Most lists of the best cybersecurity books are really pentest lists, and that leaves anyone headed for a SOC, a Windows team or a cloud account with little to read. A useful shelf covers the whole field: one book on how security fits together, a few on how attacks work, and a few on how defenders catch them. You don’t need all sixteen picks below. You need the two or three that match the job you have or want.
We grouped them into fundamentals, penetration testing and ethical hacking, Windows and cloud, defense, and red teaming, with one narrative book at the end. Books written around Kali Linux itself now live in our separate list of Kali Linux books, so this page stays on the wider field. Every pick was checked against its publisher page or catalog record and a live Amazon listing in October 2026.
Pick a Book by Where You Are
Start from the work you want to do, not from the most famous title. A beginner who opens with an EDR evasion book quits by chapter two, and a working pentester gets nothing from a fundamentals text. These are the first books we’d hand to each reader:
- New to security: Foundations of Cybersecurity, Second Edition
- New to the Linux shell: Linux Basics for Hackers, Second Edition
- Web application testing: Web Application Security, Second Edition
- Broad ethical hacking reference: Gray Hat Hacking, Sixth Edition
- Windows and Active Directory: Windows Security Internals
- SOC and blue team: Security Monitoring with Wazuh
- Red and blue working together: Practical Purple Teaming
If you’re studying for a specific certification, a general reading list is the wrong tool. Our guides for OSCP preparation, CompTIA PenTest+, CEH, Security+, CISSP and ISC2 CC map books to each exam’s current objectives.
Compare the 16 Cybersecurity Books
The date column is the day the print edition went on sale at Amazon, because that’s the edition the links below sell. Three page counts differ between sources, and the next section explains which figure the table uses for each:
| Book | Publisher, print release | Pages | Side | Best for |
|---|---|---|---|---|
| Foundations of Cybersecurity, 2nd Ed | No Starch, 2026-05-19 | 328 | Fundamentals | How the whole field fits together |
| Linux Basics for Hackers, 2nd Ed | No Starch, 2025-07-01 | 264 | Fundamentals | Linux skills before pentesting |
| Web Application Security, 2nd Ed | O’Reilly, 2024-02-27 | 444 | Offense and defense | Web attacks and the fix for each |
| Gray Hat Hacking, 6th Ed | McGraw Hill, 2022 | 704 | Offense | Broad ethical hacking reference |
| Metasploit, 2nd Ed | No Starch, 2025-01-28 | 288 | Offense | Metasploit in depth |
| Black Hat Bash | No Starch, 2024-10-01 | 344 | Offense | Scripting your own tooling |
| Windows Security Internals | No Starch, 2024-04-30 | 608 | Both | Tokens, access checks, Kerberos |
| Cloud Penetration Testing | Packt, 2023-11-24 | 298 | Offense | AWS, Azure and GCP side by side |
| Practical Social Engineering | No Starch, 2022-06-14 | 240 | Both | Phishing defense and OSINT |
| Security Monitoring with Wazuh | Packt, 2024-04-12 | 322 | Defense | Building a SOC on open source |
| Practical Purple Teaming | No Starch, 2025-10-14 | 352 | Both | Running joint red and blue exercises |
| Adversary Emulation with MITRE ATT&CK | O’Reilly, 2025-06-03 | 385 | Both | Writing threat-based emulation plans |
| Evading EDR | No Starch, 2023-10-31 | 312 | Both | How endpoint sensors see attacks |
| Red Team Engineering | No Starch, 2026-03-24 | 352 | Offense | Building red team infrastructure |
| Evasion Engineering | No Starch, 2026-07-07 | 256 | Offense | Custom tools in Go and Python |
| Sandworm | Vintage, 2020-10-20 (paperback) | 368 | Narrative | Why defense matters |
See How We Checked Dates, Pages and Stock
We searched Amazon’s catalog by publisher (No Starch Press, O’Reilly, Packt, McGraw Hill and Wiley) as well as by keyword, because keyword results bury current editions under self-published titles that appear every week. Each pick had to be a print edition sold new on Amazon on the day we checked. Contents come from the publisher’s page, its catalog record or the book’s companion repository, not from memory.
