How the judging panel is assembled
A judged award is only as good as the people reading the evidence. Here is how that panel is chosen, and what it is asked to ignore.
The Verizon Data Breach Investigations Report read more than 22,000 security incidents to compile its 2024 edition, and the people who read them were not chosen for their job titles. They were chosen because they could look at a messy intrusion and tell a defensible story about what actually happened. A judging panel works the same way. The whole value of a judged award rests on who reads the evidence and on what they are asked to leave at the door.
So the question every credible programme has to answer in public is a plain one. How are award judges chosen, and what stops the choice from quietly favouring the loudest names in the field? The answer is not a secret. It is a process, and it is written down before a single nomination arrives.
Who sits on the panel, and why
A panel that judges defenders has to be built from defenders. The starting point is practitioners who have done the work the categories describe. A judge reading the Cyber Security Leader entries should have run a security function under real pressure. A judge reading the security product entries should have bought, broken, or deployed tools of that kind, not just read the brochure.
Beyond practitioners, the panel draws on three other groups. Past winners, who know what a strong entry looks like because they wrote one. Independent researchers and academics, who keep the reading honest and ask for evidence rather than reputation. And specialists from outside the immediate field, brought in for categories that touch areas like national infrastructure or skills, where a narrow lens misses the point.
Naming matters here. The European Union Agency for Cybersecurity (ENISA) and the National Cyber Security Centre (NCSC) both publish their work under named authorship, because a finding you can attribute is a finding you can question. The panel follows that principle. Judges are named, their backgrounds are visible, and the categories they read are recorded. A panel that judges in the dark is asking to be trusted on faith, and faith is not a standard.
What a judge is asked to ignore
The harder half of panel design is not who you let in. It is what you ask them to set aside once they are reading.
A judge is asked to ignore the size of the nominee. A two-person consultancy and a global vendor are read against the same published criteria, because the criteria measure the work, not the headcount behind it. A judge is asked to ignore who sponsors the programme, because sponsorship buys nothing in the scoring and the scoring is the only thing that produces a winner.
Most of all, a judge is asked to ignore the noise. The nominee who fills a feed with thought leadership is not, on that basis, ahead of the analyst nobody has heard of. The Verizon report is blunt about where breaches actually come from, and the human factor sits at the centre of it year after year. The defenders who hold that line are often invisible by design. A breach prevented makes no headline. A judge reads for the quiet thing that held, not the loud thing that trended.
How conflicts of interest are managed
Expertise creates a problem of its own. The people best qualified to judge a category tend to know the people competing in it. A panel that pretended otherwise would be fooling only itself.
So conflicts are declared, not discovered. Before a judge is confirmed, they disclose their employer, their advisory roles, and any commercial relationship that could touch a nominee. When a conflict appears during reading, and it does, the judge recuses themselves from that category and the score is taken from the rest of the panel. No judge scores an entry from their own organisation. No judge scores a client, a vendor they sell, or a former colleague whose work they cannot read at arm's length.
This is also where one rule sits above the rest. The body that runs the programme never competes in it. Red Team Partners, the company behind the awards, appears in no category, no ranking, and no winners list, ever. An award that let its own house win would have nothing left to offer the field. Keeping the organiser off the board of play is not modesty. It is the thing that makes every other result mean something.
Why the basis is published
A panel can be perfect and still useless if nobody can see how it reached a result. So the basis is published. The criteria are public before nominations open. The judges are named. The process, scored against those criteria, read by people with declared interests, is set out in the methodology rather than implied.
This serves the field in a way that goes beyond fairness. A judged result with a visible basis can be checked, quoted, and trusted long after the ceremony. A trophy with no published process cannot.
Which leaves the only question that really matters when you read any award. If you cannot see who judged it, against what, and with what declared, how would you ever know whether the name on the trophy earned it?
The judging panel
Who is allowed to be a judge?
Judges are practitioners with direct experience of the work a category describes, alongside past winners and independent researchers. They are vetted for conflicts of interest before being confirmed, and their names and backgrounds are published.
What happens if a judge knows a nominee?
The judge declares the connection and recuses themselves from that category. The score for that entry is taken from the rest of the panel. No judge scores their own organisation, a client, or a former colleague.
Can a sponsor influence who judges or who wins?
No. Sponsorship buys nothing in the scoring, and the body that runs the programme never competes in it. Selection and scoring rest on the published criteria alone.
Are the judging criteria public?
Yes. The criteria are published before nominations open, the process is set out in the methodology, and judges are named, so any result can be questioned against a visible standard.