When people ask me how to break into cybersecurity, they usually expect a certification name. Certifications help. What helps more is recognizing the vocabulary on day one: the NIST document someone cites in a meeting, the state law legal asks about after an incident, the scanner that just failed your pull request.
So I built a reference. The full Cyber Analyst Field Guide has 322 entries across 19 missions, each with a one-line explanation and a link to the primary source. It's searchable, tags the "learn these first" items as Primary, and lets you tick things off as you study.
Full guide: Cyber Analyst Field Guide
Below are the highlights from each section.
1. The NIST documents you'll hear quoted
NIST publications are the backbone of most security programs, public or private. Start with these:
Cybersecurity Framework (CSF) 2.0. Six functions: Govern, Identify, Protect, Detect, Respond, Recover. This is how you talk to leadership.
SP 800-53 Rev. 5. The control catalog. Learn the family codes (AC, AU, IA, SC, SI) and you'll read audit findings fluently.
SP 800-37 Rev. 2, the Risk Management Framework. Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
SP 800-63-4. The 2025 revision of the Digital Identity Guidelines. Volume B covers passwords, MFA and phishing-resistant authenticators.
SP 800-61 Rev. 3. Incident response, now aligned to CSF 2.0.
SP 800-88. Media sanitization: Clear, Purge, Destroy. You'll need it the first time a laptop or drive leaves the building.
AI RMF (AI 100-1) and the Generative AI Profile (AI 600-1). The federal starting point for AI risk.
Outside NIST, know PCI DSS v4.0.1 if you touch payment cards, the CIS Controls v8.1 as a practical starting checklist, ISO 27001, SOC 2 and the OWASP Top 10 (including the OWASP Top 10 for LLM Applications).
2. Threat modeling: STRIDE plus MITRE
A common mix-up: STRIDE is Microsoft's model, not MITRE's. They work well together.
STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) helps you ask what could go wrong with a design.
MITRE ATT&CK catalogs how real attackers operate, technique by technique.
MITRE ATLAS does the same for attacks on AI and ML systems.
CWE and CVE give you the shared vocabulary for weaknesses and vulnerabilities.
The Threat Modeling Manifesto boils the process down to four questions. Start there.
3. Privacy law: there is no single US privacy law
New analysts often expect one federal privacy law. Instead you get sector laws (HIPAA, GLBA, COPPA, FERPA), the SEC's four-business-day incident disclosure rule for public companies, and a growing patchwork of state laws.
California CCPA/CPRA is the most mature state law, with new cybersecurity audit and risk assessment regulations adopted in 2025.
Nevada (NRS Chapter 603A) covers data security, online opt-out of sale, and consumer health data (SB 370) with no revenue threshold.
Arizona has no comprehensive consumer privacy law as of 2026. A bill was introduced but not enacted. Its breach statute requires notice within 45 days.
Illinois BIPA drives some of the largest privacy class actions in the country.
GDPR still sets the global bar, and the EU AI Act is phasing in through 2027.
Bookmark the IAPP US State Privacy Legislation Tracker and the NCSL breach notification law list. Laws change faster than any article can.
4. Court cases that change how you work
You don't need a law degree, but a few cases directly affect day-to-day security work:
United States v. Heppner (S.D.N.Y. 2026). Judge Rakoff held that a defendant's conversations with Claude were not protected by attorney-client privilege or work product. The AI isn't a lawyer, and a consumer AI service isn't confidential. Treat what you type into a chatbot as discoverable.
In re Capital One (E.D. Va. 2020). A breach forensics report was ordered produced because it came out of the ordinary security budget. Have counsel retain incident response firms.
United States v. Sullivan. Uber's former CISO was convicted for concealing a breach. How you handle disclosure is personal.
Van Buren v. United States (2021). The Supreme Court narrowed what "exceeds authorized access" means under the CFAA.
FTC v. Wyndham (3d Cir. 2015). Confirmed the FTC can pursue companies for poor data security.
Mata v. Avianca (2023). Lawyers sanctioned for citing AI-hallucinated cases. Verify AI output.
5. Your bookmarks bar
These are the sites I'd put in front of any new analyst:
CISA, and especially the Known Exploited Vulnerabilities (KEV) catalog. If it's on KEV, patch it first.
