Reading paths · 5 sequences
Where to start, and what to read next
Each path is assembled from entries already in the directory. The line under each step says why it comes at that point rather than what it contains — the annotation on the entry already does that.
New to cyber deception
Six links, roughly four hours. Starts with whether deception works at all, then how it is organised, then how to get a signal today, then how it fails.
-
Imposing a Cyber Penalty Against Attackers with Cyber Deception
Start with the evidence, not the theory: a short practitioner summary of the one experiment everyone cites.
-
Deception Techniques in Computer Security: A Research Perspective
Now get the vocabulary. Four axes that let you place any technique you meet later.
-
The vocabulary again, but in the form organisations and vendors actually use to talk to each other.
-
Stop reading and plant something. Fifteen minutes to a working detection with no infrastructure.
-
Examining the Efficacy of Decoy-based and Psychological Cyber Deception
Back to the evidence, this time the full experimental design and what the four conditions actually showed.
-
A Review of Honeypots: Fingerprinting Techniques, Detection, and Evasion Mechanisms
Finish with the other side: how attackers spot decoys, so you do not over-trust what you just deployed.
Getting current on autonomous offensive AI
Eight links. Deliberately alternates between capability claims and the measurements that constrain them, because reading either alone gives a distorted picture.
-
Staying ahead of threat actors in the age of AI
The 2024 baseline: state actors using models, no novel attacks. Everything after is a claim of departure from this.
-
LLM Agents can Autonomously Exploit One-day Vulnerabilities
The paper that started the alarm, read with its own caveat in view: 87% with the CVE writeup, 7% without.
-
Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models
How capability actually gets measured, and why subtask decomposition matters for reading any score.
-
CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities
The same question against real CVEs rather than CTFs. Up to 13% is the number to hold onto.
-
Incalmo: An Autonomous LLM-assisted System for Red Teaming Multi-Host Networks
Then see the number move when scaffolding changes: 3 of 40 becomes 37 of 40. Capability claims are about harnesses, not models.
-
SoK: DARPA's AI Cyber Challenge (AIxCC): Competition Design, Architectures, and Lessons Learned
The largest funded test of autonomous find-and-patch, written up by the people who ran and entered it.
-
Disrupting the first reported AI-orchestrated cyber espionage campaign
The first claimed end-to-end autonomous campaign. Read it as a vendor's account, because that is what it is.
-
GTIG AI Threat Tracker: From Prompting to Autonomy - The Evolution of Adversarial AI
A second vendor reaching similar conclusions independently, which is the closest thing to corroboration available.
Quantum cognition for security researchers
Five links for someone who keeps hearing the phrase and wants to know whether it is worth their time. Includes the strongest argument that it is not.
-
Quantum cognition: a new theoretical approach to psychology
Ten pages, no linear algebra required, and it establishes that nobody is claiming the brain is a quantum computer.
-
The full case, free to read, with the authors' own account of where the models are weak.
-
Quantum-like models cannot account for the conjunction fallacy
Read the strongest attack before you are persuaded, not after. Order effects predicted wrongly is a serious result.
-
An overview of the quantum cognition research program
How the field responded, including to the replication failures. The most current open survey.
-
The only work found that applies this machinery to a model rather than a person, and it mostly reports an obstacle.
The empirical evidence, in order
Six links, chronological. What is actually known about whether deception changes attacker behaviour, from the 2019 experiment to the 2026 work on machine attackers.
-
The design paper. 130+ professionals, deception presence and disclosure varied independently.
-
Examining the Efficacy of Decoy-based and Psychological Cyber Deception
The results. Decoys plus telling attackers deception is present had the largest effect.
-
Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset
Re-analysis of the same data for specific biases. Exploratory, and the authors say so.
-
Cyber expert feedback: Experiences, expectations, and opinions about cyber deception
What attackers said afterwards, which shows the averaged effect hides opposite individual responses.
-
Cyber deception trials: what we've learned so far
The first large operational trial rather than a lab study: 121 organisations, and a clear warning against plug-and-play.
-
Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers
The same question asked of machine attackers, where the answers diverge sharply from the human results above.
Deception against machine attackers
Six links on the newest and thinnest part of the directory: what happens when the thing you are deceiving is an agent rather than a person.
-
Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks
The founding idea: if the attacker is reading your output, your output is an input you control.
-
SoK: Honeypots & LLMs, More Than the Sum of Their Parts?
The systematization, covering both LLMs building honeypots and honeypots built for LLMs.
-
Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers
The measurement: models take bait more readily than humans and act on traps they have already named.
-
A defensive system built on that asymmetry, though at the model level rather than the network level.
-
A Review of Honeypots: Fingerprinting Techniques, Detection, and Evasion Mechanisms
The counter-move, written about human attackers but directly applicable to agents that scan for tells.
-
Something you can run, including bait tools aimed specifically at agents probing a network.