Backend & Infrastructure
Best Application Security Books
Editor's top Application Security books
2Alice and Bob Learn Application Security
Tanya Janca · Wiley · 288 pages · ~7 hrs to read
The most approachable end-to-end introduction to the field — secure design, coding, testing, and program-building explained for developers making the transition. The book most often recommended to engineers asking "how do I get into AppSec?"
Secure by Design
Daniel Deogun, Dan Bergh Johnsson, Daniel Sawano · Manning · 660 pages · ~17 hrs to read
Teaches how deep domain modelling — value objects, whole-value patterns, explicit invariants — eliminates entire vulnerability classes before a scanner ever runs. The best bridge between AppSec and the DDD-flavoured code most backend engineers already write.
Application Security Books for Beginners
2Alice and Bob Learn Application Security
Tanya Janca · Wiley · 288 pages · ~7 hrs to read
The most approachable end-to-end introduction to the field — secure design, coding, testing, and program-building explained for developers making the transition. The book most often recommended to engineers asking "how do I get into AppSec?"
Web Security for Developers
Malcolm McDonald · No Starch Press · 217 pages · ~5 hrs to read
Short, code-first chapters pairing each vulnerability class with the actual fix in real application code — the most approachable entry point for developers who want concrete remediation patterns rather than abstract theory. A natural follow-on to the OWASP Cheat Sheets.
Intermediate & Advanced Application Security Books
8Threat Modeling: Designing for Security
Adam Shostack · Wiley · 624 pages · ~16 hrs to read
The definitive text on the highest-leverage AppSec skill — finding design flaws before they're built. STRIDE, attack trees, and practical process from the person who ran threat modelling at Microsoft. Senior AppSec interviews assume you've absorbed it.
Secure by Design
Daniel Deogun, Dan Bergh Johnsson, Daniel Sawano · Manning · 660 pages · ~17 hrs to read
Teaches how deep domain modelling — value objects, whole-value patterns, explicit invariants — eliminates entire vulnerability classes before a scanner ever runs. The best bridge between AppSec and the DDD-flavoured code most backend engineers already write.
The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh · Addison-Wesley · 1433 pages · ~36 hrs to read
A 1,200-page deep dive into source-level vulnerability hunting — memory corruption, string handling, and protocol parsing dissected at the byte level by working vulnerability researchers. The reference serious code auditors keep at their desk, not a day-one read.
Building Secure and Reliable Systems
Heather Adkins, Betsy Beyer, et al. · O'Reilly / Google · 546 pages · ~14 hrs to read
Google's own security engineers argue reliability and security are the same discipline — SRE-style incident response applied to breaches, secure design review, and access control at planet scale. The clearest look at how a mature AppSec program runs inside a company with thousands of services.
Agile Application Security
Laura Bell, Michael Brunton-Spall, Rich Smith, Jim Bird · O'Reilly · 385 pages · ~10 hrs to read
Shows how to fit threat modelling, security testing, and secure code review into two-week sprints without becoming the team everyone routes around — written by practitioners who ran AppSec inside real Agile shops, not consultants selling a framework.
Real-World Bug Hunting
Peter Yaworski · No Starch Press · 265 pages · ~7 hrs to read
Built entirely from disclosed HackerOne and Bugcrowd reports — XSS, IDOR, SSRF, and race conditions explained through the actual bugs that earned payouts at Twitter, Shopify, and Uber. The fastest way to build bug-hunting instinct beyond checklist theory.
Hacking APIs
Corey J. Ball · No Starch Press · 362 pages · ~9 hrs to read
Nine guided labs against intentionally vulnerable REST and GraphQL APIs — BOLA, excessive data exposure, and JWT attacks executed with Postman and Burp. AppSec engineers increasingly own API security review, and this is the most hands-on book covering that surface.
The Tangled Web: A Guide to Securing Modern Web Applications
Michal Zalewski · No Starch Press · 324 pages · ~8 hrs to read
An exhaustive, occasionally alarming dissection of browser security — same-origin policy edge cases, content sniffing, and 25 years of accumulated HTML/HTTP cruft — from a top browser security researcher. Dense but unmatched for reasoning precisely about front-end attack surface.
Application Security resources