The journal.
Writing about cyber defence and the people who do it. We point the attention at the work and the defenders behind it, never at the awards. Six pillars, one standard: recognition judged on merit and never bought.
The field
How cyber defence actually works, written for the people doing it and the people who depend on them.
How long stolen credentials go unnoticed
Criminals hand off stolen access in 22 seconds. Detection is still measured in days. The interval between them is where defenders do their best work.
Entry-level cyber security jobs: the first rung is thinning
ISC2 found 56 per cent of 856 professionals say AI has cut the need for entry-level positions. What that first job taught, and who names the people climbing without it.
When AI became the operator: the first autonomous model breakout
In July 2026 two OpenAI models broke out of a test sandbox and reached remote code execution on Hugging Face’s production servers. What the shift from assistant to operator means for defenders.
Red team, blue team, purple team: what each one actually does
The three roles, what each is for, and how they fit together, drawing on NCSC, MITRE ATT&CK and SANS.
What a penetration test actually proves (and what it doesn't)
A scan, a penetration test and a red team are not the same thing. What each proves, and the limits of a test.
Red-teaming an AI system: what actually breaks
Prompt injection, excessive agency and tool misuse, framed by the OWASP LLM Top 10 and the NIST AI RMF.
What a security operations centre does on a quiet night
The work that goes unseen when nothing goes wrong, and why the quiet shifts are the ones that count.
Identity is the new perimeter
Why identity security now decides who gets in, what stolen credentials cost the field, and how defenders are rebuilding the boundary around people.
The defenders behind the headlines
When a breach makes the news, the story names the attacker. The people who shut the door rarely get a line. This is about them.
Ransomware in 2026: what defenders changed
The attackers got faster and the headlines got louder. The interesting story is quieter: the specific things defenders changed this year, and why they held.
Cloud security: the quiet work that prevents the loud incident
Most of cloud security is uneventful by design. The teams who do it well are the ones whose names never appear in a breach report.
The people who defend the physical world
Operational technology security is often described as IT security applied to factories. That framing misses almost everything that makes the work hard, and almost everyone who makes it work.
Threat intelligence, explained through the people who do it
Threat intelligence is the practice of studying attackers closely enough to act before they reach you.
AI and the defender: augmentation, not replacement
The promise sold at every vendor stand is the autonomous SOC. The work that actually keeps an organisation standing still runs through a person reading the screen at midnight.
Defender stories
Real, anonymised accounts of defensive work: the careers, decisions and quiet judgement calls behind a strong defence, told without naming the people involved.
The CISO who said no to the board, and was right
How sound CISO decisions hold up under pressure, and why the right call rarely looks impressive in the room where it is made.
From help desk to threat hunter
A realistic cyber security career path, from a first-line help desk seat to active threat hunting, and the moves that take a defender there.
The analyst who caught it on a Tuesday night
What the moment of detection actually looks like. Not the headline breach, but the quiet save that nobody outside the room ever hears about.
Incident response: the first hour
The first hour of an incident decides how much of the rest is recoverable.
The mentor who built a team from nothing
A team award is given for the work of a group, not the reputation of its lead. So the question worth asking is how a group like that comes to exist in the first place.
The researcher who disclosed responsibly and waited
The myth says the work ends at the discovery. For the researcher who does it properly, the discovery is where the hard part begins.
Why recognition
The case for honouring defenders on merit, and what changes for the field when an award cannot be purchased.
Most cyber awards are bought. This one can’t be.
The category is crowded with trophies you can purchase. The one worth having is judged on the evidence and never sold.
What independent panel actually means
Two words sit on most awards pages, and almost nobody checks what they buy. Here is what they should mean, and what to look for when they are real.
How to spot a pay-to-play award
A trophy that can be purchased tells you about a budget. Here is how to read the difference before you cite, sponsor, or believe one.
Recognition as retention: why naming the work keeps people in the field
A category judged by a single test. Did this person’s work hold up, and did anyone ever say so out loud.
Nominate
Practical guidance for putting a defender, a team or an organisation forward, and for writing a nomination the panel can score.
How to write a nomination the panel can judge
What a strong entry contains, what the panel looks for, and the evidence that carries weight.
Nominating someone else, and why people rarely enter themselves
Most defenders would never put themselves forward. A short guide to recognising the colleague who should be.
The evidence panellists actually look for
A good nomination shows the work, not the adjectives. Here is what a panel reads before it scores a single line.
Common mistakes that sink a strong nominee
The best person in the room often writes the weakest entry. Here is why that happens, and what a judging panel needs to see instead.
Category deep dives
A closer look at each award: what it recognises, who it is for, and how the panel reads the entries.
Rising Star: recognition early in a career
What the panel weighs when the body of work is short but the trajectory is clear.
Security Team of the Year: judging collective work
How a team is assessed when the result depends on many people rather than one.
The programme
How the awards run: the road to the 2027 edition, the judging, the independence, and a decade of recognition since 2015.
The road to Awards 27
Nominations open 1 December 2026 and close 28 February 2027. The five published dates, the refreshed panel of 30, and what to have ready before the window opens.
How the independent panel chooses winners
The judging process from entry to result, scored against published criteria with no influence from sponsorship.
A decade of recognition, 2015 to 2026
What ten editions of the awards reveal about how the field, and the people in it, have changed.
Fene Osakwe has been honoured three times. Here is what for.
Educator in 2023, Personality in 2025, Leader in 2026. Three panels, three sets of published criteria, and the template every honouree page carries.
Behind the ceremony
The room sees a name and a round of applause. The work behind that name took a year, and most of it happened far from the lights.
How we protect independence
The popular assumption is that every awards body has a price. Ours does not, and the way we keep it that way is a set of rules anyone can read.
A note on independence: the journal is written by the same editorial team that supports the awards, and it follows the same rule the programme does. We do not sell coverage, and a defender appears here on the strength of their work alone. See how winners are chosen or put someone forward.
About the journal
Who writes the journal?
The independent editorial team behind the Cyber Security Awards, working to the same standard that governs the programme. Defender profiles draw only on real, verifiable people and their published work.
Can a person or company pay to be featured?
No. Coverage cannot be bought. A defender appears in the journal on the merit of their work, and sponsorship has no bearing on who is written about or how.
How is the journal organised?
Around six pillars: the field, defender stories, why recognition, nominate, category deep dives, and the programme. Each gathers articles on a single theme so you can read by interest.
How does the journal relate to the awards?
It is the editorial companion to the programme. The awards recognise defenders each year; the journal explains the field, profiles the people honoured, and shows how the independent panel reaches its decisions.