In June of 2023 I was approached by my publicist to write a third edition of my book titled “Professional Penetration Testing: Creating and Learning in a Hacking Lab,” and I said “yes.” Thus began my long journey from conception to completion of what I consider to be a tome on the subject, simply based on page count of previous editions. Not gonna lie – the previous works were monstrous undertakings and consumed all of my free time for many months each. I also told myself at the conclusion of the previous editions that I wouldn’t be doing another one due to the commitment required, the anxiety of having to meet deadlines and the always impending dread that what I was creating would be poorly received by the community. Imposter Syndrome is a real thing and infects many of in the industry, and is something that would creep into my thoughts time and again whenever I wrote a book or article for publication.
Regardless, I said “yes” again, and the work began almost immediately, but not how many would imagine. I get asked a lot on what is required to write a book and it’s not what people usually think. I feel most people when they as the question about how to write a book assume that the book publisher has an idea of what they want written and think the author is given an assignment. There is nothing further from the truth than this expectation. In fact, it’s the opposite. The publisher looks to us – the subject matter experts – to know what is lacking in the industry and what should be addressed as a publication. So before a single word is penned to paper, there are some steps required to assure the publisher that what a writer proposes is actually something that the industry needs and will buy. This blog post will talk about the three months worth of steps I had to go through leading up to a contract being written and signed.
Author’s Proposal
My publicist already knew that my previous editions of my book had been successful and well-received in the industry, so it was easy to have the conversation about creating a third edition. In fact, it was the publicist that reached out to me asking if I wanted to write a new one. Regardless, there is still a proposal process that required some up front work on my end, specifically completing a proposal document, a personal biography and an updated Table of Content to describe what changes or new content would be included in the book. The proposal form contained the following topics that needed to be fully complete:
- Author Information (not the same thing as a bio… this included personal address, contact details, certifications, degrees, etc.)
- Target Audiences
- Purpose of the book (what problems will it solve, etc.)
- Benefits to the readers (what will make it valuable to the reader to purchase)
- List of published books this book will compete against (I had to include my previous editions in this list)
- Publication size (I got to skip this since we already had a good idea based on my previous works)
- A few other topics that were more personal in nature (timeline, requirements, etc.)
I was able to get the proposal, Table of Content and my Bio back to my publicist within the week, and then had to wait for a peer review to be performed.
Peer Review
I felt there was value to a third edition, but that was just my opinion. Before moving forward, my completed proposal, TOC and bio were sent to be reviewed by at least three of my peers in the industry. The peer review is anonymous so I don’t know who actually reviewed my material, and it took a month to complete. It was in July that I got the feedback on the peer review which was overall very positive. So much so that both my publicist and myself were happily surprised – neither of the previous editions had such a positive response as this new proposal. Guess so much had changed over the years the consensus was it was well past due to have a refresh on the book and my peers wholly endorsed a third edition. The (summarized) questions asked of the peers during the review included the following:
- What key knowledge and information needs are currently faced in the industry and will this new edition meet those needs?
- Can the proposed book compete with current published books?
- What are the strengths and weaknesses of the previous editions, and does the new edition address any of the weaknesses? (this is a scary question to be asked from the perspective of an author, tbh)
- Is this author the right person to write this book (another scary question – can we say “imposter syndrome?”)
…and many other questions that give the publisher an idea of whether or not to proceed with production and publication of the work.
Publisher’s Approval
Once my proposal has been reviewed by my peers and all the supporting documentation has been written, it goes through a presentation review by a publishing director who gives their stamp of approval or rejection. This phase took about six weeks before I heard word that my book proposal was accepted and a contract would be created for me to sign. After some back and forth about small details in the contract including the inclusion of an advance, the contract was signed by me and a final version was provided to me. It is always an exciting moment when I see the final contract due to a sense of validation by my peers and my publisher that they consider me a subject matter expert and believe I can contribute to the hacker community. I hope their beliefs are more than substantiated when my new book is completed and published.
Summary
I’m really excited that I get to write a third edition of Professional Penetration Testing – I feel now is the perfect time to get a refresh, and cannot wait for you all to read it. In the meantime, there is a lot to still do.
So here I am, with a contract in hand and a huge amount of self-induced stress. Wonderful, isn’t it?