I would appreciate feedback on my proposed application – Exceptional Talent route. My background is in security research.
MC — Recognition as a leading talent
1, High remuneration, supported by employment and compensation records.
2, Over 100 CVEs with public attribution, including significant vulnerabilities across multiple established open-source projects. Most findings are from the last six months.
3, paper presentation at an international conference organised by The Alan Turing Institute, with paper published through IET.
OC1 — Innovation
1, Two patent inventions: one granted and one still pending.
2, Supporting evidence of practical implementation and enterprise use of the patented technology, including my contribution.
OC3 — Significant technical contributions
1, A substantial contribution to my company’s HackerOne programme, including leading vulnerability validation and remediation, supported by company records and related event evidence.
2, A separate significant technical contribution supported by external reporting without my name and internal evidence of my role.
The mandatory section is where I’d focus first. Over 100 CVEs with public attribution is a strong signal, but the Guide is specific that mandatory evidence should show a consistent level of activity over time, and it treats anything produced mainly to support the timing of an application as unacceptable. A hundred findings concentrated in the last six months can undercut that, because it looks like a recent burst rather than sustained recognition. If you have attributed CVEs going back two or three years, build that longer arc in so the panel sees an ongoing record.
High remuneration on its own won’t carry the mandatory criterion. The Guide states salary information alone is insufficient and that you have to show impact in the sector beyond your day-to-day role. Treat the compensation record as supporting context for the research, not a standalone piece.
The pending patent adds little to OC1 as it stands. The Guide is explicit that patent applications are insufficient and only granted patents count as evidence of innovation. Lean the innovation case on the granted patent plus proof the technology is in real enterprise use, since a patent without market context is treated as thin.
OC3 turns on personal attribution. The second piece, external reporting that does not name you backed by internal evidence, is the weaker of the two, because the panel needs to see your individual contribution rather than the company’s. Make sure the internal evidence pins the specific work to you by name, otherwise the panel will treat it as team output.
The overall mapping is broadly understandable, but the key is to make sure each criterion is demonstrated by the specific evidence required, rather than relying on the number of achievements.
For MC, The 100+ CVEs with public attribution could be useful evidence of external recognition if the vulnerabilities have clear public attribution to you and demonstrate recognition within the security community. The fact that many are recent is also relevant for the five-year timeframe. The conference paper/presentation can add independent recognition, but the strength will depend on the standing of the conference, the publication, and whether your individual contribution is clearly established. The high remuneration can be useful supporting evidence, particularly if the compensation is demonstrably high compared with relevant roles in the UK digital technology sector. However, it should be treated as one form of supporting evidence rather than as a substitute for evidence demonstrating recognition as a leading talent.
For OC1, the granted patent is potentially relevant, but a patent by itself does not automatically establish the required level of innovation. Your implementation evidence is therefore important. Clearly establish what you personally invented, what problem it solved, what was technically innovative, and evidence that the invention was actually implemented or adopted rather than remaining purely theoretical. The granted patent can provide formal evidence of the invention, while evidence of practical implementation and enterprise use can help demonstrate that the innovation went beyond a theoretical or purely patent-stage concept.
For OC3, the HackerOne work could fit if you can demonstrate a significant contribution as an employee and clearly distinguish your personal responsibility from the company’s wider security programme. The strongest evidence would distinguish your personal work from the company’s broader security programme. For example, the evidence should clearly establish what you personally led or delivered in vulnerability validation and remediation, what technical decisions or work were attributable to you, and what measurable or significant outcome resulted. Company records can establish attribution, while independent evidence of the programme or its outcomes can strengthen the case. For the second contribution, external reporting that does not name you is less useful unless the accompanying evidence convincingly links the reported outcome to your individual work. A senior colleague’s confirmation can corroborate that link, but the underlying evidence should still demonstrate your personal contribution.
The main issue I would address before submission is individual attribution and significance: for every OC3 document, a reviewer should be able to understand what you did, why it was significant, and what resulted from it. Also ensure the evidence is distinct and that you are not relying on the same document to satisfy multiple criteria.