Resource Hub
2467 hand-picked resources, updated every week. Search it, filter it, or just browse a collection and see what catches your eye. Want today’s headlines instead? Read the free AI news feed.
Filtered by tag
Answers come only from resources in this hub, with the sources listed underneath.
58 resources
Help Net Security roundup of colleges and universities offering degrees, courses and certificates that meet cybersecurity industry demand.
Futu News report on attackers stealing AI service accounts and cloud computing resources. Described from its title; the page did not load for automated checks.
Free online jeopardy-style CTF hosted by the University of Michigan's WolvSec student club, open to teams worldwide.
Details: The official wolvctf.io site couldn't be loaded directly (blocked by robots.txt), so dates/format are confirmed via CTFtime instead. No fee is mentioned; university-run CTFs on CTFtime are conventionally free to enter.
Free jeopardy-style capture-the-flag qualifying round from Hong Kong's CERT, with an Open division alongside student categories; top teams advance to an in-person Hong Kong final.
Details: The event page doesn't state a fee explicitly, but HKCERT's CTF has historically been a free, HKPC-backed community competition. Confirm the Open division's eligibility for non-Hong-Kong participants before committing.
An op-ed arguing that the U.S. and China need to talk about self-spreading malicious software before AI makes such attacks easier to build. A readable introduction to why computer worms are back in the policy conversation.
Google Threat Intelligence and Mandiant document a May–June 2026 ShinyHunters campaign exploiting CVE-2026-35273 in Oracle PeopleSoft Environment Management. The report says Google notified more than 100 potentially exposed organizations, 68% in higher education, and provides investigation, remediation, and hardening guidance.
Help Net Security summarizes the SANS 2026 threat hunting survey: 50% of respondents named data quality as the top barrier, ahead of skilled staff (45%) and budget (42%). Survey figures are self-reported by practitioners.
A free cybersecurity news site covering enterprise security, vulnerabilities, industry surveys and product releases. Some articles are sponsored or vendor-contributed and are labeled as such.
Personal site of software engineer and cybersecurity researcher Nisarga Adhikary, with his projects and writing.
Why I recommend it: A good example of a young researcher building a public track record. It is his own site, so achievements are self-described.
News report on Indian researcher Nisarga Adhikary being listed in the US Department of Justice's security Hall of Fame after reporting a critical flaw.
Why I recommend it: MSN republishes other outlets' stories, and the flaw details come from the researcher himself. I could not open the page, so I wrote this from the title — please check it.
Free Substack newsletter by a principal cybersecurity engineer sharing career tips and cybersecurity news, including a recurring 14-day U.S. cyber threat forecast (e.g. the September 22, 2026 VECTR-CAST report on actively exploited Cisco, ScreenConnect and VMware vulnerabilities).
Why I recommend it: Good for people moving into cybersecurity who want a practitioner's read on current threats. The threat levels and forecasts are the author's own analysis, not an official CISA rating — cross-check CVEs against the CISA KEV catalog.
Bugcrowd's library of security guides, ebooks, research reports and customer stories, including its Ultimate Guide to AI Security (2026) and Ultimate Guide to Red Teaming. A reasonable free way into how bug bounty and penetration testing programmes actually run.
Why I recommend it: Free, but several downloads ask for your work email and it is a vendor's marketing library, so the conclusion is usually that you need a bug bounty platform. Read it for the vocabulary and process, then check claims against a neutral source.
The original home of SHAttered — the February 2017 research by Google and CWI Amsterdam that produced the first practical public SHA-1 collision, two different PDFs with the same hash. The paper and both colliding files are still downloadable, so you can check the hashes yourself. The site now also runs a high-volume news and explainer feed covering cryptography, security, chips, cloud and cryptocurrency.
Why I recommend it: Free, no paywall. Two halves, and they deserve different levels of trust. The 2017 SHA-1 collision material is genuine, checkable primary research and still the best way to see a broken hash function with your own eyes. The current news feed is a different thing: posts appear every few minutes, carry no named author, and the site also covers 'provably fair' crypto gambling, which sits close to affiliate territory. I have deliberately not wired it into the headlines here — use the archive, and confirm any breaking claim against a named outlet before you repeat it.
A free newsletter and news site for IT professionals from Morning Brew, published four times a week, covering cybersecurity, cloud, hardware, IT operations, software and the practical side of AI adoption inside companies. Stories are short, reported, and written from the perspective of the people who have to run the systems — patching, asset inventories, wi-fi troubleshooting, legacy migration — rather than the vendors selling to them. Also runs free virtual events and digital guides.
