What do I need to adjust in my evidence is it strong enough?

Stage 1: Tech Nation Endorsement
1

I’m preparing my Global Talent Stage 1 application under Exceptional Promise in Digital Technologyand would really value honest, critical feedback before I submit. My areas are Application Security, Offensive Security / Vulnerability Research, and API & GraphQL Security. I graduated in 2022 with a BSc in Computer Engineering.

Mandatory Criterion – recognised as having potential to be a leading talent

    • Hall of Fame recognition – Apple, Amazon, Quora, Yelp, Epic Games. I’m credited on their security acknowledgement pages for responsibly disclosed vulnerabilities. For Apple, I reported a GraphQL authorisation bypass through the Apple Security research program. It was paid and the fix is deployed. I have Hall of Fame screenshots and payment confirmations, but no formal letters from these companies.
  • Remuneration evidence. I’m an Application Security Engineer at a unicorn in Nigeria, one of Africa’s largest fintechs, earning ₦12.99M a year about (9,000) pound. I’ve also earned $24,000 in lifetime bug bounty income across HackerOne, Bugcrowd, YesWeHack and Apple. On top of that, I’ve made ₦3M in penetration-testing consulting through consultation.
  • Speaking & media. I gave a keynote, “State of Bug Bounty in Nigeria 2025” over 100+ attended, and a talk at HackWara 2026 +200 attended, “Beyond the Tool in Bounty”. I ran the HackingAPIwithDami workshop, which trained 150+ researchers in API vulnerability research. I was also featured as co-founder of Kudilo by StartupIn60 and Zikoko.

OC1 – Innovation

  • Kudilo – co-founder & technical lead. The company is registered with CAC (May 2026) and I hold 30% equity under a formal co-founder agreement. I designed the architecture and the security model: encryption of financial data, RBAC and fraud detection. I also built an ISO 27001-aligned ISMS.

  • Kudilo – traction. I co-founded Kudilo and am its CTO. It’s a WhatsApp-native bookkeeping and credit-tracking product for informal traders in Nigeria and Ghana. In under 6 months, with 100% organic acquisition, we reached 459 monthly active users, 528 workspaces, 87% monthly retention and about £700 MRR.

OC2 – Contributions beyond my occupation

  • CyBlack – mentorship & community building. Over about 2 years at CyBlack, I mentored and taught 500+ aspiring security professionals, mostly from underrepresented backgrounds in Africa. [built the hacking cohort, and over 100 mentees who got jobs.
  • HackingAPIwithDami workshop. I trained 150+ researchers in hands-on API vulnerability research. Over 5 have gone on to get a job or make money from vulnerability research all backed with picture evidence.

OC3 – Significant technical contributions

  • Moniepoint – AppSec leadership. I lead security for Monieworld, Moniebook, Cosmos and Retina. I’ve found 12+ high-severity access-control and authorisation-bypass vulnerabilities and written 7+ threat models. I set up and manage Moniepoint’s HackerOne bug bounty programme, which has 12+ researchers and $2,000+ paid out so far. My performance rating is 4.0/5, with a bonus awarded.
  • SchemaFinder (open source). It’s a Node.js tool I built that extracts GraphQL operations from JavaScript bundles for security recon. It’s public on GitHub (abidakun1/SchemaFinder) with 14 stars and evidence of usefulness By other researcher

Recommendation letters: I have three, from people holding these titles:

  • Co-founder, CyBlack / Senior Program Manager at a cloud service provider (CCSP, CISM, PMP)
  • Co-founder, Exploit Forge Ltd (8+ years in offensive security)
  • Co-Founder, Cyblack a PhD holder in cybersecurity

What I’d like feedback on:

  • Is my MC strong enough?
  • Are OC1 and OC3 the right optional criteria?
  • Should I switch to OC3 + OC2, or keep OC1 + OC3
  • Does the Income remuneration help or hurt?
  • Anything that looks like a red flag to an assessor?

Thanks in advance. Blunt feedback is very welcome.

2

MC: Not strong enough. Hall of Fame screenshots are weak without formal letters. Speaking is moderate. Media is about your startup, not you. Get CVEs or company verification. Salary (£9k) hurts drop it.

OC2 (CyBlack + workshop): Your strongest. Keep it.

OC3 (Moniepoint + SchemaFinder): Needs work. Moniepoint is internal. Get employer letter quantifying impact. SchemaFinder has 14 stars too small. Bug bounty program $2k (tiny). Strengthen or drop.

OC1 (Kudilo): Too early. 459 MAU, £700 MRR. Wait.

Red flags: Two letters from CyBlack, no independent verification, small metrics.

Advice: Don’t submit yet. Strengthen MC and OC3. Apply with OC2 + OC3 in 6–12 months.

3

The MC needs the most attention. Hall of Fame acknowledgements and paid disclosures can support a case, but screenshots alone may leave the assessor without independent context for the significance of the vulnerabilities. The speaking work may help show recognition; the startup features do not establish recognition of you as an emerging leader. Keep the remuneration evidence out unless it clearly supports a strong personal remuneration case against the right market benchmark.

OC2 looks like the clearest fit if the mentoring was voluntary and outside your paid role. For OC1, the Guide looks for innovation in the digital technology sector; company registration and product architecture alone do not show that the product is innovative. The traction helps establish that people use it, but you need evidence that explains what is technically or commercially novel.

OC3 could fit your employer work if an independent senior colleague verifies your individual contribution and its significance. The open-source tool needs evidence of use or adoption beyond its existence on GitHub. Choose criteria around the strongest independently evidenced work, and make each letter explain what the referee directly knows about your contribution.

