A UK-based security researcher has been granted Australia’s 858 National Innovation visa after identifying and responsibly disclosing a critical vulnerability in a live system operated by the Department of Foreign Affairs and Trade (DFAT) during his application assessment period.
With few traditional pathways for cybersecurity specialists to demonstrate the level of internationally recognised achievement expected under the 858 visa, Jacob Riggs used a method familiar to the profession: providing verifiable proof of impact by finding, reporting and helping remediate a major weakness.
The 858 visa, previously known as the Global Talent visa, is invitation-only and awarded to a small fraction of applicants globally. Applicants must demonstrate exceptional and internationally recognised achievement—standards commonly associated with high-profile awards, elite sporting honours, or prominent academic credentials. For cybersecurity professionals, Riggs argues, that benchmark can be difficult to evidence through conventional accolades alone.
Riggs said he faced the challenge of translating years of research, self-directed study, leadership experience, entrepreneurial projects and public-interest contributions into the type of “proof” the process demands.
He reinforced his submission by reporting the DFAT vulnerability through responsible disclosure channels, providing a tangible example of the kind of work cybersecurity enables—detecting issues before they can be exploited and contributing to stronger systems.
“In cybersecurity, mastery is invisible unless you can show its impact,” Riggs said. “If the 858 asks for anything, it’s evidence that your efforts to master yourself have meant something. For me, that meant demonstrating the value of my work in a way the system could actually recognise: by helping protect the nation assessing my application.”
The disclosure comes as cyber threats continue to intensify across Australia, increasing pressure on government agencies and private organisations to find and fix vulnerabilities before malicious actors do. DFAT has formally acknowledged Riggs’ contribution, adding his name to the department’s Vulnerability Disclosure Program honour roll.
Now holding permanent residency rights, Riggs is preparing to relocate to Sydney full-time to continue his work across research, leadership and public-interest cybersecurity—efforts he says are aimed at strengthening Australia’s capacity to respond to evolving digital threats.