Books

As AI adoption accelerates, attacks such as prompt injection, jailbreaks, data poisoning, and agent exploitation are redefining cybersecurity. This book explains why these attacks work and provides practical strategies for building secure, resilient AI systems.

Modern web security goes far beyond the basics. This book covers advanced web attacks including injection flaws, SSRF, API abuse, request smuggling and exploit chaining, plus 2026 topics like React2Shell, HTTP/3, AI-driven attacks, WebAssembly and supply chain compromises. Built for penetration testers, application security engineers and experienced developers.

Under a swollen Melbourne moon, two hearts parted by oceans and ambition rediscover each other along the Yarra’s dark embrace—only to learn that the purest love demands the courage of farewell. A sensual, melancholic journey of guilt, redemption, and quiet transcendence.

From LLMs and RAG to Memory, MCP, Agent Frameworks and Enterprise AI Controls—discover how modern AI Agents work internally within today's rapidly evolving AI ecosystem.

Tired of 2 AM fire drills because a rogue container slipped into production? Policy-as-Code Field Guide is your battle-tested playbook for automating compliance, security, and operational guardrails—before they become incidents.From OPA’s Rego to Kyverno’s YAML, Conftest’s pre-commit checks to Sentinel’s Terraform controls, this guide cuts through the noise with real-world policies, CI/CD integrations, and production hardening tips you can use today.Shift left. Enforce early. Sleep better.

Most AI systems can talk, but few can actually do. This book shows you how to build AI agents that reliably use tools, call APIs and automate real workflows. Using DSPy, Pydantic AI, the Claude Agent SDK, the OpenAI Agents SDK and Google ADK, you'll learn practical patterns for building reliable agents that work in production.

Stop reading dry atomic physics textbooks and start driving a live nuclear reactor from your browser. From Grid to Core takes a reverse-engineering approach designed for software, control, and electrical engineers, walking you upstream from the familiar 400 kV switchyard straight into the nuclear core.

In Parramatta’s bruised twilight, nine wives speak only beautiful lies to keep their husbands alive. One syllable of truth could kill; one veil of Mithya may save them all. But what remains when the light of illusion begins to fracture?

Every web application has security headers, cookies, TLS configurations, and CORS policies that need to be correct. Most teams find out they're wrong only after a penetration test — or worse, after an incident. This book shows you how to build a scanner that catches these issues automatically. You'll create a Python CLI tool that uses Hurl (declarative HTTP testing) to assert security properties, SSLyze to validate TLS protocol versions, and AI to generate specific remediation for every failure it finds. The output: structured JSON reports, visual HTML dashboards, and AI-generated security posture assessments. **What you'll build:** - 9 declarative Hurl security test files (headers, cookies, CORS, HSTS, CSP, CSRF, redirects, TLS) - A preprocessor that handles domain substitution and authentication - An output parser with built-in remediation guidance for every test - A TLS scanner validating SSL 2.0/3.0 disabled and TLS 1.2/1.3 enabled - An AI analyzer that generates context-specific fixes using Ollama, OpenAI, or Bedrock - An HTML reporter with dark-themed visual dashboards - Docker multi-architecture deployment - CI/CD pipeline with GitHub Actions **Who this is for:** - Developers who want security checks before deploying - DevSecOps engineers building CI/CD security gates - Penetration testers who need quick baseline assessments - Security students learning web vulnerability concepts hands-on - Platform teams enforcing security standards across services Every failure includes: what was expected, what was received, why it matters, how to fix it, and a documentation link. AI adds domain-specific code examples on top.

Every web application has security headers, cookies, TLS configurations, and CORS policies that need to be correct. Most teams find out they're wrong only after a penetration test — or worse, after an incident. This book shows you how to build a scanner that catches these issues automatically. You'll create a Python CLI tool that uses Hurl (declarative HTTP testing) to assert security properties, SSLyze to validate TLS protocol versions, and AI to generate specific remediation for every failure it finds. The output: structured JSON reports, visual HTML dashboards, and AI-generated security posture assessments. **What you'll build:** - 9 declarative Hurl security test files (headers, cookies, CORS, HSTS, CSP, CSRF, redirects, TLS) - A preprocessor that handles domain substitution and authentication - An output parser with built-in remediation guidance for every test - A TLS scanner validating SSL 2.0/3.0 disabled and TLS 1.2/1.3 enabled - An AI analyzer that generates context-specific fixes using Ollama, OpenAI, or Bedrock - An HTML reporter with dark-themed visual dashboards - Docker multi-architecture deployment - CI/CD pipeline with GitHub Actions **Who this is for:** - Developers who want security checks before deploying - DevSecOps engineers building CI/CD security gates - Penetration testers who need quick baseline assessments - Security students learning web vulnerability concepts hands-on - Platform teams enforcing security standards across services Every failure includes: what was expected, what was received, why it matters, how to fix it, and a documentation link. AI adds domain-specific code examples on top.

Threat modeling is broken. It takes days, costs thousands, and most teams skip it entirely. What if your AI coding assistant could do it for you — systematically, consistently, and in minutes? This book shows you how to build an MCP server that makes it happen. You'll create 80+ structured tools that guide any AI assistant through a rigorous 9-phase STRIDE threat modeling workflow. Not vague prompts that produce unstructured text — real, typed, validated tools that build up a complete threat model piece by piece: business context, architecture, threat actors, trust boundaries, data flows, STRIDE-based threats, mitigations, and a final JSON export compatible with AWS Threat Composer. **What you'll build:** - A full MCP server with FastMCP (stdio + SSE transport) - Pydantic v2 data models for type-safe threat modeling - Case-insensitive enum validation (because AI isn't always consistent) - 11 tool modules covering every phase of STRIDE analysis - Customizable organization security guidelines loaded from `.md` files - Docker deployment for team-wide access - Compliance gap analysis that validates against mandatory controls - A complete workflow orchestrator with progress tracking **What makes this different:** The server doesn't call any LLM itself. It provides the structure and tools — your AI assistant (Claude, Kiro, Cursor, Copilot) provides the intelligence. This means it works with any model, any provider, forever. No API keys, no token costs for the server itself. **Who this is for:** - Security engineers who want to automate repetitive threat modeling - Python developers building MCP servers for any domain - DevSecOps teams embedding security into AI-assisted workflows - Architects who need consistent, auditable threat models - Anyone curious about how MCP tools work under the hood **By the end of this book**, you'll have a production-ready MCP server, a deep understanding of how AI tools are structured, and transferable patterns for building MCP servers in any domain — not just security.

The product playbooks built for Silicon Valley break the moment the internet drops, the currency crashes, or the regulator rewrites the rules at midnight. This book provides the alternative: a battle-tested system for building products that thrive under uncertainty, drawn from real experience across Africa, Southeast Asia, and Latin America. If you build products in the real world, this is your field guide.