The colleague who finds the flaw, documents the fix and helps everyone understand it is not always the colleague who nominates themselves for an award. Sometimes they are still improving the footnotes.

Security researcher and rising-star awards recognize different kinds of contribution. Some use an age cutoff, some count years in cybersecurity, and some assess a PhD or an independent research record. This guide helps you match the person to the rules before writing a nomination that sounds like a superhero's LinkedIn profile.

Checked: 17 October 2026. Computing's 2027 entries are open. The ISC2 and ACM examples below use published 2026 rules as planning references; their 2027 calls have not been verified.

Start with the right type of recognition

Swipe the table sideways on a phone.

Computing: two routes for different contributions

The 2027 category page sets an under-30 limit for Security Rising Star of the Year and asks for evidence that the person's work improved security. Outstanding Security Researcher/Analyst instead recognizes work such as identifying a threat, finding a mitigation or improving customer security. Do not transfer the rising-star age rule to the researcher category without a stated requirement.

The same page gives 27 November 2026 at 11:55 p.m. GMT as the deadline. Read the general entry conditions too: UK presence is required, entry is free, finalists are expected at the paid ceremony and finalist-logo access depends on a confirmed table booking. An individual nomination still needs a realistic attendance plan.

ISC2: early career is measured in experience

The ISC2 Rising Star Professional Award rules specify one to five years of cybersecurity work experience. Nominees must be ISC2 members in good standing; Associates and Candidates are excluded under the published eligibility. Nominators can be members or non-members, with the stated board/staff exclusions, and self-nominations are not permitted. Recognition is regional across the Americas, Asia-Pacific and EMEA.

The 2026 call gave an April 12 deadline and said nominations carried no fee. That deadline has passed; we have not verified a 2027 schedule. A career changer should check experience-based rules carefully rather than assuming that “rising star” always means “under 30.” Conversely, holding a credential does not by itself satisfy a contribution-based award.

ACM SIGSAC Early-Career Researcher: an independent research record

The 2026 call required a PhD from 2020 or later, with specified career interruptions considered case by case. It emphasized originality, depth and impact, especially contributions independent of PhD and postdoctoral advisers. Membership in ACM or SIGSAC was not required, but self-nominations were prohibited.

The deadline was 4 September 2026. The nomination package called for a CV, a statement of up to two pages and three endorsements from people other than the nominator, each limited to 500 words. Those are useful planning details, not confirmed next-cycle requirements. Start identifying people who can explain the research contribution specifically; three versions of “excellent colleague” do not add up to a research assessment.

ACM SIGSAC Dissertation Award: coordinate with the department

The 2026 dissertation call accepted work defended during 2025 and officially filed by 31 January 2026. It limited nominations to one dissertation per academic department, required an English version, and set a 30 June 2026 deadline. The nominator had to be a SIGSAC member; self-nomination was not allowed.

The requested package included the dissertation, a two-page nomination statement and three endorsement letters. This round is closed. For a future call, first speak with the department about its selection process, then verify the new date window. A thesis finishing in a different year does not become eligible because its topic is excellent.

Build a nomination around a contribution, not a personality

Choose two or three claims that an informed reader could verify. For a practitioner, that might mean a documented improvement to detection, a training program with measured results or an operational process that others now use. For a researcher, it might mean a paper, an artifact, an adopted method or a finding whose significance an independent expert can explain.

Use a simple structure for each claim: problem, personal contribution, evidence, result and limitations. Make the person's role clear when the work was collaborative. Credit coauthors, teammates and maintainers. A nomination can celebrate someone without quietly assigning them everyone else's work.

For vulnerability research, use approved public advisories, disclosure acknowledgements or other shareable records. Do not attach confidential incident reports, customer data or unreleased exploit details just to make the evidence look dramatic. Obtain permission for quotations and sensitive examples. A responsible disclosure process should remain responsible when there is a trophy involved.

What if the person cannot nominate themselves?

Ask a suitable colleague, supervisor or collaborator to review the rules and decide whether they can make an honest nomination. Give them a factual evidence folder and enough time to write in their own voice. Do not invent endorsement quotations or submit a letter as if someone else wrote it.

If AI helps organize the material, verify names, dates, metrics and citations against the originals. Our AI fact-checking checklist can help with that last pass. A confident sentence should never outrun its source.

A useful next step for each reader

If you meet the current Computing criteria, review the category and attendance terms before its November deadline. If an ISC2 or ACM route fits better, assemble evidence and wait for the verified next call. If none fits, keep the portfolio: it can still support a professional review, a conference proposal or a future nomination.

For organization and product recognition, see our cybersecurity awards guide. A person's contribution deserves its own clear account. It does not need to be squeezed into a product-marketing category simply because that form happens to be open.

More awards planning guides

• Cybersecurity Startup Competitions: Who Can Apply in 2027?
• Free-to-Enter Tech Awards: The Attendance and Promotion Costs to Check

Method and disclosure: AI assisted research and drafting; the illustration is AI-generated. Sources were checked on 17 October 2026. Preparation advice is editorial guidance, not a guarantee of eligibility or selection. See our editorial policy.