Proving What Did Not Happen: How Preventive Work in Security and Safety Engineering Shows National Importance for an EB-2 NIW

A fire marshal who prevents a fire leaves no photograph. A reliability engineer whose redesign eliminates a class of outages leaves a quiet dashboard and a team that sleeps better. A security researcher who closes a vulnerability before anyone exploits it leaves, at most, a line in a patch note. The work is real, the stakes can be high, and the evidence is, by nature, an absence.

That is the central difficulty for professionals in security, safety, reliability, and risk who pursue an EB-2 National Interest Waiver. The first prong of the Dhanasar framework asks whether the proposed endeavor has substantial merit and national importance. For preventive work, the temptation is either to say too little ('I protect systems') or to supply dramatic figures that cannot be sourced. This article explains a third path: building a credible, documented argument for work whose success is measured in what did not happen.

Expert insight: You do not have to prove a specific disaster was averted. You have to show that the harm your work addresses is real, that it matters beyond one employer, and that your approach credibly reduces it. Those are three separate claims, and each needs its own evidence.

The Problem With Counterfactuals

Officers evaluate evidence, not intention. A statement such as 'my work prevented millions of dollars in losses' invites an immediate question: according to whom, and measured how? If the answer is 'my estimate,' the claim carries little weight and may harm credibility.

Preventive professionals face a particular version of this problem. The ideal evidence, a documented catastrophe that your work stopped, almost never exists. And when something close to it does exist, it is often covered by confidentiality, legal hold, or security disclosure rules. So the petition has to be built from different material: public context about the type of harm, documented changes in the systems you touched, adoption by others, and expert assessment of the method.

Three claims, three kinds of proof

Claim	Question the officer is asking	Typical evidence
The problem is real and significant	Is this harm substantial and of national concern?	Government reports, agency guidance, sector assessments, regulatory material
Your endeavor addresses it	Is your proposed work aimed at that problem?	Project descriptions, work plan, technical documentation, policy references
Your approach works	Is there credible reason to think it reduces the harm?	Deployment records, test results, independent review, adoption by others

Notice what is missing from the table: a personal estimate of lives saved or money protected. If an authoritative source publishes such a figure, you can cite it. If not, leave it out.

Warning: Never present a self-generated loss estimate as a fact. Statements like 'this prevented a 40 million dollar breach' need a documented, independently verifiable basis. An unsupported number can undermine an otherwise strong petition. Use only figures from credible sources and phrase uncertain points cautiously.

Defining the Endeavor, Not the Job

The Dhanasar framework looks at the proposed endeavor, which is different from a job title or an employer. 'Security engineer at a software company' is a position. 'Developing and deploying defensive techniques that reduce the exposure of critical infrastructure software to a defined class of attacks' is an endeavor. The second formulation gives the officer something to evaluate for merit and importance.

A good endeavor statement for preventive work has four parts:

• The harm. Name the type of failure or attack, in plain language.
• The affected domain. Identify who or what depends on the systems at risk, such as hospitals, utilities, transportation, financial infrastructure, or public services.
• The method. Describe what you do differently or better than the common approach.
• The scope. Explain how the work reaches beyond one organization, through publication, tools, standards, training, or collaboration.

Our guide to framing a national importance endeavor goes deeper on the structure, and the point that matters most here is the last one. Preventive work confined to a single employer's internal systems is harder to present as nationally important than work whose methods, tools, or findings reach others.

Sourcing Credible Context

Because your own results may be confidential, public context carries a lot of weight. The purpose is not to inflate your role but to show that the problem you work on has been recognized as significant by credible institutions.

Where to look

• Agency publications that identify risks to critical sectors, such as reports and guidance from federal bodies that oversee cybersecurity, transportation safety, energy reliability, or public health.
• Standards and frameworks published by NIST and similar bodies that define recognized practices in the domain.
• Congressional or regulatory material describing a concern that your work addresses.
• Peer-reviewed or institutional studies describing the category of failure and its consequences.

Quote sparingly and accurately, cite the document by title and date, and avoid stretching a general statement to imply it endorses your specific project. If a report mentions a risk area in broad terms, say that. Do not suggest it mentions you.

