Beat · Cybersecurity
Cybersecurity: the podcasts, blogs and shows worth following
Threat intelligence, breach reporting, and the advisories that drive enterprise security spend. These are the public sources Briefwire reads to cover it — the podcasts, blogs and shows — each fetched and checked before it is listed, and each with a note on what it is good for.
Podcasts, blogs and shows.
breach · vulnerability · ransomware · advisory
19 September 2026. Every source is English-language and public: nothing behind a paywall or a login is read.
Podcasts
Where operators and investors reason out loud at length. The receipt for a line from one of these is a timestamp.
Narrative incident retellings; ships transcripts, so episodes are extractable once wired.
- Security Now
Long-running deep-dive show on protocol and crypto weaknesses; carries transcripts.
- Security Cryptography Whatever
Deirdre Connolly, Thomas Ptacek and David Adrian arguing about real protocol decisions; ships transcripts.
Weekly analyst-grade discussion of the security news cycle with vendor-market context.
- Cloud Security Podcast by Google
Anton Chuvakin interviewing detection and cloud-security leads; candid on what SOC automation does not solve.
- Open Source Security
Josh Bressers on open-source supply chain, CVE process and CRA compliance; ships transcripts.
Blogs and newsletters
Company engineering blogs, analyst newsletters and practitioner posts. The receipt is the paragraph.
Original investigative reporting; frequently the first public account of a major breach.
Policy and cryptography commentary; the standard citation for security-economics arguments.
Fastest breach and ransomware reporting; high volume, high timeliness.
Vendor funding, M&A and product coverage — the commercial layer of the security market.
Authoritative US government advisories; the compliance-relevant primary source.
Palo Alto's threat intelligence; detailed campaign write-ups with IOCs and timelines.
Independent-leaning malware research; good technical depth on nation-state tooling.
Breach-data analysis from the operator of Have I Been Pwned; authoritative on exposure scale.
Vulnerability analysis and exploitation-likelihood assessments for prioritisation decisions.
Cloud-security research; the reference source for multi-tenant cloud vulnerability classes.
Curated daily security briefing; unusually good signal-to-noise for executive reading.
Recorded Future's newsroom; strong on state-sponsored activity and policy.
Large-telemetry threat research; quantified campaign scale from Cisco's install base.
Federal cyber policy, budget and procurement moves; dates government demand shifts.
- Microsoft MSRC Update Guide
Structured CVE and patch stream; the baseline for enterprise exposure every month.
Cloud-provider vulnerability disclosures affecting customer workloads directly.
- Google Chrome Releases
MSTIC threat-actor naming and campaign write-ups — the narrative stream, distinct from the MSRC CVE feed already tracked.
Kaspersky's research team on APT tooling; often the only public account of campaigns in non-Western telemetry.
Vulnerability and malware research with exploitation detail; publishes disclosure timelines vendors can be held to.
Cloud-proxy telemetry on phishing and encrypted-channel abuse; quantified from a large SASE install base.
Incident write-ups from the SMB and MSP estate — the segment enterprise-focused vendors do not see.
Detection engineering and the annual Threat Detection Report; the reference ranking of observed ATT&CK techniques.
Firmware and UEFI supply-chain research; the layer endpoint vendors structurally cannot inspect.
Hardware and device supply-chain integrity research; names affected OEMs and models.
Vulnerability triage with exploitation-likelihood calls; the prioritisation input for patch decisions.
Canonical's per-package advisories; the patch-availability signal for the most common server distro.
RHEL and OpenShift hardening and post-quantum migration positions from the vendor enterprises inherit defaults from.
Audit firm publishing its own findings on cryptography and TEE assumptions; full posts ship in the feed.
Aggressive n-day analysis of enterprise edge appliances, usually with a working reproduction.
Where new web attack classes get named; request smuggling and cache poisoning both originated here.
Thirty-year practitioner writing under his own name; blunt where vendor blogs hedge.
Independent analyst on AI-security convergence and where the practitioner role is heading; one reputation on the line.
Johns Hopkins cryptographer on encryption policy and protocol weaknesses; the standard technical rebuttal source.
