How to keep up with cybersecurity

I read a lot of cybersecurity news, because we make a free monthly roundup on it. It's a broad field, and one of the hardest to keep up with when vulnerabilities, incidents, research and rules all move at once. This is what I've learned about doing it without it taking over your week.

The short answer: pick a small number of sources you trust, check them at a regular time, and write down why something mattered when you save it. Most of this guide is about why that's harder in cybersecurity than it sounds, and the ways people usually go about it.

Why is cybersecurity hard to keep up with?

Mostly because the news comes from several different places. A security team might need to follow exploited vulnerabilities and public advisories, incident reporting, threat intelligence, research papers, software supply chains, AI security and rules about disclosure. Each source has a different purpose, and each leaves something out.

Look at September's reporting. CISA confirmed global exploitation of two Citrix NetScaler zero-days. Cisco disclosed an actively exploited Identity Services Engine flaw that could give an attacker full control of an affected device. The Shai-Hulud worm reached more than 1,000 organisations through exposed credentials and permissive CI/CD paths. Google patched an exploited Chrome zero-day, and new research described six North Korean cyber clusters operating under the Lazarus name. That's infrastructure, identity, supply chains, browsers and threat research in one month.

Some stories also need careful reading. Anthropic said a Russia-linked Midnight Blizzard operation used Claude to monitor malware detection and change the malware's behaviour. The report treats that as one reported incident, rather than a measure of how often attackers use AI. It also says the full targeting scope wasn't disclosed. Those details matter when deciding what a story actually tells you.

How do people usually keep up?

Most people use some mix of these:

• Newsletters. Good for a regular overview, because somebody else has selected the important stories. The catch is that their priorities may not match the systems or risks you work on.
• Journal alerts and preprint feeds. Useful for research and technical findings close to the source. They can become noisy, and research often takes work to connect to a live security decision.
• Podcasts. Easy to fit into a commute, and good for context around incidents and campaigns. Less useful when you need the exact CVE, product, date or caveat later.
• Conferences and meetings. A good way to hear about new research, defensive ideas and work in progress. They happen only occasionally, and what you hear there still needs checking.
• Colleagues and communities. Often how useful advisories and practical lessons find you. It depends on who happens to see something first, and can leave gaps in areas nobody in your group follows.

None of them covers everything, so most people end up with a patchwork.

What tends to work

• Keep the list short. Three or four sources you trust are better than fifteen you feel guilty about. If one hasn't given you anything useful in a month, drop it.
• Pick a time. Fifteen minutes on the same day each week works better than catching up whenever you can.
• Write one line when you save something. Why it matters to your work, in a sentence. A bare link rarely gets looked at again.
• Go back to the source for anything you'll act on. A summary tells you what something is about. For the exact CVE, affected product, attribution or caveat, read the original advisory or paper.

That's most of it. It takes discipline, and cybersecurity gives you plenty of reasons to keep checking long after you meant to stop.

One more option

This is why I built Iris. You describe your work in your own words, something like "identity security and exploited vulnerabilities affecting cloud access infrastructure", and every month it reads across the field and writes you a briefing on what changed for you, with every source linked so you can check anything yourself.

It's one option, and a good routine with a couple of newsletters works well too. If you'd like audio, our free monthly podcast, Keeping up with Cybersecurity is about five minutes on the month's biggest stories, with the written report and every source underneath. When you'd like a briefing built around your own work, you can set up your own briefing.

If you work in cybersecurity and think I've missed something, I'd like to hear about it: joe@irisbriefings.com.