Books
5 books by Kubilay Tunca, covering the same ground as this blog at the length the subject actually needs. Each book page says plainly who the book is for and who should skip it, so you can rule one out in thirty seconds rather than after buying it.
As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.
At a glance
Which one to read, and — just as usefully — which to skip.
| Book | Best for | Skip it if | You'll learn | Assumes | Main topics |
|---|---|---|---|---|---|
| The Digital Fortress | Anyone protecting their own money, accounts and family online | You already use a password manager, hardware keys and a threat model | Which few habits absorb most real-world risk, and what you may ignore | No technical background | Passwords, two-factor, phishing, backups, home network |
| The Anonymity Playbook | Journalists, sources, activists and anyone whose privacy has stakes | You want a list of tools rather than an account of the adversary | Threat modelling, what metadata leaks, how to keep identities separate | No specialist background, but a willingness to accept trade-offs | Operational security, Tor, metadata, source protection, surveillance |
| Secure Software Development | Developers shipping production code under delivery pressure | You want a certification study guide or a penetration-testing book | The secure pattern for each decision, and the near-miss that looks equal | You write and review real code | Input handling, authentication, secrets, dependencies, CI/CD |
| The Secure Harness | Teams running AI coding agents in repositories others depend on | You want prompt technique, or a pipeline with no human review gate | Permission scoping, hooks, release gates and usable audit trails | Agents are already writing code you are answerable for | Agent security, MCP, permissions, hooks, sandboxing, audit logging |
| The AI Native Engineer | Engineers taking AI features from a working demo to production | You are training or fine-tuning models from scratch | Retrieval that degrades well, evaluation as a habit, cost as a constraint | You are building on top of existing models | RAG, evaluation, LLM observability, tool use, AI cost control |
-
The Digital Fortress
Your Everyday Guide to a Safer Digital Life · Second Edition
Stay Safe Online Without Making It Your Second Job
A warm, plain-English guide for people with real lives and finite patience. Learn the handful of habits that genuinely protect your money, accounts, and family, and get honest permission to ignore the rest.
Skip it if: If you already use a password manager, hardware security keys, and have thought about your own threat model, this book will read as revision. Start with Secure Software Development or The Anonymity Playbook instead.
-
The Anonymity Playbook
Digital Survival for Whistleblowers, Journalists, Activists, and Everyone Else · Second Edition
For People Who Cannot Afford to Get Privacy Wrong
A practitioner’s field manual for journalists protecting sources, whistleblowers, and activists. It explains how the surveillance actually works, what each technique costs you, and exactly where it fails.
Skip it if: This is not a manual for evading a lawful investigation, and it does not pretend to be one. It assumes a lawful reader with a legitimate need for privacy, and it is explicit throughout about where each technique fails — including against adversaries it cannot defeat.
-
Secure Software Development
Practical patterns for building secure software
Write, Ship, and Maintain Code Without Shipping Vulnerabilities
A hands-on security guide for developers and IT professionals who ship real software. Build, deploy, and maintain secure systems without slowing down or drowning in theory.
Skip it if: This is not a certification study guide and it does not map to exam objectives. It is also not a penetration-testing book — the perspective throughout is the person building the system, not the person attacking it.
-
The Secure Harness
Shipping Production Code with AI Coding Agents
Use AI Coding Agents Without Losing Control of Your Codebase
A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates.
Skip it if: This is not a prompt-engineering book, and it will not make an agent better at writing code. It also assumes you want a human in the loop — if the goal is a fully autonomous pipeline with no review gate, its recommendations will read as friction.
-
The AI Native Engineer
Build, Evaluate, and Ship AI Systems That Work in Production
Stop Shipping Demos. Start Shipping Systems.
Sixteen hands-on chapters, one real product. Grow it from a single model call into a retrieved, tool-using, observable, production-grade system, with evaluation treated as a habit from the first feature.
Skip it if: This is not about training or fine-tuning models from scratch, and there is no CUDA in it. If you are doing research rather than building on top of existing models, it is aimed elsewhere.