Curated toolkit
Resources
A curated set of the references, tools and training I actually use and recommend in cyber security work.
A short, opinionated list. Everything here is something I've used or read properly — not a link dump. Edit content/pages/resources.md to make it yours.
Frameworks and references
| Resource | What it's for |
|---|---|
| MITRE ATT&CK | The shared vocabulary for attacker behaviour. Map your detections to it and your coverage gaps become obvious. |
| NCSC guidance | UK-specific, well written, and refreshingly free of vendor spin. The 10 Steps and Cyber Essentials material are good starting points. |
| CIS Controls | A prioritised list of what to fix first when everything feels urgent. |
| NIST CSF | Useful when you need a structure to hang a programme off, and a common language with auditors. |
Detection and hunting
| Resource | What it's for |
|---|---|
| Sigma | Portable detection rules. Write once, translate to your SIEM of choice. |
| Atomic Red Team | Small, safe tests to check whether a detection actually fires. |
| The DFIR Report | Real intrusions, documented end to end, with the artefacts. Some of the best free training available. |
| LOLBAS | Living-off-the-land binaries — what attackers use so they don't have to bring their own tools. |
Analysis tools
| Resource | What it's for |
|---|---|
| CyberChef | Decoding, deobfuscating and generally untangling anything. |
| VirusTotal | First stop for file and URL reputation — with the usual caveat about not uploading sensitive samples. |
| Velociraptor | Endpoint visibility and forensic collection at scale. |
| Wireshark | Still the answer when you need to know what actually crossed the wire. |
Staying current
- Krebs on Security — long-form reporting on the criminal side of the industry.
- Risky Business — a weekly news podcast with a working practitioner's filter on it.
- NCSC Weekly Threat Report — short, and worth the five minutes.
For people starting out
If you're trying to break into security, the honest advice is: build something, break something, and write about both.
- TryHackMe — guided, forgiving, good for fundamentals.
- Hack The Box — less hand-holding, more realistic.
- LetsDefend — blue-team focused, which is rarer and closer to most real jobs.
Nothing beats a home lab and a notebook. The write-up is where the learning actually sticks.