Why I recommend it: Free to read on the site and free to subscribe — the subscribe box asks for an email, but nothing is paywalled. This is one of the better free ways to learn the vocabulary of an IT job you have not had yet, because it covers the unglamorous work that interviews actually ask about. Two things to keep in mind: it is ad and sponsor funded, so sponsored posts sit alongside the reporting and you should check the byline and any 'presented by' line; and it is written for people already inside IT departments, so expect jargon on first read.
Okta's grant program giving people in career transition free access to its Identity and Access Management training catalog, practice tests and certification exam. Aimed at people who are unemployed, veterans moving to civilian work, and IT or cybersecurity students.
Why I recommend it: This is a grant you apply for, not an open course library — places are limited and awarded, and past rounds ran as a three-month subscription. Check the eligibility wording and closing date on Okta's own page before planning around it. The training is Okta's own product, so the certification proves you can run Okta, not identity work in general.
Cybersecurity news publication covering breaches, vulnerabilities, threat research, and enterprise security policy.
Why I recommend it: Free to read. One of the longest-running security news sites; useful if security is part of your work or your beat.
Apply for a scholarship covering WiCyS 2027 conference registration, all activities and meals, plus two nights of shared lodging. Applications run 2–30 September 2026.
Details: Free to apply, and the award covers the expensive parts of attending a technical conference. Applications close 30 September 2026, so this is a now-or-next-year thing.
A free online jeopardy-style capture-the-flag run as part of the 7th EOCON conference. 20 November 2026, 10:00 UTC to 22 November 2026, 10:00 UTC.
From the site: EyesOpenCTF 2026 is a FREE CTF competition organized as part of the 7th edition of EOCON. This year, the competiti...
Details: The organizers state plainly that it is free to enter. Good weekend practice across a range of challenge types.
A free online jeopardy-style capture-the-flag organised by the New Jersey Institute of Technology. 6 November 2026, 17:00 UTC to 7 November 2026, 17:00 UTC.
From the site: REGISTRATION IS NOW AVAILABLE! BOO!! Welcome to SpookyCTF 2026! Organized by the New Jersey Institute of Techno...
Details: Registration is open. A 24-hour format, so it fits into one weekend rather than eating a week.
A free online jeopardy-style capture-the-flag run by Cyber Hacktics with U.S. Air Force veterans for Cybersecurity Awareness Month. 17 October 2026, 14:00 UTC to 19 October 2026, 00:00 UTC.
From the site: DEADFACE CTF features jeopardy-style challenges and is hosted by Cyber Hacktics and veterans of the United States Air...
Details: Beginner-friendly as CTFs go, and a real thing to point at in an interview. Free to play.
Independent cybersecurity and technology news site covering malware, ransomware, data breaches, privacy, and support guides for Windows, Linux and macOS.
From the site: BleepingComputer is a premier destination for cybersecurity news for over 20 years, delivering breaking stories on the latest hacks, malware threats, and how to protect your devices.
Why I recommend it: Free to read and ad-supported. Use it as a practical incident tracker and a source of plain-language security guidance, not as a single source for attribution.
The US government's public library of cybersecurity standards, guidance and publications, including the SP 800 series, project pages, news and events.
From the site: CSRC provides access to NIST's cybersecurity- and information security-related projects, publications, news and events.
Why I recommend it: Free and public, no account needed. This is the primary source behind most security "best practice" advice you will read elsewhere, so cite it directly rather than a blog summarising it.
A long-running cybersecurity news site covering breaches, vulnerabilities and, increasingly, AI-related security incidents.
From the site: The Hacker News is the top cybersecurity news platform, delivering real-time updates, threat intelligence, data breach reports, expert analysis, and actionable insights for infosec professionals and decision-makers.
Why I recommend it: Free to read with ads and newsletter prompts. Good for spotting AI security stories early; headlines can be urgent in tone, so check the underlying advisory.
The US National Security Agency's AI Security Center: published guidance, joint advisories and best-practice sheets on securing AI systems against attack. Free to read and download.
Why I recommend it: Practical, specific security guidance you can hand to a technical team. It is written from a national-security standpoint, so priorities reflect government threat models more than everyday consumer risk.
Independent, free benchmarks testing leading AI models on real-world finance, software, science and safety tasks, with cost and latency alongside accuracy.
From the site: Private, domain-specific benchmarks in legal, tax, and finance.
Why I recommend it: When someone claims a model is "the best," check here — these are independent evaluations, not vendor marketing.
Free internet routing lookup tool for exploring Border Gateway Protocol paths, autonomous system numbers, prefixes, and network relationships. Includes a super looking glass and traceroute from distributed probes.