Sources disagreed on three books, and the table settles them like this:
- Adversary Emulation: O’Reilly’s catalog record gives 385 pages and November 2024 (the digital edition), Amazon gives 399 pages and June 2025 for the paperback; the table uses O’Reilly’s 385
- Gray Hat Hacking 6th: Barnes & Noble and Amazon give 704 pages, while Google Books and O’Reilly’s distribution record give 752; the table uses 704, the print listing
- Web Application Security 2nd: O’Reilly’s record gives 444 pages, Amazon 441; the table uses 444
Gray Hat Hacking’s release date also varies by a few weeks between retailers (February 16 on Amazon, March 9 at Barnes & Noble), and McGraw Hill’s own product pages returned nothing readable, so the table says 2022 and leaves it there. No Starch dates a few books a month earlier than their Amazon paperback, too: September 2023 for Evading EDR and September 2025 for Practical Purple Teaming. That gap is the publisher’s own release against the date the print copy reached Amazon.
Some well-known titles didn’t make the cut, and the reason is usually stock or overlap with another of our lists:
- The Ultimate Kali Linux Book and Kali Linux Penetration Testing Bible, now in the Kali list
- Penetration Testing by Georgia Weidman and The Hacker Playbook 3, in the PenTest+ guide
- Black Hat Python and Bug Bounty Bootcamp, in the OSCP guide
- Hacking APIs and Defensive Security Handbook, Second Edition, not in stock new on Amazon
- The Effective Red Team, a No Starch preorder that Amazon lists for February 16, 2027
Cryptography books have their own list of data security and encryption books, and AI-specific titles sit in our AI and LLM security books. Every offensive technique below belongs in a lab you own or on systems you have written permission to test. Our guide to building a pentest lab on Proxmox gives you that lab without touching anyone else’s network.
1. Foundations of Cybersecurity, Second Edition
Jason Andress wrote the book to read before you pick a side of security. It explains how the field fits together, which none of the tool books do:
This May 2026 edition is the renamed successor to Foundations of Information Security, as the cover notes. Its 18 chapters move from authentication, access control and cryptography through network, operating system, IoT and application security, then into a new chapter on AI security, SOC work and incident response, governance and compliance, and penetration testing. The last part covers social engineering, security awareness and what a security career looks like. Its projects are exercises such as classifying threat actors and designing detection rules, not terminal labs.
Not for you if you want commands to run tonight, because it is a concepts book. At $45 to $60 it is also one of the pricier picks, about $12 under its $59.99 list when we checked. Check the current price on Amazon.
2. Linux Basics for Hackers, Second Edition
OccupyTheWeb’s book teaches Linux, not hacking methodology, and that’s why it belongs on a general list. You learn the shell, permissions, processes, logging, networking and scripting, which is the groundwork every offensive book here assumes:
No Starch’s second edition reached Amazon as a paperback on July 1, 2025. It works in Kali with Python 3, takes a more careful approach to root privileges than the first edition did, updates the Bluetooth and logging chapters, and adds a closing chapter on AI in security. The 18 chapters run from text manipulation and file permissions through kernel modules, job scheduling, bash and Python scripting. A beginner who finishes it can read the commands in every other book here without stopping at each line.
Look elsewhere if you already administer Linux servers, since most of it will be review. It was $15 to $25 when we checked, well under its $39.99 list price. Check the current price on Amazon.
3. Web Application Security, Second Edition
Andrew Hoffman’s O’Reilly book is the web pick because it teaches each attack and then the defense against it, so developers get as much from it as testers do:
Its 37 chapters fall into three parts. Recon covers subdomains, API analysis and third-party dependencies. Offense runs through XSS (including mutation-based XSS), CSRF, XXE, injection, mass assignment and IDOR, prototype pollution, clickjacking and business logic flaws. Defense then takes the same attack classes one by one, alongside CSP, CORS, threat modeling, code review and CVSS scoring. The second edition adds GraphQL, cloud deployments, CDNs and server-side rendering, which is where a lot of current web bugs actually live.
Its preface explains why the examples are in JavaScript and why it teaches concepts instead of tools, so don’t expect Burp Suite walkthroughs. Pair it with Bug Bounty Bootcamp from the OSCP list if you want the hunter’s workflow. It was $30 to $40 when we checked, against a $65.99 list. Check the current price on Amazon.
