysis, reverse engineering (such as step-by-step Ghidra walkthroughs of Windows Minesweeper) and security tooling like QRadar pipeline monitoring. Readers get concrete, hands-on technical write-ups that show the investigative process, including dead ends.
A practitioner blog on Zero Trust, identity and security operations, currently running a multi-part series on how internet access gateways, API gateways, identity brokers and CASBs each cover only part of the access question. It explains where each control plane falls short and how AI agents make stale entitlements and unreviewed access harder to govern.
This is a vendor-run blog from Fluency, a cybersecurity platform, mixing explainers on attack techniques such as adversary-in-the-middle phishing with product-positioning pieces on AI SOC tooling. Readers get technical context on phishing and business email compromise, plus a comparative framing of AI security vendors, though the posts lean promotional.
A vendor blog from Arambh Labs covering SOC alert investigation, AI SOC platforms and analysis of live attack campaigns. It mixes threat write-ups with comparison and benchmark articles that promote the company's own Armor Investigate product.
A security-focused newsletter arguing that SOC platform buying and detection priorities are shifting beyond endpoint tooling toward cross-domain operations across identity, cloud, SaaS and AI-accelerated attacks. It mixes vendor comparison commentary with threat-activity roundups from sources like Unit 42 and The DFIR Report.
A personal blog of security and forensics writing, including reposted Palantir engineering posts on vulnerability scanning and security detection at scale. It also includes original hands-on guides, such as a threat-model-driven walkthrough for hardening a personal Android phone with GrapheneOS.
One short email a week with hand-picked newsletters from the index. Free, no spam, unsubscribe anytime.
