CISO awards: what CSO30, Champions in Security and 40 Under 40 recognize

What this guide covers

The question asks what industry awards recognize in security leaders and how they fit into a CISO's career path. This guide answers from three documents. The first is a Proofpoint blog post about the CSO30 Awards. The second is a Business Wire release about the Champions in Security Awards. The third is an EY press release about the Dallas Business Journal 40 Under 40 Awards.

All three are announcements written by or for the honoree's side. They describe what each program says it rewards. They do not describe how the awards affect a career. The last section lists what the documents leave out, including the Insider Risk Excellence Awards.

CSO30: thought leadership and business value

Proofpoint's blog post, dated November 5, 2020, says Andrew Rose, its resident CISO for EMEA, was recognised at the CSO30 Awards 2020. The post says the event was held virtually and organised by CSO Online UK.

The post describes who the program honors. It says the inaugural winners were announced on November 4 and that the program recognises 30 security executives.

The post quotes Dan Swinhoe, UK Editor at CSO Online, on the purpose of the awards. He says, "We want to celebrate the work and initiatives that demonstrate business value, thought leadership, and help reduce cybersecurity risk."

Swinhoe also lists what the 2020 winners did. According to the post, they worked in several areas: The same quote adds that winners guided their organisations through the challenges of COVID19.

For Rose, the post names the factors behind his recognition. It says his external board and mentoring work, his involvement with CyBOK, his transformation efforts and his drive to improve security behaviours contributed.

The criteria in this document are business value, thought leadership, risk reduction and sharing with the wider community. They are not limited to running a security program inside one company.

Champions in Security: human values

The Business Wire release, dated April 24, 2023, describes the inaugural Champions in Security Awards. It says the awards recognize leaders who show six values: Respect, Inclusion, Collaboration, Community, Innovation and Education.

The release names one honoree, Beth-Anne Bygum, Acxiom's Chief Security and Compliance Officer. It says she was named a Champion in Security for Inclusion because of her talent work.

It also defines the Inclusion category. The release says the award honors security leaders who build diversity, equality and inclusion principles into how they organize their teams.

The release ties the honor to her career record. It says she has spent a long career on security and governance programs. It also lists her community work.

Bygum is quoted on receiving the award. She says, "I am deeply honored to receive the inaugural 2023 Champion in Security Award for Inclusion."

Other speakers describe the program's intent. Kate Kuehn, Aon Cyber Solutions Chief Trust Officer, is quoted on the profession as a community: The sponsor's CEO, Arti Raman, says the winners are making a difference beyond technical work.

This award looks at a different part of leadership than CSO30. The stated criteria here concern how a leader treats people and builds the workforce. They do not concern technical or business results.

40 Under 40: leadership plus community

The EY release is dated April 6, 2017. It announces that Chad Holmes was an honoree of the Dallas Business Journal's 2017 40 Under 40 Awards. His title in the release is not CISO. It reads:

The release says what the award recognizes.

It also describes the program's format. The selection process is stated too:

Unlike CSO30 and Champions in Security, this program is not specific to security. It is a general business award with an age limit, and the release presents Holmes as one of its honorees from the cybersecurity field. The criteria it names are professional contributions and community contributions.

How the awards appear in these career records

The documents show a consistent pattern in how the recognition is presented. In each case, the announcement is tied to work the honoree already did. For Rose, the post lists board work, mentoring, CyBOK involvement and transformation efforts. For Bygum, the release lists her talent and community work and her years of program-building. For Holmes, the release lists his practice leadership and community roles.

In two of the three cases the employer is the one announcing the honor. Proofpoint posted about its own resident CISO on its own site. EY issued a release about its own principal. In the third, the Business Wire release quotes Bygum and gives her title as CISO at Acxiom.

The CSO30 post also places Rose's recognition inside a longer career record. It lists his earlier roles at law firms and as an analyst: The post presents the award as one item in that record, not as a step that led to a role.

What the documents do not say

None of the three documents mentions the Insider Risk Excellence Awards. This guide cannot say what that program recognizes. A separate source would be needed.

None of the documents says how an award affects hiring, promotion, pay or board access. They do not say how many CISOs win such awards, and they do not compare programs by prestige. The documents also do not say how nominations are submitted for CSO30 or Champions in Security, or how winners are chosen beyond the stated 40 Under 40 panel.

What the sources do support is narrower. CSO30 describes its criteria as thought leadership, business value and risk reduction. Champions in Security describes six human values. The Dallas Business Journal program describes professional and community contributions from leaders under 40. Each announcement ties the honor to the person's work and community activity rather than to a title alone. How much any of this matters to a CISO's path to the top seat is not answered by these documents.