The evidence panellists actually look for

Panellists score evidence, not enthusiasm. A nomination that says a person is talented gives a judge nothing to weigh, while a nomination that shows what that person did under pressure gives a judge a decision to make. That gap, between the claim and the proof, decides most entries before the final round even begins.

Specific actions, dated and attributable

The first thing a reader looks for is a concrete action with a date and a name attached to it. Not a department. Not a vendor. A person, doing a thing, at a time you can point to.

Consider a SOC analyst on a Tuesday night shift who notices a pattern of failed logins that the tooling has not flagged, traces it to a compromised supplier account, and contains it before the attacker reaches anything that matters. That is a nomination. It has a moment, a decision, and an outcome. Compare it with a sentence that praises the same analyst for being dedicated and proactive, and you can see why one survives a panel and the other does not.

The fix is plain. Replace every adjective with the action that earned it. If the nominee is described as influential, show the talk, the standard, the open tool, or the disclosure that influenced others.

Outcomes a third party can confirm

Judges read a great deal of self-description, so they place real weight on anything an outsider can corroborate. A published advisory, a CVE credited to the nominee, a conference programme, a regulator's acknowledgement, a customer reference that is willing to be named. The annual Verizon Data Breach Investigations Report and the threat landscape work from ENISA both make the same quiet point about defence: the events that matter most are often the ones that leave a verifiable trail. A nomination that points to that trail is doing the panel's verification for it.

None of this needs to be dramatic. A patch that shipped because the nominee escalated correctly is corroboration. A runbook now used across a team is corroboration. The test is simply whether someone other than the nominator could confirm it.

Scale, difficulty, and the context around the result

Two analysts can report the same outcome, and a panel will still rank them differently, because context changes what a result is worth. Containing an intrusion across a thousand endpoints during a live incident is not the same as closing a low-risk ticket, even when both read as resolved.

So a good nomination sets the scene before the result. How large was the estate. How little time was on the clock. What would have happened if the nominee had missed it. A judge cannot weigh difficulty that the nomination never describes, and difficulty is precisely where merit shows.

Honest attribution of who did what

Cyber security is team work, and panels know it. An entry that hands a single person every credit for a year of collective effort reads as inflated, and inflation invites doubt about the parts that are true.

The more credible move is to draw the line clearly. State what the nominee personally owned, name the moment their judgement changed the outcome, and acknowledge where colleagues carried the rest. For a team award, the same honesty applies in reverse. Show how the group functioned together, and name the individual decisions that held it together on a bad night. Honesty does not weaken a nomination. It is the thing a panel trusts.

Evidence the criteria actually ask for

Every category publishes what it is looking for, and the most common reason a strong candidate scores poorly is a nomination written for the wrong award. A Rising Star entry that reads like a Leader entry forces the panel to discount most of it.

Read the criteria for the category first, then write to them. National guidance such as the material the NCSC publishes on good practice can help frame a contribution in terms a panel recognises, but the published category criteria are the only checklist that scores. If the criteria ask for measurable impact, lead with the measure. If they ask for community contribution, lead with what the nominee gave away.

Clarity that respects the reader's time

A panel reads many entries in a sitting, so the nomination that is easy to follow has a real advantage over one that buries its best moment in paragraph four. This is not about polish. It is about putting the strongest evidence where a tired reader will find it.

Open with the single most defensible thing the nominee did. Support it with the corroboration. Then add the context that shows how hard it was. A nomination built in that order does the judge a favour, and judges remember the entries that respected their attention.