Cyber Security

Go beyond the basics of Tor and learn how to build private, resilient services on the dark web. From onion routing and v3 onion services to real-world threats and secure deployment, this book gives you the technical knowledge and practical skills to host privacy-critical services without exposing where they live.

Secure AI. Understand the Threats. Build More Trustworthy Intelligent Systems.Explore adversarial attacks, data poisoning, model theft, AI-enabled cyber threats, secure AI development, adversarial defenses, trustworthy AI, MLOps security, governance, privacy, red teaming, and the future of AI cybersecurity through practical concepts and real-world case studies.

Build, implement and sustain an AS/EN 9100-compliant Quality Management System with confidence. This practical guide takes you from planning and implementation through certification and ongoing improvement, with clear guidance, aerospace context and insights grounded in authoritative industry sources.

Software supply chains are now a critical attack surface. The Software Trust Chain explores how to secure code, dependencies, builds, CI/CD, containers and deployments in the age of generative AI and autonomous coding agents, focusing on practical engineering principles that remain useful as tools and platforms change.

AI-generated content is everywhere, but how do you know what is real? The AI Forensics Handbook explores the science behind detecting synthetic text, images, video and audio, revealing the signals AI leaves behind and the methods used to uncover them. Practical, rigorous and grounded in real-world limitations, this is a guide to understanding what detection can really prove.

AI models do not have to be huge, slow or expensive. Distilling Intelligence explores how to build smaller models that perform at scale, then secure the APIs that serve them. From compression and distributed serving to extraction attacks, observability and incident response, this book covers what it takes to run AI reliably in the real world.

When an attack hits the cloud, the evidence can disappear fast. Forensics in the Cloud shows defenders how to find, preserve and piece together the clues across AWS, Azure, GCP and Oracle Cloud. With practical workflows, code and real-world scenarios, it’s a hands-on guide to uncovering what happened and proving it.

Linux System Hardening is a practical guide to securing Linux systems from the kernel to the cloud. It explains how threats work, how to apply effective controls and what you give up along the way. Built for admins, security engineers and DevSecOps teams working with real production systems.

Static code analysis is more than running a linter and fixing warnings. This book shows how to build practical analysis pipelines with Claude Code and deterministic tools, combining AI-driven insights with reliable checks to improve code quality and security across projects of any size.

AI is changing fast, and so are the security risks that come with it. This practical guide shows security and technology leaders how to govern, secure and assure AI systems from design through deployment and beyond. Packed with proven frameworks, controls and real-world guidance, it turns complex AI security requirements into practical action.

Turn complex technology risks into clear, evidence-based executive decisions through visual flows, practical guidance, and a fully fictional enterprise case.

A practical reference for securing real-world OT, ICS and SCADA environments.Roadmap for engineers, CISOs, and consultants to master industrial cybersecurity. Learn to secure ICS, SCADA, and Industry 4.0 environments, apply IEC 62443 & NIS 2, and build robust defense-in-depth architectures—from real-world attack analysis to practical incident response.

Scraping is getting harder to control as bots become more sophisticated. This practical guide shows security engineers, SREs and platform architects how to build anti-scraping defenses that work at scale, from traffic analysis and behavioral detection to rate limiting, challenges, observability and continuous adaptation.

Excerpt 1 — Chapter 1, "Introduction": why cybersecurity management is not about technologyThe simplest way to manage an organization's cybersecurity is to draw up a list of technical measures ("install antivirus software," "enable multi-factor authentication," "encrypt disks") and carry them out one by one. This approach has an obvious advantage — simplicity — but also a systemic flaw: it does not answer the question of which measures this particular organization actually needs, to what extent, and what to do when there are not enough resources for "the whole list." It also creates a false sense of completeness: "we implemented everything on the list — so we are secure," even though the real level of risk depends not on the length of the list but on how well the measures match the specific threats and the value of the organization's assets. Excerpt 2 — Chapter 1: cyber risk within enterprise risk managementIf cybersecurity is about managing risk rather than a checklist of technical measures, the logical continuation of this idea is as follows: cyber risk is not a separate, isolated category discussed only by the IT department in its own language. It is one of the types of risk that any enterprise faces — alongside financial, reputational, operational, and supply chain risk. It should be managed within the same frame of reference as other enterprise risks. Excerpt 3 — Chapter 14, applying the Chapter 10 mapping methodology: where a mapping gap becomes a technical projectThe last row is the central conclusion of this step, and of the whole case study: the mapping table shows honestly that no Annex A control exists for PR.AA-04 that can simply be marked "done" and the gap considered closed. An organization relying only on the SoA, or only on the mapping table, could mistakenly conclude that because A.5.17 partially covers the topic, no further action is needed — which is exactly why the gap analysis, the SoA, and the risk register above all consistently define SSO as a separate, explicit technical project, rather than a derivative action from existing controls. Excerpt 4 — Chapter 14, closing paragraph of the bookThe running case study in this chapter has shown that the fifth step of the Chapter 7 methodology — "the organization can repeat these steps as often as needed" — is not a rhetorical flourish but a real operating cycle: MFA for contractors, backup encryption, and automatic deactivation in the ERP, each opened by a separate cycle in Chapters 6–7 and 13, were already closed and verified by the time this chapter began, and the very fact of their closure — through broadening the profiling scope to identity management across the ERP and CRM together — opened up a new, precisely formulated gap, PR.AA-04, reflected consistently and at once in the updated profile, the action plan, the SoA, the risk register, and the mapping table. It is precisely this consistency among five tools converging on a single decision, not the mere existence of each tool on its own, that is the practical upshot of building an integrated cybersecurity management system.

Build AI that keeps working when the cloud doesn't. Local-First AI Engineering shows you how to run capable, private AI systems on infrastructure you control. From hardware and inference to RAG, agents, security and production ops, you'll learn how to build local AI that is fast, reliable and truly yours.