Guide to Finding the Best Infosec News for Security Engineers
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
Security engineers, the practitioners who build detection systems, write SOAR playbooks, review security architectures, conduct threat modeling, and develop secure code, have a distinct set of information needs that general cybersecurity news sources rarely serve well. The technical depth required to understand a novel memory corruption vulnerability, implement a detection rule for a new malware technique, or evaluate a cryptographic implementation requires sources that go beyond executive summaries.
This guide is for security engineers, detection engineers, AppSec practitioners, and red team operators who need technical depth alongside current threat intelligence. We cover sources that provide the content density and technical quality that drives actual engineering work.
Decryption Digest, Best for Daily Threat Intelligence With Technical Depth
Decryption Digest provides daily threat intelligence that covers the technical details security engineers need for operational work: specific ATT&CK techniques used in active campaigns, malware technical capabilities, vulnerability exploitation details beyond CVSS scores, and the specific detection rule logic and IOCs that translate threat intelligence into SIEM and EDR coverage.
For detection engineers, Decryption Digest's coverage of novel malware techniques, C2 communication patterns, and evasion techniques provides the threat research input that drives detection rule updates. When a new malware family uses a novel Windows API combination for process injection or implements a new C2 protocol, Decryption Digest covers the technical details that inform detection engineering before it becomes a widespread campaign.
Free daily email at decryptiondigest.com/newsletter.
tl;dr sec, Best for Security Engineering Content Aggregation
tl;dr sec, curated by Clint Gibler, is the most valuable weekly aggregation of technical security engineering content available. Each edition collects the week's best security blog posts, conference talks (DEF CON, Black Hat, USENIX Security), tooling releases, and research papers across offensive security, detection engineering, AppSec, and cloud security.
The curation quality is consistently high, the newsletter surfaces content from practitioner blogs, academic papers, and conference presentations that would take hours of independent monitoring to find. For security engineers who want to stay current on the technical state of the art without spending 10 hours per week browsing Twitter/X and RSS feeds, tl;dr sec is an indispensable weekly read.
The content focus is not current events or threat intelligence, it is the technical craft of security engineering. It is a complement to a daily briefing, not a substitute for one.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Vendor Security Research Blogs, Primary Sources for Technical Depth
The highest-quality technical security research is published by vendor security research teams: PortSwigger (web application security), Google Project Zero (vulnerability research), CrowdStrike Intelligence (malware analysis), ESET Research (malware and APT analysis), Secureworks CTU (threat actor TTP analysis), and Microsoft MSTIC (platform threat intelligence).
For security engineers who need to understand a specific vulnerability class or threat technique at implementation depth, not just an executive summary, these research blogs are the primary sources. A Project Zero analysis of a browser engine vulnerability includes the root cause, exploitation methodology, and patch analysis at a level that drives meaningful defensive engineering work.
Follow the RSS or social feeds for the research teams most relevant to your work domain. For web security engineers: PortSwigger, Google Project Zero, and the OWASP blog. For detection engineers: ESET Research, CrowdStrike Intelligence, and Elastic Security Research. For cloud security engineers: Wiz Research, Unit 42 Cloud Threat Intelligence, and Microsoft Defender for Cloud blog.
Conference Talk Repositories and Academic Research
DEF CON and Black Hat talks represent the cutting edge of security research, new attack techniques, novel evasion methods, and original vulnerability research that will not appear in vendor blogs or news sources for months. Both conferences publish full video recordings of talks within weeks of the event.
For security engineers who want to understand emerging attack techniques before they are operationalized by threat actors, watching relevant DEF CON and Black Hat talks is the highest-value learning investment available. Identify the talks most relevant to your domain (web security, Windows internals, cloud security, reverse engineering) and build a systematic review workflow rather than trying to watch everything.
ArXiv's security and cryptography section (cs.CR) provides access to pre-print academic research on cryptographic vulnerabilities, protocol weaknesses, and novel attack techniques before peer-reviewed publication. For engineers working on cryptographic systems or protocol security, ArXiv monitoring is a meaningful research advantage.
Decryption Digest (daily technical threat intel)
Best for: technically-grounded daily briefing covering active threats with detection engineering implications.
tl;dr sec (weekly aggregation)
Best for: best technical security content of the week across offensive security, AppSec, and detection engineering.
