Cybersecurity professionals often have unusually visible records: disclosed vulnerabilities, conference talks, open-source tools, competition results and review board service. The EB-1A requires "sustained national or international acclaim," shown by a major international award or "at least three" of ten criteria (8 CFR 204.5(h)(3), eCFR), and the O-1A uses a similar list of eight (8 CFR 214.2(o)(3)(iii), eCFR).
As of October 26, 2026, the challenge for security researchers is rarely a lack of activity. It is showing that the activity amounts to recognized, significant contributions. This guide maps the criteria to security careers.
- EB-1A requires a major international award or three of ten criteria; the O-1A requires an award or three of eight.
- Original contributions need evidence of major significance, such as published materials about the work, citations or commercial use.
- Open-source tools can count when there is evidence of significant impact in the field.
- Reviewing talks or papers for recognized conferences can support judging, with proof of actual participation.
- Published material must be about the person, not just the employer.
- The NIW guidance gives weight to STEM areas important to national security, but benefits to one employer alone are not enough.
Which criteria fit cybersecurity work?
| Criterion | Security evidence that may be offered |
|---|---|
| Original contributions of major significance | Vulnerability research that changed practice; tools adopted across the industry |
| Scholarly articles | Papers at security conferences or journals; published research write-ups for expert readers |
| Judging the work of others | Conference program committees or review boards; journal review |
| Published material about you | Coverage of your research in major media or trade publications |
| Leading or critical role | Leading security functions at a distinguished company or agency |
| Awards | Recognized competition wins, research awards, top bug bounty recognition |
| High salary | Compensation compared with security professionals at your level |
How do vulnerabilities and tools become original contributions?
By showing significance. The Policy Manual's examples include "published materials about the significance of the person's original work," letters, citations, and "patents or licenses deriving from the person's work or evidence of commercial use of the person's work," and it warns that being "funded, patented, or published" does not on its own prove major significance (USCIS Policy Manual, Vol. 6, Part F, Ch. 2).
For the O-1A, the manual also lists "contributions to repositories of software, data, designs, protocols, or other technical resources with evidence of significant scientific, scholarly, or business-related impact in the field" (USCIS Policy Manual, Vol. 2, Part M, Ch. 4). A security tool used by many organizations, with evidence of that use, fits well.
For vulnerability research, strong evidence includes vendor advisories crediting you, coverage explaining why the finding mattered, changes to standards or products that followed, and citations by other researchers. A list of CVE identifiers on its own shows output, not significance. Our guide to original contributions of major significance explains the standard.
Does reviewing for security conferences count as judging?
Yes, with proof. The Policy Manual's examples of judging include "peer review of abstracts or papers submitted for presentation at scholarly conferences in the respective field," and it requires showing the person "actually participated in the judging of the work of others" (USCIS Policy Manual, Vol. 6, Part F, Ch. 2). Save the invitation, the review platform's confirmation and the conference's selection statistics. Our guide to finding judging opportunities lists ways to build this.
Do security papers and write-ups count as scholarly articles?
Many do. The Policy Manual's examples of scholarly authorship include "published conference presentations at nationally or internationally recognized conferences," and it explains that outside academia, "a scholarly article should be written for learned persons in that field" (USCIS Policy Manual, Vol. 6, Part F, Ch. 2). Peer-reviewed papers at academic security venues fit easily. Detailed technical research published in recognized industry proceedings can also fit if you show the venue's standing and expert audience. Blog posts on a personal site are weaker unless they were widely cited or republished.
What press counts?
Coverage about you. Published material "should be about the person, relating to the person's work in the field, and not just about the person's employer and the employer's work" (USCIS Policy Manual, Vol. 6, Part F, Ch. 2). Security research is often covered by trade and mainstream outlets that name the researcher; those articles are strong evidence when the outlet's reach is documented.
Can a security role at a company be critical?
Yes. "It is not the title of the person's role, but rather the person's performance in the role that determines whether the role is (or was) critical," and officers look at whether the person "has contributed in a way that is of significant importance to the outcome of the organization or establishment's activities" (USCIS Policy Manual, Vol. 6, Part F, Ch. 2). Leading the response to major incidents, building controls the business depends on, or running a red team relied on by leadership can fit, explained in detailed letters.
Do competition wins count as awards?
