In a tale tailor-made for the tech sector, 36-year-old British cybersecurity researcher Jacob Riggs has secured permanent residency via Australia’s ultra-selective Subclass 858 National Innovation visa—better known as the revamped Global Talent pathway—after responsibly disclosing a critical vulnerability in a Department of Foreign Affairs and Trade (DFAT) system.
Riggs, who lacks formal academic credentials, discovered the flaw in less than two hours while testing DFAT’s services under its public Vulnerability Disclosure Policy. He immediately reported the issue, winning a place on the agency’s security honour roll and adding timely evidence to his visa application. The 858 visa typically goes to Nobel laureates, Olympic medallists and founders with patents; approval rates hover below one per cent.
![Ethical hacker wins Australia’s coveted 858 Innovation visa after exposing DFAT flaw]()
The researcher compiled a 60-page portfolio of bug-bounty payouts, government commendations and private-sector references to demonstrate “internationally recognised achievement” under migration regulations. After a seven-month process—handled without an agent—Home Affairs granted the visa in late December, paving the way for Riggs to relocate to Sydney in 2026.
Australia’s tech industry has applauded the decision, arguing that practical cyber skills are as valuable as academic laurels in an era of daily ransomware attacks. “Riggs’ case shows the system can recognise real-world impact,” said AustCyber chair Michelle Price, who urged more transparent pathways for digital-security talent.
For employers the story offers two lessons. First, the 858 visa remains open but highly competitive; strong evidence and local endorsements are critical. Second, Australia’s vulnerability disclosure programs can both improve security and serve as informal talent-scouting tools—creating win-wins for agencies and skilled migrants alike.
Riggs, who lacks formal academic credentials, discovered the flaw in less than two hours while testing DFAT’s services under its public Vulnerability Disclosure Policy. He immediately reported the issue, winning a place on the agency’s security honour roll and adding timely evidence to his visa application. The 858 visa typically goes to Nobel laureates, Olympic medallists and founders with patents; approval rates hover below one per cent.
The researcher compiled a 60-page portfolio of bug-bounty payouts, government commendations and private-sector references to demonstrate “internationally recognised achievement” under migration regulations. After a seven-month process—handled without an agent—Home Affairs granted the visa in late December, paving the way for Riggs to relocate to Sydney in 2026.
Australia’s tech industry has applauded the decision, arguing that practical cyber skills are as valuable as academic laurels in an era of daily ransomware attacks. “Riggs’ case shows the system can recognise real-world impact,” said AustCyber chair Michelle Price, who urged more transparent pathways for digital-security talent.
For employers the story offers two lessons. First, the 858 visa remains open but highly competitive; strong evidence and local endorsements are critical. Second, Australia’s vulnerability disclosure programs can both improve security and serve as informal talent-scouting tools—creating win-wins for agencies and skilled migrants alike.
Source: news.com.au
