Frequently asked questions.

The programme has run since 2014, with winners recognised every year from 2015 onward. One edition, 2024, was not held; every other year is recorded in the Hall of Fame through to 2026.

Yes. Categories cannot be bought. An independent panel scores each nomination against published criteria, and that independence is the programme’s entire value.

Anyone whose work defends the digital world: individuals, teams, products, services and communities, across ten categories in 2026. Peers and the community can put people forward.

From 2025, winners are announced online, so recognition reaches innovators everywhere. Select winners also receive an exclusive hospitality package to collect their award in person at a leading partner conference in Singapore, Vietnam, Thailand, Cambodia, Dubai or Denmark.

No. Sponsorship funds the ceremony and events only, and sponsors have no role in judging. The panel scores each nomination against published criteria, so no commercial arrangement can influence the result.

An independent panel of practitioners and recognised voices in the field, separate from the programme’s commercial side. Panellists score nominations against published criteria.

Yes. Every nomination is read in full and scored against the criteria for its category before any shortlist is drawn.

Yes. Self-nomination is welcome and judged on exactly the same basis as any other entry: the evidence, against the criteria.

Sponsors fund the event, not the judging. They cannot place a name on a shortlist, weight a score, or veto a winner. That separation is fixed.

Ten. The 2026 programme was restructured into five individual awards (Rising Star, Cyber Security Professional, Cyber Security Leader, Cyber Security Influencer and Cyber Security Advocate) and five organisation awards (Company, Product, Service, Team and Community).

Choose the one that best fits the contribution you want recognised. Individuals enter the people categories; firms, tools, services, teams and communities enter the organisation categories. Each category page sets out the criteria the panel uses, so you can match your evidence to the right award.

Recognition is decided by an independent panel on merit against the published criteria, and a place can never be bought.

Anyone who sets the security direction for a team or organisation and can show the outcomes of that leadership. Title and seniority are not the test; evidence of impact is.

In the 2026 restructure of the programme, which organised the awards into five individual categories and five organisational ones.

Fene Osakwe, recognised for resilient security strategy across finance, telecoms and government, and previously the programme’s Personality of the Year in 2025.

Any practitioner whose technical work has raised the standard of the field and who can show the outcomes of it. Title and seniority are not the test; depth and evidence of impact are.

Professional rewards the craft itself, the applied technical work done well over time. Leader honours the person who sets the direction and builds the team. The same person can qualify for both; nominate them where the evidence is clearest.

Prof. Victor Chang, Chair of Business Analytics at Aston Business School, Aston University, recognised for cybersecurity frameworks in use across several countries and a long record of mentoring researchers.

Anyone who carries the case for security to people beyond the profession and can show the difference it made. Educators, community organisers, mentors and practitioners who do this work all qualify. Audience size is not the test; changed behaviour is.

The Influencer category recognises someone who shapes the conversation within the field. The Advocate category recognises someone who reaches people outside it, boards, workforces and newcomers, and brings more of them in.

Jim West, recognised for sustained work putting the case for security in front of people outside the profession. He was earlier honoured by the programme as Cyber Personality of the Year in 2021.

No. Every winner is chosen by an independent panel that scores nominations against published criteria. Recognition is judged on merit and cannot be bought.

Anyone early in their cyber security career who can show real work and its effect on others. There is no fixed age or years-in-role cut-off; the panel weighs contribution against time in the field and reads the trajectory.

On three things: the work itself and whether it held up to scrutiny, the reach of that work beyond the nominee, and the trajectory it points to. Evidence carries more weight than potential on its own.

Jubilian Ho Hong Yi, an Information Security graduate and OffSec instructor recognised for his work and his contribution to communities that bring new people into the field.

Anyone whose research, teaching, writing or speaking has changed how others in the field work, with evidence of that change beyond their own organisation. Audience size is not the test; impact is.

No. The panel scores original contribution, reach that prompts action, and clear, generous explanation. A large following with no traceable effect on practice does not win.

The Influencer honour has run for several editions. In the 2026 restructure it became one of five individual categories, alongside five organisational ones.

Paul Jackson, CEO of THEOS Cyber, recognised for more than three decades in digital forensics, cyber investigation and incident response across Asia-Pacific.

Recent holders include Dr Franck Courbon in 2025, Tarnveer Singh in 2023, Jay Hira in 2022 and Clement Arul in 2021. The full record is in the Hall of Fame.

Any firm whose work over the year improved how its clients defend themselves and can show the outcomes of that work. Size is not the test; a small specialist can win over a large generalist on the strength of the difference it made.

