I’m sitting in the Puerto Vallarta airport, waiting to board a flight to Denver. Tomorrow, ISC2 is giving me a 2026 Global Achievement Award, the Senior Professional Award for the Americas region.

I should be thrilled. Mostly, I’m torn. Honestly? I’d rather be working.

I know how that sounds. Stick with me, because I think the reason matters, and I suspect some of you feel the same way about recognition in your own work.

Why I’m torn

I don’t like awards. Never have.

Part of it is wiring. I’m an introvert. Standing on a stage while a room full of people claps at me is about as far from my happy place as it gets. Give me a hard problem and a quiet room any day.

But that’s the easy explanation. The real one is harder to say.

An award marks a finish line I don’t believe exists.

I’ve been doing this for more than 30 years. I started FRSecure in 2008, and it’s grown to more than 120 people serving thousands of clients. SecurityStudio came in 2017. The CISSP Mentor Program started with six students in 2010 and has passed 100,000. We built CvCISO, the industry’s first vCISO certification. That’s real work, and I’m proud of it.

And none of it fixed the problem.

I wrote a whole book in 2018 asking how we fix this broken industry. Eight years later, I’m still asking. Breaches keep happening for the same boring reasons. Vendors still sell fear. Organizations still buy products instead of building programs. We still can’t agree on what “secure” means, let alone measure it.

So when someone hands me an award, part of my brain hears “well done.” Everything else in me says, “Done? We’re not even close.”

Why I’m getting on the plane anyway

Here’s what changed my mind.

After ISC2 announced the winners, I got an email from a student in our CvCISO program. She’s originally from Cameroon. She wanted me to know she was one of the people who nominated me.

I had no idea. Nobody asked her to do it. She just did it.

Since then, we’ve talked on the phone a few times, and I’ve gotten to know her. She has a fascinating story. In her words, the program helped her career and her life.

That one got me.

I don’t care much about a trophy. I care a lot about her. People like her are the reason I do this work. Not awards. Not stages. Her, and the thousands like her who bet on themselves and did the hard work.

I hope she represents the future of cybersecurity. We need a lot more people like her.

She took her own time to say “this mattered to me.” If I skip that because I’d rather be working, I’m telling her that her thank-you wasn’t worth a flight.

It is.

I’ve had to admit something uncomfortable. “I don’t do it for awards” can be true and still be a hiding place. It’s a tidy way to avoid being seen. Deflecting praise feels noble, but sometimes it’s just ego wearing a humility costume.

Receiving a thank-you well takes humility too. Maybe more.

Both things are true

I’m grateful. I’m restless. I don’t have to pick one.

And this award isn’t really mine anyway. It belongs to the six people who showed up to that first Mentor Program class, and the 100,000 who came after. To the CvCISO students who are out there doing the work. To the teams at FRSecure and SecurityStudio who did the heavy lifting while my name was on the door. To the clients who trusted us to tell them the truth, even when they didn’t want to hear it.

So tomorrow I’ll walk up there, say thank you, and mean it. Then I’ll probably say the quiet part out loud: this is nice, but we haven’t fixed it yet.

If this sounds like you

Some of you know this feeling. Someone recognizes you, and your first instinct is to deflect. Minimize it. Change the subject. Get back to the inbox.

If that’s you, stop. Recognition isn’t a verdict that you’re finished. It’s proof that what you did mattered to somebody. Let it.

And when someone takes the time to honor you, show up. Not for you. For them.

So let me ask you. When was the last time someone thanked you and you actually let it land?

Next time, don’t deflect. Say thank you. Mean it.

Then go back to work. There’s plenty left to do.