Investigative reporter working sources directly on election security and nation-state operations; long-form originals.
Practitioner newsletter tracking new detection tooling and rules week by week; a named author's picks.
Daily practitioner diaries on exploitation activity seen in the wild; the full-text feed, after isc.sans.edu/rssfeed.xml started serving the site's HTML under a text/xml content type.
Malicious-package counts from the largest Maven and npm proxy; the volume series behind supply-chain claims.
Threat-actor attribution and annual-report data from the largest endpoint vendor.
The UK national authority's advisories and guidance; the non-US mandate source beside CISA.
ESET's researchers on European and LATAM campaigns; strong on the espionage tooling US vendors under-cover.
Software supply-chain and package-registry attacks; covered the npm worm arrests with named packages.
YouTube shows
Interviews, conference talks and explainers, read from their published captions.
Malware and incident walkthroughs; fast technical read on live campaigns.
Vulnerability-research explainers; useful for translating CVEs into business risk.
Offensive-technique demonstrations; grounds red-team capability claims in evidence.
Enterprise-facing security research briefings; the vendor-facing half of the conference circuit.
US government briefings on active campaigns and binding directives; the mandate source.
Long unedited practitioner interviews; candid on tooling choices and career signal.
Instructor webcasts and threat briefings carrying named detection detail.
Weekly unscripted infosec news and live webcasts by working testers; opinionated on tooling that fails in practice.
Bug-bounty hunter demonstrating live exploitation, including AI-assistant prompt-injection chains.
What Briefwire does with them
- 01Reads
Every source above is fetched through the day. Spoken sources are read from their published transcript or captions; written ones from the post itself.
- 02Extracts and matches
Discrete claims are pulled out, typed — a product move, a data point, a prediction, an opinion — and matched against the same claim from other publishers.
- 03Ranks and sends
The 12 lines that rank highest go out as a brief, daily or weekly at the hour you choose. A claim several independent sources made ranks higher; that counts agreement, not accuracy, and every line links to where it was said.
More on the method: how a line earns its place, what industry intelligence is, and how this differs from page monitors, podcast summarisers, industry newsletters, and the other tools you may already run.
Run one of the sources above, or think one is missing? How sources are attributed, and how to reach us.
The other industries Briefwire reads
- AI ToolingModel labs, inference platforms, and the release feeds that date every capability claim.
- Dev Tools & InfraCloud platforms, developer infrastructure, and the changelogs that date every shipped feature.
- B2B SaaS & GTMSaaS operating benchmarks, pricing and go-to-market, from operators and the tools they run on.
- E-commerce / DTCRetail and DTC economics: platform changes, channel costs, and merchant-side reality.
- Fintech & PaymentsPayments infrastructure, banking strategy, and the regulators who reset both.
- Crypto & StablecoinsDigital-asset markets, stablecoin issuance, and the protocol releases underneath them.
- Healthcare / BiotechDrug development, health-system economics, and the regulator that gates both.
- Climate & EnergyEnergy-transition project economics, utility strategy, and climate-tech capital flows.
- Semiconductors / Hardware / RoboticsSilicon supply chains, independent hardware measurement, and the robotics companies buying it all.
- Legal & RegTechLegal technology adoption, law-firm buying, and the enforcement actions that create compliance demand.
- HR & Future of WorkHiring tools, workforce data, and the employment rules that reset employer obligations.
- Insurance & InsurtechCarrier strategy, reinsurance pricing, and the distribution and core-system modernisation underneath.
- Real Estate & PropTechCommercial real-estate capital markets, mortgage technology, and construction-site digitisation.
- Logistics & Supply ChainFreight rates, capacity, forwarder margin, and the regulators who move all three.
- Manufacturing & IndustrialAutomation purchasing, plant capex, and the robotics platforms industrial buyers standardise on.
- Media & Creator EconomyPublisher revenue models, programmatic advertising, and the platform rule changes both depend on.
- GamingStudio economics, platform policy, engine migration, and the discovery data that drives publishing.
Cybersecurity in 12 lines a brief, each with a receipt.
14 days of Desk, every seat, card on file — cancel before day 14 and it is never charged. Or take three lines free by email every Monday, no account.