No. The panel scores the outcomes for clients, not revenue or headcount. The criteria are weighted so a focused firm and a large one are judged on the same measure: what changed for the people who relied on them.

Bridewell, recognised for managed detection and response, testing and consultancy in regulated and critical sectors. The firm had earlier been honoured as Best Cyber Security Service Provider in 2025 and Best Security Company in 2023.

No. A place can never be bought. An independent panel decides on merit against the published criteria, and sponsorship has no bearing on who wins or where they are placed.

Any security product that can show what it changed for the people who use it. The test is evidence of impact in real deployments, not category size, market share or marketing reach.

Any managed or professional security service, from managed detection and response to consultancy and incident response retainers, that can show verifiable results for the clients it protects. The size of the contract book is not the test; evidence of impact is.

It reads for outcomes the clients can confirm. The strongest entries name the incident, the response and the result, and the clients stand behind them. A capability sheet on its own carries little weight.

THEOS Cyber, recognised for managed detection and response delivered across the markets where its clients operate.

No. Recognition cannot be bought. Every nomination is read in full and judged on merit against the published criteria.

Any group of people who defend an organisation together and can show the outcomes of that work: an in-house SOC, a data protection function, a managed defence team, or a cross-functional group formed for a specific mission. Size is not the test; evidence of what the team did together is.

No. Every nomination is read in full, and recognition is judged on merit alone. It is never bought.

A community, network, membership body, not-for-profit, or recurring event that brings defenders together. The test is what it does for its members, not its legal form or size.

ISC2 Security Congress, the annual gathering of ISC2 members, recognised for moving practice between defenders and keeping people in the field.

No. Every nomination is read in full, and recognition is judged on merit. It cannot be bought, sponsored into, or lobbied for.

Through the nomination form. The strongest entries show what changed for the members, with evidence the panel can check, rather than attendance figures.

No. Every nomination is read by an independent panel against the published criteria for its category. Sponsorship funds the ceremony, not the judging, so no payment influences whether an entry wins.

A colleague, a peer, a mentor, a supplier, a team, a company, a product or a community. There are five individual categories and five organisation categories in the current edition.

Describe what the nominee did, over what period, and what changed as a result. Keep claims next to proof, and point to checkable detail where you can. The panel scores the work, not the wording.

Nominations close on the published date for the current edition. Submit ahead of that date so the panel can read your entry in full. The closing date for the live edition is shown on the contact page.

Winners have been recognised every year since 2015, with no edition in 2024. The most recent cohort, from 2026, is Jubilian Ho Hong Yi, Victor Chang, Fene Osakwe, Paul Jackson and Jim West across the individual categories, with Bridewell, Saviynt, THEOS Cyber, Evalian and ISC2 Security Congress recognised among the organisations.

No. The programme paused for 2024, so there are no 2024 winners. Recognition resumed in 2025 and continued in 2026 with a restructured set of categories.

No. Every winner is chosen by an independent panel that scores nominations against published criteria. Sponsorship has no bearing on who wins or where they appear.

The 2026 cohort is shown on this page, and every earlier edition has its own page listing that year's winners category by category. The full year-by-year record runs back to the first edition in 2015.

Fene Osakwe was named Cyber Security Leader of the Year at the 2026 Cyber Security Awards. He was also Cyber Personality of the Year in 2025, recognised across two consecutive editions of the programme.

He advises boards and executive teams on cyber security strategy and resilience, and speaks at international conferences. He sits on the Forbes Technology Council and has worked across financial institutions, telecoms and governments.

The panel recognised his record of building resilient security strategy across sectors and of translating technical risk into terms boards can act on. Recognition is judged on merit against the published criteria for the category.

No. The Cyber Security Awards are judged on merit. Recognition cannot be purchased, sponsored into existence, or traded for. Every winner earns the citation on the strength of their work.

Jubilian Ho Hong Yi was named Rising Star in Cyber Security at the 2026 Cyber Security Awards, the individual category that honours people early in a career who already raise the standard for defenders around them.

He is a penetration tester at Ensign InfoSecurity in Singapore, holding the OSCP certification. His work spans vulnerability assessment, source code review and exploit development, finding flaws before attackers can use them.

At Black Hat Europe 2023 Arsenal he presented on malicious NFTs, showing how attackers abuse the Web3 stack and giving practical guidance on verifying sites, treating free NFTs with caution, and keeping data hygiene tight in blockchain development.

Paul Jackson was named Cyber Security Influencer of the Year at the 2026 Cyber Security Awards, judged on merit against the published criteria for the category.

He is Regional Managing Director, Cyber Risk and Investigations for Asia-Pacific at Kroll, based in Hong Kong.

