ABOUT
Not just what's happening in security, but what's being built to solve it.
The Cyber Toolchain is for practitioners who want to know what's new in the tools they use. We follow more than 1,300 cyber tools and write about what they ship, how they work, how they position themselves, and where the market is heading. A toolchain is the tools you connect to get a job done, each one handing its work to the next. When one tool changes, the jobs that run through it can change too. What we mean by toolchain.
The daily issues, the weekly picks, and the tools directory are free to read. A subscription adds email delivery, filtering to the tools you run, and analytics and reports that only paid plans can see, and a show is coming soon.
We want everyone to have better cyber tools to defend with. That only happens if what we publish reaches the product leaders, founders, and maintainers who build those tools and shapes what they build, and if every organization has the information it needs to adopt the defenses that protect it.
$ cat ./mission.txt # format: newsletter · articles · show coming soon ▸ find the cyber tools worth using ▸ stay current as they change ▸ see where the market is heading, in the data ▸ show builders what great looks like ▸ coming soon: a show with the people who build them $ whoami jon_schipp # host & creator
THE HOST
Jon has spent his career in security engineering, incident response, and software development, where he built tools, ran them in anger, and evaluated the teams behind them. That tooling-first habit is the reason the newsletter exists, and the show, coming soon, will follow the same approach.
He started in hands-on security engineering at NCSA, writing open-source tools used in universities and SOCs. As a founding member of Komand he was both its security lead and an engineer, building many of its integrations and the release and deployment infrastructure, and at Rapid7 he went on to lead integration and SOAR engineering. He also built this site's pipeline with AI coding agents, from the release-note fetchers and LLM summaries to the front end.
Today he spends much of his time on agentic engineering, building software with AI coding agents and the harnesses around them. In his setup the agents file their own issues, implement the changes, and review each other's work while tests, logs, and spend limits keep them in check. The Toolchain runs this way, which is why he cares so much about which agents and models are the right tools for the right jobs.
He has led product across Attack Surface Management, Exposure Management, Security Orchestration, Automation and Response (SOAR), and GRC, and has built SaaS platforms along the way.
He got his start couch-surfing his way to hacker conferences as a teenager, and curiosity has driven everything since. The community affectionately calls him the "Ric Flair of Cybersecurity."
THREE WAYS TO FOLLOW
The Newsletter
Every day, a rundown of what more than 1,300 cyber tools shipped, with the exact commands to run the new features. It's free to read on the site.
Read the latest →The Show
Live tool demos and conversations with the people who build them. Coming soon.
Follow the channel →Articles
Field notes and deeper write-ups when a tool deserves more room.
Browse articles →