EB-2 NIW for Cybersecurity Professionals: Showing National Scope, Not Just One Employer's Security

USCIS says benefits to one employer alone, even one with a national footprint, are not enough for national importance. Here is how security professionals document wider impact when their best work is confidential.

Part of our guide to EB-1A and EB-2 NIW.

Short answer: an NIW for cybersecurity work is realistic only when the petition proves a security endeavor whose benefit reaches past the company that pays you. As of 2026-11-01, the USCIS Policy Manual says benefits to one employer alone, "even an employer with a national footprint," are not sufficiently relevant to national importance. That is the trap for security professionals: a petition that describes a strong defender of one network argues the very benefit USCIS sets aside. Yours has to show, with evidence created outside your employer, that your work changes security for a sector, the field or the public.

Status as of 2026-11-01:

• In effect: the Matter of Dhanasar three-prong test, as applied in the USCIS Policy Manual chapter on national interest waivers (current as of 2026-10-27).
• In effect, challenged: PA-2026-05 (since 2026-08-05) lets USCIS deny without an RFE or NOID when required initial evidence is missing. AAUP v. Mullin (D. Mass., filed 2026-10-05) challenges it; no ruling yet.
• Latest data: NIW approval rate 55.3% in FY2026 Q3 (April to June 2026), up from 42.5% in Q1, all before PA-2026-05.
• Processing (USCIS tool, read 2026-11-01, 80% of cases): NIW I-140, 30 months; premium processing, 45 business days for a $2,965 I-907 fee.
• Under OIRA review, unpublished: "Amending the Premium Processing Timeframe" (RIN 1615-AD25), received 2026-10-13. Direction unknown; today's timeframes apply.

Can you get an NIW for cybersecurity work?

Yes, if you qualify for EB-2 and your petition proves all three Matter of Dhanasar prongs: a specific security endeavor with substantial merit and national importance, a record showing you are well positioned to advance it, and a reason the United States benefits from waiving the job offer. Protecting one employer's systems does not establish national importance by itself.

Our explainer on the Dhanasar three-prong test covers the standard in general; this post applies it to security roles, where the best work is usually confidential.

The EB-2 baseline comes first

The waiver removes the job offer and labor certification, not EB-2 itself. The USCIS EB-2 page (updated 2025-01-15) requires an advanced degree (a US master's or foreign equivalent, or a bachelor's plus five years of progressive experience) or exceptional ability, shown by three of six criteria. It adds: "Those seeking a national interest waiver may self-petition (you do not need an employer to sponsor you)."

Your H-1B or STEM OPT status still depends on an employer. If you need that role first, see our guide to cybersecurity jobs that sponsor H-1B; the EB-2 NIW self-petition guide walks through the filing.

Can a cybersecurity analyst qualify for an NIW?

An analyst can, but the job title is not the case. The Policy Manual says "The term 'endeavor' is more specific than the general occupation," and that "a software engineer adapting their employer's code for various clients" will struggle to show national importance without broader impacts backed by specific evidence. "An analyst triaging alerts for one company" is the same weak case. Detection research, threat reporting or tooling that other organizations use gives USCIS something to weigh.

Why "I protect my employer" draws RFEs

Because USCIS reads it as a benefit to one company. The Policy Manual says "Benefits to a specific employer alone, even an employer with a national footprint," are not sufficiently relevant to national importance; the question is whether the endeavor has broader implications, "such as for a field, a region, or the public at large." Securing a large bank's network is valuable work, and it is still that bank's benefit.

Petitions built on the employer's revenue, customer count or brand argue the one thing the chapter sets aside; our breakdown of NIW RFE reasons by prong shows how that gap surfaces. And since 2026-08-05 an RFE is not guaranteed: PA-2026-05 lets officers deny without one when required initial evidence is missing, and makes 12 weeks the maximum RFE response time.

Common misconception: "national scope" means working for a national company, a federal agency or a critical infrastructure operator.

Correction: the Policy Manual rejects employer footprint as the test: "Officers should focus on the nature of the proposed endeavor, rather than only the geographic breadth of the endeavor." In our reading, a regional hospital's security engineer whose methods spread to other hospitals may present a stronger first prong than an engineer at a national retailer whose work never leaves the building.

How do I show national importance for corporate security work?

Name the specific problem your endeavor addresses, show with government or academic sources why it matters beyond any one organization, then prove with outside evidence that your work reaches others. To identify a critical and emerging technology field, the Policy Manual says officers consider "governmental, academic, and other authoritative and instructive sources"; for security work, CISA and NIST publish the most useful ones.