4. Gray Hat Hacking, Sixth Edition
McGraw Hill’s handbook is the widest single book on ethical hacking, written by seven practitioners who teach at conferences such as Black Hat and DEF CON:
The sixth edition added seven new chapters across 30 in six parts. It opens with Ghidra and IDA Pro, moves through red and purple teams, C2 and a threat hunting lab, then spends nine chapters on Linux and Windows exploitation (kernel exploits, PowerShell and post-exploitation in modern Windows environments included). The last three parts cover IoT and software-defined radio, hypervisor attacks with a look inside Hyper-V, and AWS, Azure, containers and Kubernetes. Proof-of-concept code for each chapter sits in the GHHv6 repository on GitHub, which also holds the setup for its cloud labs. You won’t read it front to back. You’ll read the five chapters that match the job in front of you.
Age is the cost. It came out in 2022, the repository’s last commit was in May 2024, and we found no announced seventh edition, so tool versions in the exploit chapters will be behind yours. It was $30 to $40 when we checked, well under its $60 list, sold by McGraw Hill itself. Check the current price on Amazon.
5. Metasploit, Second Edition
The first edition was a long-standing Metasploit reference, and the second brings it up to date with the framework you install today. Its authors are close to the tools themselves:
According to No Starch, David Kennedy founded TrustedSec and Mati Aharoni founded OffSec. Devon Kearns co-founded the Exploit Database and Kali, Jim O’Gorman leads the Kali project at OffSec, and Daniel G. Graham, the fifth author, teaches computer science at the University of Virginia. The second edition, dated December 2024 by the publisher, follows the Penetration Testing Execution Standard. It adds Active Directory testing and a chapter on pentesting the cloud, covers newer modules, and updates its evasion chapter, which matters as much to defenders tuning their alerts as to testers. Late in the book it runs a full simulated engagement, and appendices cover lab setup and a cheat sheet. Our Metasploit Framework install guide gets the framework running if your image lacks it.
Wait on it if you haven’t done a basic pentest course yet, since it goes deep on one framework rather than the whole process. It was $35 to $45 when we checked, against a $59.99 list price. Check the current price on Amazon.
6. Black Hat Bash
Dolev Farhi and Nick Aleks teach you to write your own small tools in bash instead of only running other people’s. It is the natural follow-on once the Linux basics are in place:
The book opens with two chapters of bash syntax, then builds a lab with Kali and Docker. Its 12 chapters follow the stages of a penetration test, from reconnaissance and vulnerability scanning with tools such as Nmap and Nuclei through post-exploitation and lateral movement in the lab. Farhi is a security engineer at Palo Alto Networks, and both authors wrote Black Hat GraphQL. Because the targets run in Docker containers, the lab is lighter than a rack of Windows VMs.
If you can’t yet read a bash loop, work through Linux Basics for Hackers or a general bash scripting book first. The paperback went on sale on October 1, 2024 and was $35 to $45 when we checked, against a $59.99 list price. Check the current price on Amazon.
7. Windows Security Internals
James Forshaw of Google Project Zero has found hundreds of publicly disclosed vulnerabilities in Microsoft platforms, and this is his explanation of how Windows decides who gets access to what. Read it whether you attack Active Directory or defend it:
Across 608 pages it covers the security reference monitor, access tokens, security descriptors, access checking and auditing, then local and network authentication, Active Directory, NTLM and Kerberos. Everything is taught through PowerShell examples you run and modify, and an appendix walks you through building a small Windows domain to test against. The listings use the NtObjectManager module from Forshaw’s own tooling and are published in the book’s companion repository, whose README says to run them one at a time rather than as a whole script.
It is an internals book, not an attack playbook, so you will not find a step-by-step domain compromise in it. What you get is the reason those attacks work, which outlasts any tool. It was $40 to $50 when we checked, against a $59.99 list. Check the current price on Amazon.