They can. For the O-1, the manual says the awards criterion "does not require an award or prize to have the same level of recognition and prestige associated with the Nobel Prize," and that "a person may rely on a team award, provided the person is one of the recipients of the award" (USCIS Policy Manual, Vol. 2, Part M, Ch. 4). Document the competition's standing, the field of competitors and how winners were chosen.
What decides an EB-1A at the end?
The final merits review. Officers "evaluate all the evidence together when considering the petition in its entirety for the final merits determination" (USCIS Policy Manual, Vol. 6, Part F, Ch. 2). Security cases do well when independent sources point the same way: other researchers citing your work, conferences selecting your talks, vendors crediting your findings and media explaining their significance.
Is the NIW an option?
Often. The NIW chapter says "USCIS recognizes the importance of progress in STEM fields and the essential role of persons with advanced STEM degrees in fostering this progress," including STEM areas "important to U.S. competitiveness or national security" (USCIS Policy Manual, Vol. 6, Part F, Ch. 5). But "benefits to a specific employer alone, even an employer with a national footprint, are not sufficiently relevant to the question of whether a person's endeavor has national importance" (same). Frame the endeavor around broader impact, such as protecting critical infrastructure or producing research and tools used across the field. Our guide to the NIW three prongs covers the test.
Should you start with the O-1A?
Many security researchers do. The O-1A uses similar criteria with a lower overall bar and provides work authorization while you build toward a green card, and its regulation lets you pursue permanent residence at the same time. Our guide to the O-1 to green card path explains how the two connect.
What this means for you
- For each major finding or tool, collect evidence of impact: advisories, coverage, adoption and citations.
- Keep proof of every review board or program committee role and the reviews you completed.
- Gather coverage that names you, with evidence of each outlet's reach.
- Ask leaders for detailed letters about specific security outcomes you drove.
- If you consider an NIW, describe an endeavor that benefits more than your employer.
- Keep copies of conference acceptance notices and published proceedings for your talks.
Where to start
Our free evaluation at /evaluate/ maps your record against the EB-1A, O-1A and EB-2 NIW standards, and Frank, our AI assistant at /frank, finds real opportunities for the criteria you are missing, such as judging or speaking. Petitions are reviewed and filed by our partner law firm, Lai & Turner.
Sources
All checked October 26, 2026.
- 8 CFR 204.5(h) and 214.2(o) (eCFR, current text). EB-1A and O-1A standards and criteria.
- USCIS Policy Manual, Volume 6, Part F, Chapter 2. Original contributions; judging; published material; critical role.
- USCIS Policy Manual, Volume 2, Part M, Chapter 4. Repositories; awards and team awards.
- USCIS Policy Manual, Volume 6, Part F, Chapter 5. STEM and national security; employer-benefit limit.
Frequently asked questions
Do CVEs count for EB-1A or O-1?
They can support original contributions of major significance when the record shows impact: vendor advisories crediting you, coverage of the vulnerability's significance, changes in industry practice, or citations by other researchers. A count of CVEs alone shows activity, not major significance. The USCIS Policy Manual focuses on whether the work made major, significant contributions to the field.
Do security conference talks count?
Talks themselves are not a listed criterion, but they help in several ways. Published papers or proceedings can support scholarly authorship, invitations to speak at selective conferences support recognition, and coverage of your talk in major media can support published material about you. Serving on a conference review board supports judging if you can prove you completed reviews.
Do capture the flag wins or bug bounty rankings count?
They may count as awards if the competition or program is nationally or internationally recognized and the recognition is for excellence. Document the selection process, the number of competitors and the program's standing. Team wins can count if you were one of the recipients, according to the Policy Manual's O-1 guidance.
Can a security engineer at a large company use the critical role criterion?
Yes, if the role was of significant importance to the organization's activities and the organization has a distinguished reputation. Letters from leaders should explain specific contributions, such as leading incident response for major events or building defenses relied on across the company. The title alone does not decide it; performance in the role does.
Is the NIW a good fit for cybersecurity?
It can be. The Policy Manual recognizes the importance of advanced STEM degree holders in areas important to US competitiveness or national security. The endeavor must still have national importance beyond one employer, for example securing critical infrastructure, publishing research or tools used across the industry, or work with government partners. A defensive role at a single company needs that broader framing.
Green Card Guide AI is not a law firm and this article is not legal advice. It describes evidence-building strategy in general terms; your attorney determines what belongs in your petition and how it's argued.
