Cybersecurity blogs and newsletters worth following, and what each is good for

These are the blogs and newsletters Briefwire has chosen to cover Cybersecurity, each one fetched and checked before it is listed. Company engineering blogs, analyst newsletters and practitioner posts. The receipt is the post it was written in.

Start the 14-day trial See the latest brief

The list

In no ranked order. The note beside each says what it is good for, which is a different thing from how big it is.

Each note describes the publication in its own terms. Briefwire reads what these sources publish, in public, and nothing else.

Krebs on Security
Original investigative reporting; frequently the first public account of a major breach.
Schneier on Security
Policy and cryptography commentary; the standard citation for security-economics arguments.
BleepingComputer
Fastest breach and ransomware reporting; high volume, high timeliness.
SecurityWeek
Vendor funding, M&A and product coverage — the commercial layer of the security market.
CISA Advisories
Authoritative US government advisories; the compliance-relevant primary source.
Unit 42
Palo Alto's threat intelligence; detailed campaign write-ups with IOCs and timelines.
SentinelLabs
Independent-leaning malware research; good technical depth on nation-state tooling.
Troy Hunt
Breach-data analysis from the operator of Have I Been Pwned; authoritative on exposure scale.
Rapid7 Blog
Vulnerability analysis and exploitation-likelihood assessments for prioritisation decisions.
Wiz Blog
Cloud-security research; the reference source for multi-tenant cloud vulnerability classes.
Risky Business News
Curated daily security briefing; unusually good signal-to-noise for executive reading.
The Record
Recorded Future's newsroom; strong on state-sponsored activity and policy.
Cisco Talos Blog
Large-telemetry threat research; quantified campaign scale from Cisco's install base.
CyberScoop
Federal cyber policy, budget and procurement moves; dates government demand shifts.
Microsoft MSRC Update Guide
Structured CVE and patch stream; the baseline for enterprise exposure every month.
AWS Security Bulletins
Cloud-provider vulnerability disclosures affecting customer workloads directly.
Google Chrome Releases
Zero-day patch notes; the earliest warning on browser exploitation in the wild.
Microsoft Security Blog
MSTIC threat-actor naming and campaign write-ups — the narrative stream, distinct from the MSRC CVE feed already tracked.
Securelist (Kaspersky GReAT)
Kaspersky's research team on APT tooling; often the only public account of campaigns in non-Western telemetry.
Check Point Research
Vulnerability and malware research with exploitation detail; publishes disclosure timelines vendors can be held to.
Zscaler ThreatLabz
Cloud-proxy telemetry on phishing and encrypted-channel abuse; quantified from a large SASE install base.
Huntress
Incident write-ups from the SMB and MSP estate — the segment enterprise-focused vendors do not see.
Red Canary
Detection engineering and the annual Threat Detection Report; the reference ranking of observed ATT&CK techniques.
GreyNoise
Internet-wide scanning telemetry that dates mass-exploitation waves, often before vendor advisories.
Binarly
Firmware and UEFI supply-chain research; the layer endpoint vendors structurally cannot inspect.
Eclypsium
Hardware and device supply-chain integrity research; names affected OEMs and models.
Tenable Blog
Vulnerability triage with exploitation-likelihood calls; the prioritisation input for patch decisions.
Ubuntu Security Notices
Canonical's per-package advisories; the patch-availability signal for the most common server distro.
Red Hat Product Security
RHEL and OpenShift hardening and post-quantum migration positions from the vendor enterprises inherit defaults from.
Trail of Bits
Audit firm publishing its own findings on cryptography and TEE assumptions; full posts ship in the feed.
watchTowr Labs
Aggressive n-day analysis of enterprise edge appliances, usually with a working reproduction.
PortSwigger Research
Where new web attack classes get named; request smuggling and cache poisoning both originated here.
Graham Cluley
Thirty-year practitioner writing under his own name; blunt where vendor blogs hedge.
Daniel Miessler
Independent analyst on AI-security convergence and where the practitioner role is heading; one reputation on the line.
Cryptography Engineering (Matthew Green)
Johns Hopkins cryptographer on encryption policy and protocol weaknesses; the standard technical rebuttal source.
Zero Day (Kim Zetter)
Investigative reporter working sources directly on election security and nation-state operations; long-form originals.
Detection Engineering
Practitioner newsletter tracking new detection tooling and rules week by week; a named author's picks.
SANS Internet Storm Center
Daily practitioner diaries on exploitation activity seen in the wild; the full-text feed, after isc.sans.edu/rssfeed.xml started serving the site's HTML under a text/xml content type.
Sonatype
Malicious-package counts from the largest Maven and npm proxy; the volume series behind supply-chain claims.
CrowdStrike Blog
Threat-actor attribution and annual-report data from the largest endpoint vendor.
NCSC UK
The UK national authority's advisories and guidance; the non-US mandate source beside CISA.
WeLiveSecurity (ESET)
ESET's researchers on European and LATAM campaigns; strong on the espionage tooling US vendors under-cover.
ReversingLabs
Software supply-chain and package-registry attacks; covered the npm worm arrests with named packages.

How the list was made, and what we do with it

Chosen by hand: Every source is here because people who work in Cybersecurity say substantive things on it, not because it is large. Enough of them to cover the field, few enough to audit.
Checked before listing: Each feed is fetched and checked when it is added and again whenever the library is re-checked by hand: one whose newest item is more than six months old fails, and one quiet for more than three is flagged but can stay listed. Every source is English-language and public.
Read, so you need not: You do not have to read all of them. Each new post is read, and the claims worth keeping are pulled out, each linked to the post it was written in.
When it is read: Briefwire reads a beat’s sources through the day while a trial or paid account tracks it. A beat nobody tracks may not be read at all, and its page shows the library, not a live feed.
Sent as a brief: The 12 lines that rank highest across the whole Cybersecurity beat go out daily or weekly. A claim several independent sources made ranks higher — that counts agreement, not accuracy.

The blogs and newsletters are one part of the beat. Every Cybersecurity source, all media — or just the YouTube channels.

Run one of these, or think one is missing? How sources are attributed, and how to reach us.

Blogs and newsletters in other industries

Terms on this page

Cybersecurity in 12 lines a brief, each with a receipt.

14 days of Desk, every seat, card on file — cancel before the trial ends and the card is never charged.

Start the 14-day trial See the latest brief