awesome-security: a curated map of security tools and learning resources

awesome-security (about 15,000 stars on GitHub) is one of the oldest and best known awesome lists in the security field. It was started in 2015 by the GitHub user sbilly and has been extended by more than a hundred contributors since. The repository is a single long README of links, each with a one-line description, plus a contribution guide. It contains no code and no technical content of its own; its value is the selection and the structure.

What an awesome list is

An awesome list is a GitHub convention, popularised by the sindresorhus/awesome index, for a hand-curated list of links on one subject. Good lists accept only things the maintainers consider genuinely useful, keep every entry described in one line, and are reviewed through pull requests like any other project. The article What is an awesome list? in this topic explains the convention and how to judge whether a list is still maintained.

How it is organised

The list is divided first into broad areas and then into subsections, so a reader can jump straight to the part of the field they care about:

• Network: scanning and monitoring tools, intrusion detection and prevention systems, honeypots, packet capture and analysis, and firewalls.
• Endpoint: anti-virus and endpoint protection, configuration management, authentication, and mobile and macOS security.
• Threat intelligence: feeds, platforms and standards for sharing indicators.
• Web: web application firewalls, scanners and application security tooling.
• Usable security and privacy, big data and DevOps tooling.
• Operating systems built for security work, both for defence and for testing.
• Education: datasets, books, online courses, certifications, and other awesome lists that go deeper into a single area.

How to use it

Treat it as a map rather than a reading list. When you need a tool for a job you have not done before, for example a honeypot or a threat intelligence platform, open the matching section, read the one-line descriptions, and then evaluate the two or three projects whose names you recognise or that have the most recent activity. The list does not rank entries and does not remove old ones quickly, so always check a project’s own repository for its licence, last commit and open issues before depending on it. Because the whole thing is one Markdown file, searching it with your browser’s find function, or cloning it and running grep, is faster than scrolling.

Credit

awesome-security is maintained by sbilly and the contributors listed on GitHub. It is published under the MIT license.