NIST CSRC and the National Vulnerability Database
CIS Benchmarks for hardening
CERT/CC Vulnerability Notes
SANS Internet Storm Center
OWASP Cheat Sheet Series
VirusTotal, CyberChef, Shodan and abuse.ch for daily analysis
6. Learn from 2025's breaches
For statistics, go to the Verizon DBIR and IBM Cost of a Data Breach reports. For case studies, 2025 gave us plenty:
PowerSchool, with student records for more than 62 million people
The Salesloft Drift OAuth token theft, which reached many Salesforce customers through one integration
Scattered Spider's social engineering attacks on UK retailers
Coinbase's insider bribery incident
The SharePoint "ToolShell" exploitation wave (CVE-2025-53770)
A compiled dump of about 16 billion credentials gathered by infostealer malware
The recurring themes are identity, third-party integrations and help-desk social engineering, more than exotic zero-days.
7. The vendor landscape
You'll see these names in job postings and architecture diagrams: CrowdStrike, Microsoft (Defender, Sentinel, Entra, Purview), Splunk (now part of Cisco), Palo Alto Networks, Fortinet, Okta, Zscaler, SentinelOne, and the vulnerability management trio Tenable, Qualys and Rapid7. Ownership shifts often. Wiz and CyberArk both had major acquisitions announced in 2025.
8. Open-source tools to run in a home lab
You can learn most of the job for free:
Wazuh (SIEM/XDR) and Security Onion (network security monitoring)
Suricata and Zeek for network detection
ClamAV for antivirus, YARA and Sigma for detection rules
Nmap, Wireshark and ZAP for assessment
Trivy and Checkov for containers and infrastructure as code
Velociraptor and Volatility for forensics
9. AppSec and the software supply chain
Code scanning now happens in the IDE, the pull request and the pipeline. Know the categories (SAST, SCA, secrets, IaC, container scanning) and the platforms:
Snyk and Aikido Security for developer-friendly, all-in-one scanning with free tiers
GitHub Advanced Security (CodeQL and secret scanning), SonarQube and Semgrep
Dependabot or Renovate for dependency updates, Gitleaks for secrets in git history
10. CI/CD, Terraform and Ansible
A secure pipeline follows a simple flow: pre-commit checks, then scanning and review on the pull request, then SBOM generation and signing at build, then deployment with short-lived credentials.
Start with the OWASP Top 10 CI/CD Security Risks, the CISA/NSA "Defending CI/CD Environments" guidance and SLSA. For infrastructure as code, use HashiCorp's Terraform tutorials (or OpenTofu), keep state files remote and encrypted, and use Ansible with Ansible Vault for secrets. Ansible Lockdown offers ready-made CIS hardening roles.
11. Securing GitHub
The 2025 compromise of the tj-actions/changed-files GitHub Action leaked secrets from thousands of pipelines because they referenced a mutable tag. The basics that would have helped:
Pin third-party Actions to a full commit SHA
Set the default GITHUB_TOKEN to read-only
Use OIDC to deploy to the cloud instead of storing long-lived keys
Turn on secret scanning with push protection, CodeQL and Dependabot
Protect main with rulesets: required reviews, required status checks, no force-pushes
Enforce 2FA and use fine-grained tokens
12. Stacks, SaaS, AI tools and the rest
The full guide also covers:
Common tech stacks: LAMP, MERN, FastAPI with PostgreSQL, .NET, serverless
The enterprise SaaS stack and its OAuth risk
AI tooling: Hugging Face, Ollama, ChromaDB, pgvector, MCP, and red-team tools like garak and PyRIT
Python libraries security engineers use every week
Diagrams-as-code with Mermaid and the C4 model
IDEs
Cloud best practices: the shared responsibility model and the AWS and Azure Well-Architected Frameworks
Where to start
If this feels like a lot, it is. Nobody masters all of it. Pick the items tagged Primary in the guide, work through one section a week, and build a small home lab with Wazuh and a vulnerable VM. In three months you'll recognize most of what comes up in meetings.
Get the full, searchable Cyber Analyst Field Guide here.
What did I miss? Tell me through the Contact page which document, tool or case you'd add, and I'll include the best suggestions in the next version.
This article is general information, not legal advice. Laws and vendor details change, so confirm against the primary sources linked in the guide.