Google Project Zero blog (as published)
Best for: deep vulnerability research at implementation depth with root cause and exploitation analysis.
PortSwigger Research (as published)
Best for: web application security research and new vulnerability class documentation.
DEF CON and Black Hat recordings (annually)
Best for: emerging attack techniques and original security research six to twelve months ahead of mainstream coverage.
The bottom line
Security engineers need both current threat intelligence and technical depth: Decryption Digest for daily actionable threat coverage, tl;dr sec for weekly technical content aggregation, and primary research sources (Project Zero, PortSwigger, ESET Research, CrowdStrike Intelligence) for the domain-specific depth that drives engineering work. The combination covers the threat landscape and the technical craft without requiring hours of unstructured browsing. Subscribe to Decryption Digest at decryptiondigest.com/newsletter to anchor your daily threat intelligence reading.
Frequently asked questions
What security research blogs are worth following?
Prioritize primary research over aggregators. Top vendor research blogs: Google Project Zero (vulnerability research), PortSwigger (web security), ESET Research (malware analysis), CrowdStrike Intelligence (threat actor TTPs), Elastic Security Research (detection engineering), Wiz Research (cloud security), and Microsoft MSTIC (platform threats). Academic: USENIX Security proceedings and ArXiv cs.CR. Community: Didier Stevens blog (malware analysis tooling), Adam Shostack (threat modeling), and Chris Doman (threat intelligence).
How do I stay current on detection engineering techniques?
Subscribe to Decryption Digest for daily threat intelligence that drives detection rule requirements, read Elastic Security Research and CrowdStrike Intelligence blogs for detection content, follow the Sigma rules GitHub repository for community-contributed SIEM detection rules mapped to ATT&CK, and watch Detection Engineering-focused talks from Blue Team Con and MITRE ATT&CKcon. The Sigma community GitHub repository is particularly valuable, it surfaces new detection opportunities for emerging threats faster than any single vendor.
How do I find security research relevant to my specific technical domain?
Use domain-specific conference tracks as your primary filter: BSides talks for community security research, USENIX Security and IEEE S&P for academic research, Black Hat Briefings for applied vulnerability research, DEF CON villages (AppSec village, Hardware village, Cloud village) for domain-specific deep dives. On Twitter/X, curate a security research list of practitioners in your specific domain rather than following general security accounts. The signal-to-noise ratio is dramatically better with domain-specific curation.
How do security engineers stay current on cloud security vulnerabilities?
Follow Wiz Research and Orca Security for cloud vulnerability research. Subscribe to AWS Security Bulletins, Azure Security Updates, and GCP Security Bulletins via email. The CloudSecList newsletter aggregates cloud security news. ScoutSuite, Prowler, and Steampipe provide open-source cloud misconfiguration scanning that generates direct awareness of gaps in your specific environment. The most efficient approach for cloud-native environments combines a daily practitioner briefing for threat intelligence context with automated misconfiguration scanning that surfaces environment-specific risks rather than generic advisories.
What security engineering concepts should I study to build better detections?
Focus on three areas: threat actor TTPs for your primary threat profiles (MITRE ATT&CK is the reference, but read primary research from CrowdStrike, Mandiant, and Microsoft MSTIC for the technique detail ATT&CK abstracts away), operating system internals for the platforms you defend (Windows kernel internals for Windows-heavy environments, Linux security model for cloud environments), and detection engineering methodology (Sigma rule authoring, SIEM query optimization, false positive management). The SpecterOps blog, Elastic Security Research, and the Detection Engineering Weekly newsletter are particularly useful for building detection depth.
How do security engineers participate in the broader security research community?
The most accessible entry points are: contributing YARA rules or Sigma detection rules to public repositories (Florian Roth's signature-base, SigmaHQ), participating in threat hunting communities on Discord and Slack, presenting findings at BSides local conferences, and publishing threat hunting write-ups or tool releases on GitHub. For vulnerability researchers, HackerOne and Bugcrowd bug bounty programs provide structured environments for testing skills against real targets with legal authorization. CTF participation (DEF CON CTF, PicoCTF) builds offensive skills that directly improve the quality of defensive detection engineering.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.