One caution: the chapter's footnote on critical and emerging technologies says examples "may include, but are not limited to, certain critical areas of artificial intelligence or quantum information science." The list is open-ended, but the chapter never names cybersecurity, so the field label will not do the work; your specific problem has to. Four anchors, opened on 2026-11-01:

• Critical infrastructure. CISA lists 16 critical infrastructure sectors, among them Energy, Water and Wastewater, and Healthcare and Public Health, whose "assets, systems, and networks, whether physical or virtual," are so vital that losing them would be debilitating. Securing a class of systems used across a sector, such as medical devices or industrial control software, is a sector-level frame; working at one company in the sector is not.
• Exploited vulnerabilities. CISA's Known Exploited Vulnerabilities catalog is, in its words, "the authoritative source of vulnerabilities that have been exploited in the wild." Research on vulnerability classes listed there addresses problems attackers already use.
• Coordinated disclosure. CISA's Coordinated Vulnerability Disclosure program coordinates the release of vulnerability information and mitigations ("As a CNA, CISA may serve as the authoring CNA when appropriate"). A disclosure published this way is a public record created outside your employer.
• Frameworks. NIST presents its Cybersecurity Framework (CSF 2.0) as a resource "for industry, government, and organizations to reduce cybersecurity risks." Tools that help many organizations adopt such practices are a field-level contribution; following the framework at your own company is not.

Same work, two framings

Illustrations only, not assessments of any case.

What evidence works when most of your work is confidential?

Evidence that someone other than you and your employer created or confirmed. Advisories, CVE records, talk programs, repositories and independent letters can be checked by an officer who never sees an internal report. The Policy Manual's second-prong list asks for evidence of "how the person's work is being used by others" and says "This list is not meant to be a checklist."

Cybersecurity NIW evidence map, as of 2026-11 (Policy Manual current as of 2026-10-27).

A CVE record or advisory that names you is exactly what confidential work lacks: verifiable and created outside your employer. One serious issue in widely used software says more than a long list of minor findings. Certifications count for less than people expect: the Policy Manual lists "Degrees, certificates, or licenses in the field" as second-prong evidence and the EB-2 page counts professional certification as one exceptional-ability criterion, but a credential many practitioners share cannot show national importance.

Confidential work: what needs approval before it goes in

• Get written permission from your employer's legal or security team before any internal document or metric goes into a petition. Unpatched vulnerability details, exploit code and customer data stay out entirely; cite the public advisory instead.
• Keep every number true and documented. An inflated metric does more damage than a missing one.
• Let letters carry what documents cannot. A security lead at a partner organization describing how your method changed their practice corroborates what your statement only claims. Our guide to independent expert letters versus collaborator letters explains why independence matters; the Policy Manual says expert letters can be persuasive when they "are supported by other independent evidence."

Is NIW or EB-1A better for security researchers?

It depends on your record and your country of birth, and the choice belongs with a licensed immigration attorney. NIW asks whether a specific endeavor matters and whether you can advance it; EB-1A asks whether your record already places you at the top of the field.

NIW vs EB-1A for security researchers, as of 2026-11.

Rates are approvals over approvals plus denials in the USCIS FY2026 Q3 I-140 data, not your personal odds; the EB-1A test is from the USCIS EB-1 page. Two 2026 decisions from the federal district court in Nebraska split on the final merits step (Mukherji v. Miller ordered an approval; Agarwal v. Miller upheld the review); with no appellate precedent, USCIS still applies it. Our comparison of EB-1A and EB-2 NIW for engineers covers the criteria side by side.

A worked example: one engineer, two petitions

Take a hypothetical application security engineer on H-1B, born outside India and China, with a US master's in cybersecurity and four years at a payments company.

Draft one. Endeavor: "keep protecting my employer's payment platform." Evidence: a manager's letter, a CISSP, internal awards and the employer's size. Every exhibit points back to one company.

Draft two. Endeavor: reducing a class of authentication flaws in open-source payment libraries that many merchants and processors use. Evidence: two CVEs crediting the engineer through coordinated disclosure, fixes merged upstream, a peer-selected talk, an open-source scanner with documented dependents, and letters from an independent maintainer and a security lead at an unrelated processor. Same engineer, same job, a different case.

Timeline for draft two, with premium processing, if the 45-business-day timeframe in effect today still applies:

• Monday, 2027-02-01: the I-140 and Form I-907 reach USCIS. An NIW needs no labor certification, so the filing date becomes the priority date.
• Around Tuesday, 2027-04-06: the 45th business day, skipping Presidents' Day (2027-02-15). By then, the USCIS premium processing page says, USCIS issues an approval, denial, NOID or RFE, or opens a fraud or misrepresentation investigation; an RFE or NOID makes the period "stop and reset."
• After approval: in the November 2026 bulletin, EB-2 rest of world is 2025-04-01 (Final Action) and 2026-03-15 (Dates for Filing), so a February 2027 priority date waits until the chart USCIS designates reaches it. USCIS required Dates for Filing in November; consular cases always use Final Action Dates. The December bulletin was not out as of 2026-11-01.

For an India-born engineer, EB-2 India sits at 2013-11-01 (Final Action) and 2015-01-15 (Dates for Filing), so the approved I-140 matters mostly for H-1B: it generally supports three-year extensions beyond the six-year limit under AC21 section 104(c). Confirm how that applies to you with your attorney.

