Chapter 79 — Deep specialisation tracks and the research frontier

What this guide still doesn't cover, and where it actually lives

Even at this depth, real fields remain genuinely out of scope. Naming them precisely, with where to actually go, is more useful than a vague "there's more to learn."

   BINARY EXPLOITATION / MEMORY-CORRUPTION RESEARCH
     stack/heap overflows at the ROP/JOP level, use-after-free exploit
     dev, browser/kernel exploitation, mitigation bypass (CFI, CET,
     MTE). -> pwn.college's advanced modules, "Windows Kernel
     Programming" / "A Guide to Kernel Exploitation" (Perla & Oldani),
     the annual Pwn2Own writeups, CTF "pwn" categories specifically.

   REVERSE ENGINEERING AND MALWARE ANALYSIS AT DEPTH
     Ch 75 gave you triage-level literacy: preserve evidence, identify
     persistence, extract IOCs, and decide when to escalate. Deep work means
     Ghidra/IDA/Binary Ninja scripting, unpacking, anti-analysis defeat, and
     firmware RE. -> "Practical Malware Analysis" (still the standard start),
     then malware.unicorn.org's advanced tracks, and following published
     APT-analysis reports (Mandiant, Google TAG) as an ongoing practice.

   MOBILE SECURITY AT DEPTH
     Ch 70 gave you the real review model: platform trust boundaries, local
     storage, token handling, backend authorization, and instrumentation.
     Deep work means iOS/Android internals, Frida instrumentation,
     keystore/keychain attacks, jailbreak/root research, and exploit chains
     against mobile runtimes. -> OWASP MASTG/MASVS (the mobile analogue of
     this guide's web depth), "The Mobile Application Hacker's Handbook."

   HARDWARE / EMBEDDED / SIDE-CHANNEL SECURITY
     JTAG/glitching, TEE (SGX/SEV/TDX) attacks and CONFIDENTIAL
     COMPUTING more broadly, Spectre/Meltdown-class microarchitectural
     attacks, RF/SDR. -> *The Hardware Hacking Handbook* (G1 reference),
     and specifically watch CONFIDENTIAL COMPUTING as a live, fast-moving
     research area directly relevant to Part 7's data-protection story --
     it's the natural next step beyond "encrypt data at rest and in
     transit" toward "encrypt data even while it's being COMPUTED on,"
     with real production use already (AWS Nitro Enclaves, Azure
     confidential VMs, Google Confidential Space).

   CRYPTOGRAPHIC ENGINEERING AND PROTOCOL VERIFICATION
     implementing primitives correctly and constant-time, and FORMALLY
     VERIFYING protocol security properties (Tamarin, ProVerif) rather
     than reasoning about them informally as this guide does throughout.
     -> cryptopals.com (G1 reference) remains the best hands-on start;
     the Tamarin Prover tutorial for formal protocol analysis; this is
     also where POST-QUANTUM MIGRATION RESEARCH (G1 Part 6) is most
     active right now -- new attacks and refinements on the NIST-selected
     algorithms are an ongoing research area, not a solved problem.

   AI / ML / LLM SECURITY
     Ch 69 gave you the application-security model for LLM apps and agents:
     untrusted instructions, tool isolation, retrieval boundaries, logging,
     evaluation, and cost controls. Deep work means adversarial ML,
     model-extraction/inversion research, poisoning at training and
     fine-tuning scale, AI supply-chain assurance, agentic-tool ecosystems,
     and rigorous AI red teaming. -> OWASP GenAI/LLM guidance, MITRE ATLAS,
     and a dedicated AI/ML guide if one exists alongside this one. The
     overlap with this guide's Part 5 (distributed authorization for
     agent-to-tool calls) and Part 6 (prompt injection is structurally an
     injection class, G1 Ch 42) is substantial and growing.

   GOVERNANCE, RISK, AND FORMAL SECURITY MANAGEMENT AT DEPTH
     Part 9 gave you working literacy; a CISO-track career goes
     considerably deeper into enterprise risk management, security
     architecture frameworks (SABSA, TOGAF's security extensions), and
     organisational change leadership specifically. -> CISSP's domain
     structure (even if you never sit the exam) is a reasonable syllabus
     for the breadth; *CISO Desk Reference Guide* for the role-specific
     material this guide didn't attempt.

   PHYSICAL SECURITY, SOCIAL ENGINEERING, AND OSINT AT DEPTH
     badge cloning, lock-picking, pretexting, and the tradecraft side of
     red-team engagements (Ch 60) that this guide's chapter only framed
     at the governance level. -> DEF CON's Social Engineering Village
     content and *Social Engineering: The Science of Human Hacking*
     (Hadnagy) for a structured start; genuinely requires hands-on
     practice and, for anything beyond OSINT, explicit written
     authorisation every single time (G1 Ch 0.6, non-negotiable here more
     than almost anywhere else in security work).

The research frontier — where the ground is still moving

A few areas worth watching specifically because this guide's advice will age, and knowing WHERE to expect change is more durable than any specific fact:

   POST-QUANTUM CRYPTOGRAPHY MIGRATION (G1 Part 6, this guide's Part 2/7
     key-management chapters) -- the standards are set, but real-world
     migration tooling, hybrid-mode performance characteristics, and
     even the algorithms' own cryptanalytic scrutiny are all still
     actively evolving. Revisit this area at least annually.
   CONFIDENTIAL COMPUTING -- moving from "encrypt at rest and in transit"
     (Part 7) to "encrypt/isolate during computation itself" is becoming
     practically deployable rather than purely theoretical; watch how it
     changes the "who can decrypt" question at the heart of Part 7 Ch 42.
   PASSWORDLESS/PASSKEY ADOPTION (G1 Ch 46, referenced throughout this
     guide's identity chapters) -- adoption curves and the specific
     phishing-resistance guarantees are still shifting as major platforms
     roll out support at different paces.
   AI-ASSISTED OFFENSE AND DEFENSE -- both attackers and defenders
     increasingly use LLMs for reconnaissance, code review, and detection
     triage; the net effect on the offense/defense balance is a live,
     genuinely unsettled debate worth tracking rather than assuming a
     settled answer either way.
   MEMORY-SAFE LANGUAGE ADOPTION -- a slow but real industry shift
     (government and major-vendor mandates increasingly push toward
     Rust/Go/etc. for new systems code) that will, over a long horizon,
     shrink the entire memory-corruption category this chapter just
     pointed you toward as "out of scope" -- worth knowing as context even
     if you never write the code yourself.