Security researcher hacked the Australian government to help his visa application

When governments talk about attracting “global talent,” they tend to picture Nobel laureates or decorated researchers, not the kind of person who spends their evenings looking for ways into government networks.

Yet that is precisely the profile Australia approved when it granted Jacob Riggs its rarest visa, the National Innovation (subclass 858).

Riggs, a British security researcher with no formal academic pedigree, built his career the unconventional way – finding critical vulnerabilities in the systems of big tech firms, universities, and governments, then disclosing them responsibly. Over the years he accumulated a portfolio of quiet acknowledgements. Bug bounties, letters of thanks, and formal recognition from institutions that would prefer their security lapses remain unmentioned.

It was that body of work he submitted to the Australian government as evidence of “internationally recognised achievement.” But while most applicants submit their documents and hope for the best, Riggs ironically responded to the uncertainty with the same instinct that shaped his career. He started looking for vulnerabilities.

Specifically, in Australia.

During the waiting period, he began examining parts of the government’s attack surface. Not covertly, but through the Department of Foreign Affairs and Trade (DFAT) authorised Vulnerability Disclosure Policy. Within hours, he identified a critical flaw. In another context it might have been exploited. Instead, he reported it immediately. DFAT patched the issue, wrote to thank him directly, and publicly credited him on its website.

For an immigration programme designed to capture elite global talent, the timing was remarkable. A live demonstration of the exact skill set the visa is supposed to recognise, carried out on the infrastructure of the government assessing him.

Riggs’ path stands in contrast to the credential-driven image of “high-skilled migration.” A kind of merit that immigration systems rarely know how to measure.

The broader significance of Riggs’ case lies in what it reveals about cybersecurity talent. People most capable of securing modern infrastructure often emerge through non-traditional routes. Typically self-taught, adversarial thinkers who learn by breaking things first and improving them second. They rarely fit neatly into bureaucratic categories, and governments only occasionally recognise them as strategic assets.

Australia did, this time, and it did so at the exact moment one such researcher demonstrated, in a very practical way, why that recognition matters.

In granting the visa, Australia has acquired an ally with the rare ability to expose its weaknesses before others exploit them – a quietly potent asset in a world where resilience depends on seeing what others fail to notice.