Follow these people to keep your own collection current, and read the standing columns rather than waiting for incident coverage. Everything below is open source: newsletters, blogs, social accounts, government advisories and published articles.
Read Krebs first when a breach, ransomware crew or fraud network surfaces, because he names the operators behind it before vendors do. Use his posts as leads for attribution work, not as final attribution.
Greenberg is the reference narrative reporter on state cyber operations, especially Russian military intelligence activity against critical infrastructure. Read him to understand operational intent, then map the behavior to MITRE ATT&CK yourself.
CyberScoop is the fastest reliable read on United States federal cyber policy, budgets and agency leadership changes. Use it to track who holds authority before you assess what an agency can actually do.
Healey is the clearest writer on cyber conflict history and whether defense is actually gaining advantage. Read him before you write any strategic judgment about escalation or deterrence.
Rid supplies the historical baseline for influence operations and active measures, which keeps current disinformation claims proportionate. Read him whenever a campaign is described as unprecedented.
Gallagher documents surveillance tooling and government contracting that rarely appears in vendor reporting. Use his work to understand collection capability, not just intrusion activity.
Cimpanu's newsletter is the highest signal daily roundup of intrusions, malware and takedowns anywhere in open source. Skim it every morning and pull the primary links out for your own collection.
Gray interrogates vendor and government claims harder than most reporters, which is useful for confidence calibration. Listen for the pushback, not the headline.
Beaumont is usually first with practical exposure counts and exploitation reality during a mass vulnerability event. Use his numbers for tactical triage, and confirm against Known Exploited Vulnerabilities before you escalate.
Whittaker's newsletter tracks data exposure, spyware and breach notification failures with unusual follow-through. Read it weekly to catch incidents that never reach the wires.
Schneier connects technical failure to incentives, regulation and public policy better than almost anyone writing. Read him for the structural argument, not for incident detail.
Lawfare is the standing reference for legal authorities behind United States cyber operations, including Title 10 and Title 50 questions. Check it before asserting what a command is permitted to do.
The Record covers ransomware victim disclosure, government advisories and international enforcement with consistent primary sourcing. Use it to build the timeline for any long-running actor campaign.
Burgess covers leak archives, extortion crews and platform security with steady access to primary documents. Read him when a dataset appears and its provenance matters.
Read these in full before writing judgments on the topics they cover. Each entry links to the original open source publication.
This is the clearest public account of purpose-built grid attack tooling. Read it before assessing any claim about critical infrastructure pre-positioning.
The definitive case study on collateral damage from a state operation. Use it to argue why containment assumptions fail in wormable attacks.
The original long-form intrusion investigation, and still the best teaching text on patient tracking. Read it to see analytic discipline without modern tooling.
The primary government document behind most Volt Typhoon reporting. Read the advisory itself rather than secondhand summaries.
The most complete reconstruction of the SolarWinds intrusion and detection failure. Use it to frame supply chain risk beyond software bills of materials.
The standing technical record on mercenary spyware targeting. Cite Citizen Lab directly when discussing commercial intrusion vendors.
A continuing source of structured policy analysis on cyber norms, market incentives and defense posture. Pull from it when you need a strategic frame rather than an incident.
The authoritative mapping between real actor tradecraft and detection coverage. Use it to translate any actor report into technique-level defensive gaps.
The single best open prioritization list for exploitation actually observed in the wild. Check it before treating any vulnerability report as urgent.
Continuous reporting on extortion crews, victim disclosure and law enforcement disruption. Use it to keep actor status current between vendor reports.