Three Illustrative Scenarios

The examples below are hypothetical and created for illustration. They are not real cases and do not predict an outcome.

Scenario one: the vulnerability researcher

A researcher in application security has responsibly disclosed dozens of vulnerabilities in widely deployed open components. His first petition draft read: 'My work protects millions of users.' There was no source for the number.

The rewrite did something different. It cited public advisories documenting each disclosure, identified the components by their publicly known names, and showed through the maintainers' own release notes that fixes were issued. It then pointed to a government publication describing the category of software supply chain risk as a concern for critical sectors. A letter from a maintainer, who had no relationship with the researcher beyond the disclosures, described what each report changed. The petition no longer claimed a number. It showed a documented chain: finding, fix, and recognized category of risk.

Scenario two: the reliability engineer

A site reliability engineer at a regional energy-services company redesigned the failover logic for a monitoring system. She cannot disclose the company's incident history. Instead, she documents the design pattern, publishes a technical paper describing the approach in general terms, and presents it at an industry conference. Two utilities independently adopt similar logic and say so in public technical talks.

Her endeavor is framed around improving resilience of monitoring and control for grid operations, supported by public material on grid reliability from energy-sector bodies. The evidence of effectiveness is not her employer's internal metrics but adoption, peer review of the paper, and the independent talks. If she wants the full picture of how a technical record becomes evidence, a related read is our piece on how industry practitioners build an EB-2 NIW case without a research record.

Scenario three: the process safety specialist

A chemical process safety specialist leads hazard analyses at a manufacturing firm. The facility's internal reports are proprietary. She develops a training curriculum and a checklist method that she shares through a professional society, where it is adopted by member companies. Her petition cites regulatory guidance on process safety management, documents the society's adoption of her method, includes a letter from the society's technical program chair, and describes a three-year plan to extend the method to smaller facilities that lack safety staff.

The narrative is honest about what she can and cannot show: no dramatic averted accident, but a documented, adopted method addressing a recognized hazard category, with a clear forward plan.

The shared lesson of all three: replace the invisible outcome with visible inputs, adoption, and independent assessment.

Substantial Merit Versus National Importance

These two elements are related but not identical, and preventive work often shows the first more readily than the second. Substantial merit asks whether the endeavor has value. National importance asks whether its potential prospective impact is broad enough to matter nationally, not just locally or to one employer.

For security and safety work, national importance often rests on one of the following:

• The sector. The work serves infrastructure or services society depends on.
• The reach. The method, tool, or finding is used across organizations.
• The policy link. The work supports goals described in government or standards documents.

You do not need all three, but you need at least one that you can document. Work in a critical sector with no reach beyond a single firm may be presented with a plan to broaden it. Work with wide reach in a lower-stakes sector can lean on adoption. The key is describing the importance in terms of the endeavor's prospective impact, which the framework addresses, and not a retrospective list of tasks.

The difference between merit and importance is one of the places where applicants most often stumble. For a related discussion about how the second and third prongs interact, see our article on the prong that turns on trajectory.

Showing You Are Well Positioned

Even a well-framed endeavor needs a person credibly able to advance it. In preventive fields, this usually means a combination of the following:

• Education and training that match the technical demands of the work.
• A track record of results, shown through disclosures, deployments, published methods, or tools others use.
• Independent recognition, such as invitations to review, speak, or advise.
• A concrete plan for what you will do next, with progress already underway.

The plan matters more than many applicants realize. A statement like 'I will continue to protect critical systems' says nothing. A plan that names the project, the intended deliverable, the collaborators or partner organizations, and the interim milestones gives the officer something to assess. The overlooked second prong, covered in our guide to proving you are well positioned, goes into this in more detail.

Expert insight: Independent voices carry more weight than internal ones. A maintainer who received your report, a standards editor who adopted your method, or an operator at another organization who deployed your tool can describe what happened without sounding promotional.

Questions an Officer Is Likely to Ask

It helps to read your draft the way an unfamiliar adjudicator would. Preventive work tends to trigger a predictable set of questions, and a petition that answers them in advance reads as confident rather than defensive.

'How do you know it worked?'