8. Cloud Penetration Testing
Kim Crawley’s Packt book is the only recent multi-cloud pentest title from an established publisher that we could confirm in stock, and it treats AWS, Azure and GCP with the same structure:
Three opening chapters cover how enterprises run cloud networks, how those networks get attacked and the concepts a cloud pentest rests on. Each provider then gets three chapters: its security features, pentesting through serverless applications and tools, and pentesting containerized applications with Docker and Kubernetes. A closing chapter covers best practices and working with the cloud admins who own the account you’re testing.
The repeated pattern gives you a breadth pass on each cloud rather than depth on one, and consoles and CLIs have moved since November 2023. We found no companion repository either. It was $40 to $45 when we checked. Check the current price on Amazon.
9. Practical Social Engineering
People remain the easiest way into most organizations, and Joe Gray’s book covers that attack surface from both sides. He won the inaugural DerbyCon social engineering CTF and the TraceLabs OSINT Search Party at DEF CON 28:
It opens on the ethics of social engineering engagements, then covers OSINT with tools such as Recon-ng and theHarvester, how authorized phishing assessments are run and measured, and how to report them. The last part is the defense: proactive defense techniques, technical email controls, and turning what you find into threat intelligence. That makes it as useful to the person running a company’s security awareness training as to a tester.
Published in 2022, it is dated on specific email and domain tooling, though the human patterns haven’t changed. It was $30 to $35 when we checked, with only a few copies left from a marketplace seller. Check the current price on Amazon.
10. Security Monitoring with Wazuh
A large share of security jobs (SOC analyst, detection engineer, incident responder) sit on the defending side. Rajneesh Gupta’s book is the blue team pick because you build something real with it, a monitoring stack on open source tools:
The companion repository lists what you build across the chapters:
- Intrusion detection with Wazuh and Suricata
- File integrity monitoring
- Threat intelligence with MISP
- Automated response through Shuffle, TheHive and Cortex
- Threat hunting with Osquery
The repository also ships custom Wazuh rules for Sysmon events and a TheHive integration script, so the examples are more than screenshots. Packt aims it at SOC analysts and security engineers who know basic Linux. You can stand up the server from our Wazuh install guide for Ubuntu and follow the chapters against it, and our threat hunting books list carries on from where this one stops.
Its labs start from the Wazuh OVA that was current in 2024, and Wazuh has moved several releases since, so expect screens and menus to differ from the printed ones. Look elsewhere if you want vendor-neutral SOC theory; this is one platform done well. It sold for $20 to $30 when we checked, well below its $44.99 list. Check the current price on Amazon.
11. Practical Purple Teaming
Alfie Champion built purple team functions for a decade, in-house and while consulting with MWR InfoSecurity, and his book turns that into a method you can run with your own red and blue teams:
Part one sets out the atomic and scenario-based methods and frames them with MITRE ATT&CK, the Cyber Kill Chain and the Pyramid of Pain. Part two is the lab: you set up an environment, collect telemetry, then run living-off-the-land techniques from the Atomic Red Team library, Active Directory recon with MITRE Caldera and a domain compromise with Mythic, checking at each step what the defenders saw. The last part covers reporting, tracking and turning one-off exercises into a standing program.
The labs depend on named open-source stacks, and those change faster than a print run, so budget time to adapt the setup chapters. It was $40 to $45 when we checked, with Amazon showing limited stock. Check the current price on Amazon.
12. Adversary Emulation with MITRE ATT&CK
Drinor Selmanaj’s O’Reilly book picks up where purple teaming leaves off: it shows you how to research a real threat group and turn its tradecraft into a plan your red team can execute:
The first part covers advanced persistent threats, frameworks, ATT&CK techniques seen in the wild, visualization with ATT&CK Navigator and Attack Flow, and cyber threat intelligence. The second part is the method: setting goals, researching tradecraft, planning the engagement, then implementing and executing it with tools such as Caldera, Atomic Red Team, Prelude Operator and BadBlood. The book closes with three complete emulation plans, for FIN6, APT3 and APT29.
Roughly half of it is process and intelligence work before anything runs, and three worked plans is not many. O’Reilly’s record counts 385 pages. It was $40 to $45 when we checked, with only a couple of copies in stock at Amazon. Check the current price on Amazon.