He has spent more than twenty-five years across law enforcement and corporate cyber, beginning in the Hong Kong Police Force and later leading high-tech investigations at a global bank before moving into advisory practice.

No. Recognition is decided by an independent panel on merit. The honour is never bought or sponsored.

Jim West was named Cyber Security Advocate of the Year at the 2026 Cyber Security Awards, recognising his work training and mentoring newcomers into the profession.

Yes. He was named Cyber Personality of the Year in 2021, having been shortlisted in earlier editions before that.

TopCyberPro.com is the Houston-based company Jim West founded to coach, mentor and train people moving into cyber security, with a focus on helping them earn certifications affordably.

Bridewell was named Cyber Security Company of the Year at the 2026 Cyber Security Awards, judged on the strength of its managed detection and response, consulting and testing work across the year.

Bridewell is a UK-based cyber security services firm. Its teams run a 24/7 security operations centre, deliver managed detection and response, and provide consulting and penetration testing, with a focus on critical national infrastructure.

No. The Cyber Security Awards are judged on merit by an independent panel. Recognition cannot be bought, sponsored or influenced through any commercial arrangement.

Saviynt was named Cyber Security Product of the Year at the 2026 Cyber Security Awards, for the Saviynt Identity Cloud, its converged platform for identity governance and access management.

Saviynt builds a cloud-first identity security platform that covers identity governance and administration (IGA), access management and privileged access, giving organisations visibility and control over who can reach which systems.

No. Every Cyber Security Award is judged on merit against published criteria. Recognition cannot be bought or sponsored. The panel assessed Saviynt against the Product category criteria.

Most breaches involve misused credentials and over-broad access. Identity governance lets a security team see every account, enforce least privilege and remove access the moment it is no longer needed, which closes a route attackers rely on.

THEOS Cyber was named Cyber Security Service of the Year at the 2026 Cyber Security Awards, in the organisation half of the restructured programme.

THEOS Cyber is headquartered in Singapore and serves organisations across the Asia-Pacific region, with a team spread across several continents.

THEOS Cyber runs managed threat detection and response, incident response, penetration testing and cloud security work for clients in finance, fintech, healthcare, manufacturing and other sectors.

No. Recognition at the Cyber Security Awards is judged on merit against published criteria. A place is never bought.

Evalian was named Cyber Security Team of the Year at the 2026 Cyber Security Awards, one of the five organisation categories in the restructured programme.

Evalian is a UK consultancy that brings cyber security and data protection together under one roof, covering data protection and GDPR compliance, penetration testing, ISO 27001 certification support, and a UK-based managed SOC for round-the-clock monitoring.

No. The Cyber Security Awards are judged on merit. Recognition cannot be bought, and the Team category is decided on the evidence a team submits against the published criteria.

Evalian works across the UK with offices in Southampton, London, Worcester and Dublin, supported by a team that has grown well beyond fifty specialists.

ISC2 Security Congress was named Cyber Security Community of the Year in the 2026 programme, one of the five organisation categories introduced when the awards were restructured that year.

ISC2 is the non-profit professional body for cyber security practitioners, with hundreds of thousands of certified members worldwide. Security Congress is its annual conference, held each year since 2011, where members gather to learn, earn continuing education credits and meet their peers.

The Community of the Year category honours the people and gatherings that hold the profession together. A conference qualifies when it gives practitioners somewhere to learn from one another, not just a place to sit and listen.

No. Every category at the Cyber Security Awards is judged on merit. Recognition is never bought, and sponsorship buys no influence over who wins.

Yes. The long and short boilerplate on this page is cleared for reuse and adaptation. We ask only that you name the year and category when you cite a specific result, since these have changed across editions.

No. The programme did not run a 2024 edition. Winners are recorded every year from 2015 onward, with the 2026 edition restructured into five individual and five organisation categories.

No. Categories are never for sale. The programme is funded through sponsorship of the ceremony and events, which plays no part in the judging. The panel scores the evidence a nominee submits against published criteria.

Write to [email protected] with the claim you need checked and your deadline. We will point you to the record on the methodology or Hall of Fame page so you can verify it yourself.

Write to [email protected]. It reaches the team that handles questions about the programme, the categories and the timeline, and a person reads each message.

We aim to answer every genuine enquiry within a few working days. Replies can take a little longer in the weeks around the ceremony, when the team is busiest.

No. Nominations go through the nomination form, which guides you through the evidence each category asks for. Email us only if a question is not covered there.

No. Recognition cannot be bought. The panel scores each nomination against published criteria, so no payment or message will place anyone on a shortlist.

For media and interviews, write to [email protected]. For ceremony and event sponsorship, write to [email protected].