The Story Behind the SANS Difference Makers Awards: Celebrating the People Who Move Security Forward

The SANS Difference Makers Awards (DMAs) were established more than a decade ago to honor the people whose contributions strengthen cybersecurity behind the scenes. SANS founder Alan Paller and SANS Director of Emerging Security Trends John Pescatore created the DMAs as an alternative to industry recognition programs that prioritize titles or visibility. Their intent was to highlight practitioners, educators, investigators, students, researchers, and community leaders whose work has a clear, real-world effect.

From the beginning, the DMAs have focused on outcomes: improving operations, publishing tools or research, teaching effectively, mentoring new talent, supporting defenders, and advancing security programs that reduce risk. Over the years, the awards have become a fixture of SANS Cyber Defense Initiative in Washington, DC, bringing together nominees from government, critical infrastructure, academia, non-profits, small teams, and large enterprises.

What Sets the DMAs Apart

Three elements have shaped the character of the DMAs since their inception.

1. A commitment to demonstrated impact. Recipients are selected for work that produces clear improvements in security. Past winners include teachers building talent pipelines, non-profit leaders expanding access to technology, election officials strengthening statewide defenses, volunteer threat intelligence groups supporting hospitals, cloud engineers and researchers who create widely used tools, and FBI teams focused on specialized national security challenges. The common thread is meaningful contribution supported by results.
2. An open and community-centered process. Anyone may submit a nomination and anyone may vote, with no cost or barriers to participation. Many categories acknowledge two honorees: a Community Winner chosen through open voting, and a Committee Winner selected by a SANS expert panel. This pairing reflects both grassroots support and informed evaluation.
3. A ceremony designed to give people their moment. The awards are presented in a full-stage program that highlights the significance of the work. Recent ceremonies have included hosts, produced segments, interviews, and stories that bring attention to individuals whose efforts often take place far from the spotlight. Winners receive the golden key, a symbol closely associated with the event across the community.

How DMA Award Categories Have Evolved Over Time

As the field has grown, so have the award categories at the DMAs. Each category reflects a different dimension of how people contribute to cybersecurity:

• Community Champion of the Year
• Innovation of the Year
• Rising Star of the Year
• Practitioners of the Year – Cyber Defense, ICS/OT, Red Team or Offensive Operations, and DFIR/Threat Intelligence
• Media Creator of the Year
• CISO of the Year
• Company of the Year
• Lifetime Achievement Award

This mix acknowledges that progress in cybersecurity comes from many directions: hands-on technical work; creative problem solving; education and mentorship; community building; and long-term leadership. Recipients are recognized for achievements that elevate the practice of security for others, whether by standing up programs in under-resourced environments, contributing open-source capabilities used across SOCs and IR teams, or driving initiatives that help entire sectors mature.

You can find the full list of 2025 nominees here.

Join Us For This Year’s Ceremony

The SANS DMAs have become a consistent way for the cybersecurity community to acknowledge progress made not through headlines, but through dedication, expertise, and steady improvement. The awards remind us that strengthening security is collective work—and that the field moves forward because committed individuals choose to step up, create, teach, investigate, and support others.

The SANS Difference Makers Awards 2025 ceremony will stream live, virtually on Sunday, Dec. 14 at 7:30 pm EST on LinkedIn, YouTube, and X. Choose your preferred platform and select “Attend” or “Notify Me" on the event page to receive reminders as the date approaches.