Site and writing of security researcher Marcus Hutchins, known for stopping the WannaCry ransomware attack — malware analysis, security explainers and reflections from an unconventional path into cybersecurity.
Why I recommend it: A strong example of a self-taught technical career — worth following if you are breaking into security without a degree.
Barclays' technology internship track for software engineering, cybersecurity, infrastructure and product roles, with details on the programme and application process.
Why I recommend it: Worth applying to even if you picture yourself at a tech company — bank engineering internships pay well and teach you scale and security practices you rarely see elsewhere.
Free 48-hour online jeopardy-style capture-the-flag competition November 20-22, 2026, run by the University of Florida Student InfoSec Team, with challenges in pwn, reverse engineering, forensics, and cryptography.
Details: Student-run CTFs are usually the most welcoming. Team up with two or three people and split the categories.
A technical learning platform with 60,000+ books, 30,000+ hours of video, live online events, and interactive labs and sandboxes from O'Reilly and nearly 200 other publishers.
Why I recommend it: Check your public library card and any school or employer account before paying — many library systems give full O'Reilly access for free, and some live events are open to anyone.
A weekly newsletter rounding up cybersecurity news, threats, breaches, and career signals for anyone keeping pace with digital safety.
Why I recommend it: Curated security digest — good for staying current and spotting emerging roles.
An autonomous AI agent for penetration testing and security research, running through one command-line interface across several major models.
Why I recommend it: If you are moving toward security work, tools like this are what the job looks like now. Learn the agent, but learn the fundamentals it is automating too.
Free, senior-taught software engineering courses built for career acceleration, with pathways in web, mobile, cybersecurity, data, and AI-native applied engineering.
Why I recommend it: I often recommend CodePath to clients breaking into tech or leveling up their engineering skills without taking on bootcamp debt. The courses are rigorous, free, and taught by engineers who actually hire.
A Bronx-based nonprofit offering free tech training and career support in web development, data, design, and cybersecurity for underestimated talent in New York, Newark, and Atlanta.
Why I recommend it: I point career changers who cannot afford a bootcamp toward TKH. The program is community-rooted, employer-connected, and focused on economic mobility.
Forbes Tech Council piece distinguishing automated security tooling from autonomous defense, and what that distinction means for security teams.
Why I recommend it: A clear reminder that buying automation is not the same as being protected. Good framing if you are moving into a security or IT role.
IBM's free learning platform for job seekers and students, with courses and credentials in AI, cybersecurity, data analysis, and workplace skills. Registration creates a free IBM SkillsBuild ID.
Why I recommend it: Free, employer-branded credentials from a name recruiters know. Pick one track, finish it, and put the badge on your LinkedIn profile.
OpenAI's announcement of GPT-6 Astra, its most capable model, with reported results on computer use, browsing, software engineering, cybersecurity, and professional work.
Why I recommend it: Read the capability list as a job-task list. Whatever a model does well this year reshapes entry-level work the next.
One of the largest technology staffing and IT services firms in North America, hiring for software, data, cloud, cybersecurity, help desk, and project delivery roles at enterprise clients.
Why I recommend it: If you want tech work at a large company without a referral, TEKsystems is often the actual hiring channel. Keep your resume keyword-clean for their recruiters, and ask directly which clients and rates a req covers before interviewing.
Annual global study on cybersecurity hiring, skills gaps, budget pressure, and what helps practitioners grow their careers.
Why I recommend it: Details: use the hiring and skills-gap data to decide which security certifications and skills are actually in demand before you spend money on training.
Free courses and free LinkedIn-ready credentials in AI, cybersecurity, data, and cloud computing.
Why I recommend it: One of the few places where both the training and the credential are free. Stack two or three badges in one lane instead of one badge in four lanes.
Free courses in networking, cybersecurity, Python, and IT fundamentals.
Why I recommend it: The free entry-level courses map directly to IT support and network technician postings.
Hands-on cybersecurity training through guided browser-based labs.
Why I recommend it: A generous free tier and a public profile that shows what you actually completed. That profile is proof, which is more than a certificate.
An 11th-edition online jeopardy-style capture-the-flag competition from the University of Central Florida's Hack@UCF club open to all skill levels.
Details: Free status inferred from this event's long free-community history; not explicitly restated on the 2026 page.
A cybersecurity capture-the-flag competition explicitly welcoming every skill level from complete beginners to professionals.
Details: Access code: chctf2026. Qualifiers are virtual; finals are in-person in Grand Forks ND on Oct 26.
A multi-tiered free cybersecurity skills-training scholarship aimed at students and career changers seeking a cybersecurity job within about 1.5 years.
Details: Page describes this as for "WiCyS members" -- confirm whether WiCyS membership itself is free before publishing.