4

Hi @Abidakun_Samuel,

Eligibility is actually the first thing I would look at, and there is a reason for that. Tech Nation assesses your evidence in the context of your stated discipline and area of expertise. Over the years, I have seen applications fail, not necessarily because the evidence was weak, but because the applicant’s discipline was either not eligible, unclear, or inconsistent with the overall application narrative.

Application Security, Offensive Security, Vulnerability Research, API Security, and GraphQL Security are all technology areas. The question is, what is your actual discipline and area of expertise?

I would suggest positioning yourself as:

“My area of expertise is Cybersecurity, with specialist experience in Application Security, Offensive Security, Vulnerability Research, API Security, and GraphQL Security.”

That gives assessors a clear and consistent picture of who you are professionally.

Having covered eligibility and discipline, let’s look at the evidence itself.

The Mandatory Criterion for Exceptional Promise is about demonstrating that you are being recognised as someone with the potential to become a leading talent in the digital technology sector.

Being recognised by organisations such as Apple, Amazon, Quora, Yelp and Epic Games for responsible vulnerability disclosure shows that respected technology companies have acknowledged your technical expertise. For someone positioning as a Cybersecurity professional specialising in Application Security this is directly relevant to your discipline.

A strategic way to present it will be Apple credited me for reporting a GraphQL authorisation bypass through its security research programme. I believe finding and responsibly disclosing a vulnerability in a major technology platform is a recognised technical achievement within cybersecurity.However, an assessor may still ask does this demonstrate wider sector recognition, or does it mainly demonstrate technical competence and recognition from specific companies?

In my view, it can support your Mandatory Criterion, but it would not be particularly strong on its own.

Regarding salary, no matter how high the figure is, remuneration alone is rarely enough. You still need to demonstrate significant contributions and impact beyond your paid employment.

On speaking engagements, were you invited as a keynote speaker?

Your talk on State of Bug Bounty in Nigeria 2025 can demonstrate expertise, but the strength of the evidence will also depend on the reputation and standing of HackWara 2026. If it is regarded as a recognised or top tier technology event, that would strengthen the case.

Workshops and training activities can be useful for OC2, assuming the other evidence requirements are also being met.

Also, simply being featured because of a role or title does not automatically demonstrate recognition. The key question is what achievements or impact led to that feature. Can you clearly show the outcomes and accomplishments that formed the basis of being featured?

OC1

OC1 is about innovation, not leading company direction.

Your technical leadership responsibilities and role as a founder do not automatically demonstrate innovation. What matters is showing what you actually innovated within a product led company. Similarly, company registration by itself is not evidence of innovation. Designing the architecture and security model, including encryption of financial data, RBAC implementation, and fraud detection capabilities, demonstrates strong technical competence and capability. However, competence and innovation are not necessarily the same thing.

This type of evidence may fit OC3 more naturally, assuming the other OC3 requirements are also satisfied.

The Kudilo traction metrics can help strengthen the Kudilo innovation evidence, but only if the underlying product or solution can genuinely be shown to be innovative. Commercial traction is typically supporting evidence for innovation. It is not innovation by itself. Innovation remains the primary requirement.

OC2

Your OC2 evidence can potentially work if these activities were delivered within a structured environment and you can clearly demonstrate measurable impact. One concern I have is that some of the activities appear very close to what you are already relying on for MC. Evidence should be unique across criteria. You also need to demonstrate how your activities advanced the sector, not just how many people attended.

OC3

Remember that you only need to satisfy two Optional Criteria out of the four available options.
From what you have listed, you appear to be considering OC1 and OC2 already. However, based on the evidence described under your OC1, much of it leans more towards contribution than innovation.

Because of that, it may be worth looking closely at OC2 and OC3 instead, provided you can clearly demonstrate the required impact and technical contribution for OC3.

For SchemaFinder, you should be careful. Open source contributions do not automatically qualify under OC3. OC3 focuses on significant technical contributions within a product led company. If SchemaFinder is a personal project or side project rather than work carried out within a product led company, it may not fit comfortably under OC3.

Recommendation Letters

For your recommendation letters, do not focus only on roles and titles.Take time to review the public profiles of your recommenders and make sure they are genuinely established and recognised within the industry. Also, having a PhD does not automatically make someone an established expert from an industry perspective. Academic achievements alone are not usually the yardstick for industry recognition.

On Your Questions

Is my MC strong enough?

It’s fair, but I would not describe it as particularly strong based on recent feedback patterns. I would suggest strengthening it with at least one additional high quality piece of recognition evidence to increase your chances.

Are OC1 and OC3 the right optional criteria?

From what you have described, your OC1 reads more like technical contribution than innovation. OC3 appears to be a more natural fit, assuming the evidence satisfies the other OC3 requirements.

Should I switch to OC3 + OC2, or keep OC1 + OC3?

It is certainly worth considering. However, evidence that does not meet OC1 will not automatically qualify for OC3. You would need to assess each piece of evidence carefully against the specific OC3 requirements.

Does the income remuneration help or hurt?

It can help as supporting evidence, but honestly, it is not sufficient on its own. I have seen application with remuneration equivalent to over £270,000 per year rejected because salary alone was not considered enough to meet the criterion.

Anything that looks like a red flag to an assessor?

Yes.You have listed your evidence well, but there is often a difference between how evidence is described in a forum post and what the actual evidence documents show.

The real assessment is based on the evidence itself, not the summary description.To provide more meaningful guidance, I would need to review the actual evidence you intend to submit rather than the high level descriptions.

All the best.