13. Evading EDR
Matt Hand spent more than a decade as a red team operator and works as a service architect at SpecterOps, yet his book is as much for the people running endpoint detection as for those trying to slip past it. It takes the EDR agent apart one sensor at a time:
Chapters cover function-hooking DLLs, process, thread, object, image-load and registry notifications, filesystem minifilters, network filter drivers, Event Tracing for Windows, scanners, AMSI, early launch antimalware drivers and the Microsoft-Windows-Threat-Intelligence provider. Each one explains what the sensor collects and the documented ways around it, and a final case study runs a detection-aware attack from start to finish.
Read it for the architecture, not as a bypass cookbook: it is Windows only, and EDR vendors have hardened their sensors since 2023. It was $40 to $45 when we checked, sold by a marketplace seller rather than Amazon. Check the current price on Amazon.
14. Red Team Engineering
Casey Erdmann’s book is about building the kit a red team runs on, from phishing infrastructure to C2, and it suits a pentester moving into red team operations:
Its 11 chapters run in three parts. The first builds offensive software: credential-harvesting web apps, Python tools for SMB brute forcing and password spraying, and custom malware design. The second automates infrastructure on AWS, covers networking for C2, reverse VPN tunnels with OpenVPN and PiVPN, and fleet management with Salt. The third puts it to work with Metasploit, a physical dropbox, phishing behind C2 redirectors and a multiplayer C2 setup.
There is no chapter on reporting or running an engagement, so it is a build book and nothing more. Stock is the bigger problem: when we checked, Amazon’s listing had a single copy from a marketplace seller at $50 to $55, against a $79.99 list. If that copy is gone, No Starch sells it direct. Check the current price on Amazon.
15. Evasion Engineering
Dennis Chow and Michael LaSalvia’s July 2026 book is the newest pick here, and it builds each tool, then switches sides to show how the tool gets caught:
You write the tools in Go and Python: a C2 implant that queues commands through Google Cloud Firestore, an SSH worm, replacements for the built-in binaries attackers usually live off, a packer that disguises shellcode as a list of IPv4 addresses, and covert exfiltration through cloud logging. The publisher asks for Go 1.21 or newer and Python 3, and the code is in the authors’ companion repository. The last two chapters switch to detection: one builds detection tools, the other runs controlled reveals that test whether a detection pipeline catches the techniques.
Its README says plainly that it is not a beginner book, and the labs need both AWS and GCP accounts. At 256 pages it is also the shortest of the red team picks. It was $40 to $45 when we checked, sold by Amazon. Check the current price on Amazon.
16. Sandworm
Andy Greenberg’s Sandworm has no labs, and it is still the book most likely to keep you studying the other fifteen. It tells the story of the Russian military intelligence hacking group behind attacks on Ukraine’s power grid and the 2017 NotPetya malware:
Penguin Random House puts NotPetya’s damage at about ten billion dollars, with ATMs, railways, postal systems and hospitals in Ukraine knocked offline. Greenberg, a senior writer at Wired, follows the researchers who traced the attacks, which shows how incident response and attribution work outside a textbook. It reads like a thriller and suits anyone weighing a move into security.
Pass on this one if you only buy books you can follow along with at a keyboard. The Vintage paperback was $10 to $20 when we checked. Check the current price on Amazon.
Check the Seller Before You Pay
Security books print in small runs, so the Amazon buy box often belongs to a marketplace seller rather than Amazon itself, and that changes what you pay and how returns work. When we checked, five listings were not sold by Amazon itself:
- Red Team Engineering: one copy left
- Metasploit, Second Edition: eight copies left
- Practical Social Engineering: four copies left
- Evading EDR: in stock
- Gray Hat Hacking, Sixth Edition: sold by McGraw Hill, nine copies left
If the listing shows a seller you don’t recognize and a price well above the band we quote, open the other buying options before you add it to the cart, since a cheaper new copy from another seller is often one click away. No Starch also sells its print books direct with the ebook included, which is worth more than a few dollars saved on a reseller copy, and ten of the sixteen picks are No Starch titles. For a reader starting from zero, Foundations of Cybersecurity plus Linux Basics for Hackers is the pair we’d buy first, and the rest of the list fills in whichever side of security you settle on.