Step by step: building a cybersecurity NIW record

1. Confirm EB-2 eligibility: degree records, a credential evaluation for a foreign degree, and experience letters if you rely on a bachelor's plus five years.
2. Inventory your public record: CVE entries, CISA and vendor advisories, conference programs, code repositories.
3. Request written permission from your employer's legal or security team for any internal metric or document.
4. Draft the endeavor statement: the problem, the sector affected, how you will advance it in the US, and why it reaches beyond one employer.
5. Cite CISA, NIST and academic sources showing why that specific problem matters.
6. Collect letters from independent experts and outside users of your work, each with specific examples.
7. Prepare Form I-140 (edition 06/07/24, accepted as of 2026-10-30) with the G-1055 fee (edition 10/26/26): $715 on paper or $665 online, plus an Asylum Program Fee of $600, $300 or $0 depending on the petitioner.
8. Decide with your attorney whether to add Form I-907. Under PA-2026-05 a faster answer can also be a faster denial, so premium processing is no substitute for a complete filing.
9. Check the State Department Visa Bulletin and the USCIS adjustment filing chart before any I-485. A new NIW's priority date is its filing date, so an I-485 can go in with it only when the designated chart shows EB-2 as Current for your country; in November 2026 none did.
10. Ask an immigration attorney about immigrant intent before filing if you are on F-1 STEM OPT, and your DSO about anything touching SEVIS or travel.

Common mistakes

• Describing your job, or your employer's size, instead of an endeavor. "I will keep securing my employer's systems" names an occupation and an employer, and the Policy Manual sets aside benefits to one employer even with a national footprint.
• Treating "cybersecurity is important" as proof. The chapter never names cybersecurity; show why your specific problem matters with CISA, NIST or academic sources.
• Counting CVEs or certifications instead of explaining impact. One serious, widely relevant disclosure says more than twenty minor ones, and a CISSP never establishes national importance.
• Filing thin and waiting for an RFE. Under PA-2026-05, missing required initial evidence can mean a denial with no RFE.
• Believing "NIW approvals collapsed after PA-2026-05." No USCIS data covers decisions under the policy; the latest quarter (April to June 2026) shows 55.3%.

Frequently asked questions

Can a cybersecurity analyst qualify for an NIW?

An analyst can, but the job title is not the case. You need the EB-2 baseline and a specific endeavor that meets all three Dhanasar prongs, and the USCIS Policy Manual (current as of 2026-10-27) says benefits to one employer alone are not sufficiently relevant to national importance. Detection research, threat reporting or tools other organizations use give USCIS something to weigh.

How do I show national importance for corporate security work?

Name the specific problem your endeavor addresses, show with government or academic sources why it matters beyond one organization, and prove with outside evidence that your work reaches others. CISA's 16 critical infrastructure sectors and its Known Exploited Vulnerabilities catalog are useful anchors. Since 2026-08-05, PA-2026-05 (challenged in court) lets USCIS deny without an RFE when required initial evidence is missing.

Do CVEs or bug bounty credits count as NIW evidence?

They can support the second prong, which weighs how others use your work. A CVE record or advisory that credits you by name is verifiable and created outside your employer, and its weight depends on how widely the affected product is used. Bug bounty rankings and payouts show skill but mostly benefit the paying company, so they rarely show national importance.

Do certifications like CISSP help an NIW?

A little. The USCIS Policy Manual (current as of 2026-10-27) lists degrees, certificates or licenses in the field among second-prong evidence, and a professional certification is one of six exceptional-ability criteria. Because many practitioners hold the same credential, it supports a petition but cannot show national importance or carry the case.

Is NIW or EB-1A better for security researchers?

It depends on your record and country of birth, so decide with a licensed immigration attorney. In USCIS data for April to June 2026, before PA-2026-05, NIW approvals ran at 55.3% and EB-1A at 32.2%. EB-1A sets a higher evidence bar, but in the November 2026 Visa Bulletin its India Final Action Date is 2023-02-01, against 2013-11-01 for EB-2 India, a much shorter queue.

Sources

• USCIS Policy Manual, Vol. 6, Part F, Ch. 5, the USCIS EB-2 page and the USCIS EB-1 page
• USCIS Policy Alert PA-2026-05 and I-140 data, FY2026 Q3
• USCIS premium processing, G-1055, processing times and adjustment filing charts
• State Department Visa Bulletin
• CISA: Critical Infrastructure Sectors, Known Exploited Vulnerabilities Catalog, Coordinated Vulnerability Disclosure program; NIST Cybersecurity Framework

How we checked this: on 2026-11-01 we read the Policy Manual chapter, the USCIS EB-1, EB-2, premium processing and filing-chart pages, PA-2026-05, G-1055, the CISA and NIST pages, and the FY2026 Q3 I-140 spreadsheet (rates recomputed from its counts). The November 2026 Visa Bulletin values (released 2026-10-22) were cross-checked against several agreeing law-firm summaries because travel.state.gov blocks automated reads; confirm them there.

This is general information, not legal or tax advice; your own notices govern, so take petition strategy to a licensed immigration attorney and anything touching F-1, OPT or SEVIS to your DSO.

An NIW is built on years of visible work, and that usually starts with the right sponsored role. If you are on OPT, STEM OPT or H-1B and want a focused search for security employers that sponsor, F1Jobs can help.