Every expert writing a book wants to prove they’re the real thing. For most fields that instinct is harmless.
Show your best work, name-drop the hard cases you cracked, let the reader see how deep you go. For a security expert, that same instinct is a loaded gun pointed at your own foot, because the most impressive thing you know is often the exact thing you must never put in print. For more, see The Art of Invisibility.
I’ve spent a career on both sides of this.
I ran security and PCI compliance at Trader Joe’s for two decades, as Director of Computer Operations and Technical Services. I served as the technical editor on Cyberheist, the cybersecurity book put out by KnowBe4, and I wrote my own guide to keeping families safe online. I’ve also ghostwritten several cybersecurity books for clients.
The same question comes up every single time, and it’s the one nobody outside the field thinks to ask. How much of what I know can I say?
Does Publishing a Cybersecurity Book Help Attackers?
No. Attackers already have the techniques. What the book sells is the author’s judgment and experience, and an attacker can’t use either one.
A chef can publish the recipe. The point of the chef’s book is the recipe. A surgeon can describe the procedure in detail and the worst that happens is a reader feels queasy. A consultant can lay out the entire methodology and the only risk is a competitor borrows it.
The security expert doesn’t get that freedom. You spent years learning exactly how systems break, because you can’t defend against an attack you don’t understand. That knowledge is the most valuable thing in your head and the most dangerous thing you could ever write down. The instinct to prove your expertise by showing the break is the instinct that gets people hurt. I’d never put the exploit itself in print.
You don’t hand attackers the map. It takes an enormous amount of work to keep them out: late nights, budgets, arguments with people who don’t want to spend the money. One published walkthrough undoes a piece of all of it. Why would you spend a career building the wall and then draw the intruders a diagram of the weak spot?
Every defender who reads your book is grateful for the thinking. Every attacker who reads it is grateful for the instructions. Print the exploit and you’ve written a book that serves the wrong reader best.
Why isn’t the exploit the valuable part of a security book?
Authors who panic about this miss something important. The how-to-break-in is the least valuable thing you know. It has a shelf life measured in months. The vendor patches the vulnerability and deprecates the version, the trick stops working, and now your book contains a dangerous detail that’s also out of date, the worst of both worlds.
Print the exploit and you’ve written a book that serves the wrong reader best.
Worse, the attack methods aren’t even scarce. Anyone who wants to break into something can find the tutorial without buying your book. Publishing the exploit gives the bad guys nothing they couldn’t already get and gives your reader a reason to distrust your judgment. The valuable thing is everything around the exploit. How you think about a threat before it arrives. How you decide what to defend first when you can’t defend everything, because nobody can, and pretending otherwise is how people get breached.
The war story of the incident that should have sunk the company and what pulled it back. The judgment, the part that took twenty years to build and that no tutorial contains. A reader pays for that, and it proves you’re the expert.
| Material | Put it in print? | Why |
|---|---|---|
| The working exploit | Never | Short shelf life, already findable, and it arms attackers |
| How attacks work and how to defend | Yes, without a usable map | Defenders gain the thinking without getting instructions |
| How you think about a threat | Yes | The judgment readers pay for |
| What to defend first | Yes | Nobody can defend everything |
| Incident war stories | Yes | Shows what pulled a company back from the edge |
| The flashiest technical detail | Check it first | It is often the most dangerous detail in the room |
The mechanics of the attack prove nothing except that you can read the same forums everyone else can. A security book gets its authority from showing you understand the whole field and can defend it. An author who needs the attacker’s manual to look credible cares more about seeming clever than about the people that chapter could get hurt. For more on information security, see Richard’s interview with Norman Kromberg.
The Authors Who Get It and the Ones Who Don’t
The clients I’ve written for were savvy enough to draw this line themselves. They were good at what they did. That meant they already knew which details were live rounds and which were safe to handle. I never had to drill them on it.
They’d talk freely about the thinking and the strategy and then go quiet and careful the moment we got near the part that could be weaponized. That instinct is what a real practitioner has, and watching it is how you can tell you’re dealing with one.
The danger is the author who doesn’t have that instinct yet. The one who’s good but green, or the one so eager to look impressive that they reach for the flashiest technical detail in the room without clocking that the flashiest detail is also the most dangerous one. They publish the exploit because it makes the chapter pop, and they’ve just armed the exact people they spent their career keeping out.
A ghostwriter who doesn’t understand security can’t protect you from this, because they can’t tell a vivid technical detail that makes a great paragraph from a live exploit that should never see daylight. To them it all looks like good color, and color is what they’re hired to find, so they’ll reach for the dangerous thing exactly because it reads well. I can tell the difference, because I spent years on the defense side learning where exactly the lines are.
A writer who understands the technology belongs on a security book as part of the safety system. Ghostwriters who take security books without that background are gambling with the client’s name, and the client is the one who pays when the bet goes bad.
My take
Write the security book, and leave the working exploit out of it. Readers pay for your judgment, how you decide what to defend first and how a company got pulled back from the edge. Anyone can copy attack mechanics off the same forums. The bigger danger is the eager author reaching for the flashiest detail, and a ghostwriter without a security background won’t know to stop them. Draw the line before the first interview.
Restraint Is the Proof, Not the Absence of It
The amateur publishes the exploit to look smart. The professional leaves it out because he understands exactly what it would cost, and that understanding is itself the expertise on display.
A reader who knows the field will respect the book that shows deep knowledge of how attacks work while pointedly refusing to write the recipe. That restraint signals you’ve done the job, because anyone who has done the job carries this instinct in their bones.
The reader who doesn’t know the field gets a book that makes them safer instead of one that makes the world a little more dangerous. Both readers are better served, and you’ve lost nothing worth keeping, because the thing you held back was never the source of your authority in the first place.
Your book should prove you can think like an attacker without ever becoming one of their tools, and knowing where that line sits is the expertise worth writing a book about. An author who trades it away for a flashier chapter has pushed the cost onto defenders who never agreed to pay it. I won’t write that chapter for anyone.
Schedule a free consultation to discuss your book project.
I wrote Family Cybersecurity to help families defend themselves. It opens with a friend losing thirty years of family photos and covers protecting the people who live in your house.
Frequently Asked Questions
You spent years learning exactly how systems break, because you can’t defend against an attack you don’t understand.Share on X
