Cyber Security Professional of the Year.

Behind most defended systems sits one practitioner who did the unglamorous work well, and did it for years. This category honours that person, and the panel scores the craft, not the job title.

Quick answer

What does the Cyber Security Professional of the Year honour?

The Cyber Security Professional of the Year category recognises the practitioner whose technical work, applied across real systems, raises the standard of how the field defends itself. It is judged on depth and on evidence: research that others now build on, frameworks adopted beyond their author, defences that held when tested, and a record of teaching the next people coming through. The panel looks for proof that the nominee changed practice, mapped to the published criteria. Seniority and job title alone do not decide it. Introduced in the 2026 restructure of the programme, the category sits among five individual honours alongside Rising Star, Leader, Influencer and Advocate. The award has a single ownable rule that holds across every category: every nomination is read in full, and recognition is judged on merit and never bought. The current holder is Prof. Victor Chang, recognised in 2026.

Who holds it

The 2026 Professional of the Year

Winner 2026

Prof. Victor Chang

Cyber Security Professional · 2026

Prof. Victor Chang holds the Chair of Business Analytics at Aston Business School, Aston University. He was named Cyber Security Professional of the Year in 2026 for work that reaches well beyond the page: cybersecurity frameworks that protect data centres across several countries, privacy-preserving AI in clinical use, and a mentoring record that has shaped early-career researchers across six continents.

A decade of winners sits in the Hall of Fame.

What the panel scores against

The criteria reward applied craft over reputation. Judges read for technical depth that holds up to scrutiny, for work that others have adopted or built upon, and for outcomes that can be checked against a named system, paper or programme. A nomination that names the problem, the contribution, and what changed because of it will always travel further than one that lists certifications.

The panel also weighs how a professional lifts others. The field is short of skilled people, so evidence that a nominee taught, mentored or opened a door for someone else counts as part of the work, not a footnote to it.

What a winning record looks like

Strong nominations in this category show a contribution and its reach. A defence designed once and now running in places its author never visited. A method published and then used by teams who have never met the person who wrote it. A junior analyst who is now senior because someone took the time. The professional’s fingerprints are on the change, and the evidence is checkable.

Weak nominations describe a role. Years served, tools mastered, a title earned. The panel reads past the CV and looks for the specific work only this person did, and what that work produced for the people it protects.

How it relates to the other individual categories

The 2026 restructure set five individual honours side by side, and they sort cleanly by where a person’s impact lands. Professional rewards the craft itself, the technical work done well over time. The Leader award honours the person who sets a team’s direction. The Rising Star recognises early-career promise already showing in outcomes. Influencer and Advocate cover those who change minds and widen the door. A practitioner can fit more than one; nominate them where the evidence is strongest.

How it is judged

The criteria the panel scores against

The Cyber Security Professional of the Year award celebrates an individual who has consistently demonstrated excellence, expertise, and dedication in their role within the cybersecurity industry. It recognises professionals who deliver measurable results, contribute to the advancement of the industry, and show a strong commitment to ongoing growth and development — embodying professionalism and integrity while supporting the success of their peers and organisations.

01Achievement: Evidence of significant achievements and recognition within the cybersecurity industry, including successful projects, publications, speaking engagements, or other measurable outcomes.
02Contribution to the Industry: Evidence of contributions to the cybersecurity industry through thought leadership, innovation, collaboration with peers, or active participation in industry initiatives.
03Dedication: Evidence of a strong commitment to cybersecurity, demonstrated through ongoing professional development, pursuit of excellence, and a proactive approach to addressing challenges.
04Developing Others: Evidence of efforts to mentor and support colleagues or the wider community, including the development of training programmes, mentorship initiatives, or other educational activities.