A community-run jeopardy-style capture-the-flag competition held in support of National Cybersecurity Awareness Month open to all.
Details: Cash prizes offered with no entry fee mentioned; free status inferred rather than explicitly re-confirmed for 2026.
Certificate covering security frameworks, threat detection, Python for security tasks, SIEM tools, and incident response.
Why I recommend it: A credible on-ramp into security work. Combine it with a free conference or local meetup, because in this field who you talk to opens as many doors as what you studied.
Upcoming cybersecurity conference calendar with virtual and in-person events, dates, locations, and registration links.
From the site: Find cybersecurity conferences happening this week. Virtual & in‑person events. Get dates, locations, and last‑minute registration links now.
Why I recommend it: Useful for staying current on security trends and finding networking events if you are pivoting into cybersecurity, tech policy, or IT operations.
Grant packages combining $5,000 cash, a year of free internet/voice/cybersecurity service, equipment, a professionally produced TV commercial, coaching, and online entrepreneurship courses. Open to all qualifying small businesses in specific participating metro areas during limited annual application windows.
Why I recommend it: Only open in select cities during short annual windows — check comcastrise.com for current cities and dates.
Full-scholarship cybersecurity academies for veterans, women, and career changers entering the field.
Why I recommend it: These are intensive and fully funded — plan for it like a job, not a night class.
Scholarship providing free cybersecurity training and certification prep for women in security.
Why I recommend it: Applications are competitive but short. Lead with why security specifically, not why tech generally.
Cybersecurity scholarships for undergraduate, graduate, and career-change students.
Why I recommend it: Deadlines cluster in the spring. Draft the essay once and reuse it across every scholarship on this list.
Community, conferences, and training for women in cybersecurity, including student and career-changer tracks.
Why I recommend it: The seminars are useful, but the member community is where the referrals actually come from.
Wired's weekly security roundup covers OpenAI, Anthropic, and 100+ companies cosigning a letter warning that organizations have mere months to prepare for AI-enabled cyberattacks. The piece also tracks rogue AI agent hacking incidents, attacks on over 100 U.S. water systems, license-plate-reader surveillance abuse, Meta's $16.7B child-safety settlement, and ICE buying robot dogs — a snapshot of where AI, surveillance, and critical-infrastructure security collide.
From the site: OpenAI, Anthropic, and more than 100 companies have cosigned a letter saying that everyone else has mere months to prepare for AI-enabled cyberattacks.
Why I recommend it: A stark signal that AI-enabled cyberattacks are no longer hypothetical. The cosigned letter from OpenAI and Anthropic calling for a 'collective response' is exactly the kind of industry accountability move worth watching — pair it with the Hugging Face incident reporting and the water-system attacks to see how AI agents are already being used offensively. Useful for anyone tracking the gap between AI capability and AI governance.
Twelve-month paid apprenticeships in Application Development, Cybersecurity, Data Engineering, and Cloud Engineering. Accenture has scaled apprenticeships into a large share of its entry-level hiring in North America.
In plain terms: This program provides paid, entry-level tech and business apprenticeships with mentorship for job seekers without a four-year degree. You can submit an application to gain hands-on training and work toward a full-time role.
Why I recommend it: Client-facing consulting experience is the differentiator here. It teaches you how to talk to business stakeholders, which pays off for the rest of your career.
Twelve-month paid apprenticeships with full benefits in Cybersecurity, Software Development, Data Science, Cloud Engineering, and Application Development. IBM built these around "new collar" roles that prioritize skills over diplomas.
In plain terms: This program offers year-long paid apprenticeships with benefits across tech fields like software development and cybersecurity. You can apply for entry-level roles that prioritize your skills rather than a college degree.
Why I recommend it: Application windows open in short rolling bursts, sometimes closing within a day. Set a job alert and follow IBM on LinkedIn so you are not late.
A global tech community that partners with major technology companies to run fully funded certification cohorts — including security and data analytics tracks — alongside mentorship, resume workshops, and access to corporate hiring partners.
Why I recommend it: Sponsored certification vouchers are the practical win here. Join the community first, then watch for cohort announcements.
Research summary showing skills-based, talent-friendly hiring practices save over $125,000 per cybersecurity worker through faster hiring and better retention, with a focus on widening pathways for women.
In plain terms: This research report shows how cybersecurity employers use skills-based hiring, mentorship programs, and ongoing training to retain talent. You can use this data to identify workplaces that support professional growth and clear promotion paths for women.
Why I recommend it: Good ammunition if you're arguing for skills-based hiring internally — it puts a dollar figure on it.
Created by Women in CyberSecurity (WiCyS) with FourOne Insights