This is the counterfactual question. The honest answer is rarely a single number. It is usually a combination of signals: the problem recurred less often in systems that adopted your method, independent reviewers judged the approach sound, and others copied it. Present these signals as a set, and acknowledge that no single one is decisive. Candor here builds trust. An applicant who admits that the strongest evidence is indirect, then lays out the indirect evidence carefully, is more credible than one who claims certainty.

'Would this have happened anyway?'

Officers may wonder whether the improvement would have occurred through routine maintenance or the work of others. You can address this by showing what was distinctive about your approach, such as a new technique, a design decision that departed from common practice, or a problem that others had tried and failed to solve. Documentation of the state of practice before your work, drawn from public sources, helps establish the baseline.

'Why does this matter beyond one company?'

This is the reach question, and it is often the decisive one for national importance. If your answer depends entirely on your employer's size, you should consider whether your endeavor can be framed more broadly. Publishing methods, contributing to open tools, teaching practitioners, or serving on advisory groups can all widen the footprint. They also create the independent record that preventive work otherwise lacks.

'What will you do next?'

The forward-looking question is central to the NIW. A petition that describes only the past invites the response that the applicant is rewarding a good career rather than proposing an endeavor. Make the future concrete, and make sure it connects to what you have already started.

The Third Prong Still Needs Its Own Argument

Applicants in security and safety sometimes assume the importance of the field settles the question of whether the job offer and labor certification should be waived. It does not. The third prong asks whether, on balance, it would benefit the United States to waive those requirements. Arguments here often involve the urgency of the work, the difficulty of applying the labor certification process to a self-directed or multi-employer endeavor, and the fact that your contributions are not tied to a single position.

This prong is its own argument, with its own evidence, and our article on the third Dhanasar prong explains why. It is also worth reading when traditional PERM labor certification might actually be the better route, because for some employer-bound roles it is.

Handling Confidentiality Without Losing the Case

Preventive work is often subject to confidentiality, and responsible disclosure norms make the situation sharper. A petition that reveals sensitive details can create legal, contractual, or even safety problems. A petition that reveals nothing proves nothing. The balance is to describe the work at a level that can be shared, supported by public records and independent confirmation.

What you can often share	What you often cannot
Publicly disclosed advisories and fix notes	Internal incident reports
Published methods, papers, tools, talks	Unpublished architecture details
Letters from independent parties describing outcomes	Customer names covered by contract
Redacted or summarized records, with employer permission	Anything under legal hold or security restriction

If your employer allows it, a short letter confirming your role and the general nature of the work, without sensitive detail, can help. When in doubt, consult your employer's legal or compliance team and qualified immigration counsel before including any material.

Warning: Do not submit screenshots of internal systems, customer data, or non-public vulnerability details to illustrate your work. The risk to you and others usually outweighs any benefit, and an officer does not need them to understand the claim.

A Practical Checklist for Preventive-Work Petitions

• Is the endeavor described as a defined problem and method, not as a job title?
• Does every statistic come from a named, credible, public source?
• Have you separated the claims: the problem is significant, your work addresses it, your approach works?
• Is there evidence of reach beyond one employer, such as publications, adoption, standards, or training?
• Do independent people describe specific outcomes in their own words?
• Does the plan name projects, deliverables, and a realistic timeline?
• Have you addressed the waiver of the job offer with its own reasoning?
• Have you cleared any confidential material with the right parties?
• Do dates, titles, and names match across letters, exhibits, and the narrative?

Common Mistakes

• Describing the employer's mission as your endeavor. The endeavor is yours; the employer is a context.
• Using fear as evidence. A dramatic description of what could go wrong is not proof that your work matters. Sourced context and documented results are.
• Counting tickets or tasks. Volume metrics, such as the number of alerts triaged, rarely demonstrate national importance.
• Relying only on internal praise. Letters from managers confirm your job performance. Independent letters confirm broader significance.
• Ignoring the founder and executive path. If you run your own security or safety company, the framing differs; see the founder's version of a national interest waiver.

Frequently Asked Questions

Can a cybersecurity professional qualify for an EB-2 NIW?

Eligibility depends on the specific facts, including whether the person qualifies for the EB-2 classification, and whether the endeavor meets all three Dhanasar prongs. Cybersecurity is not automatically accepted or rejected. The strength of the endeavor definition and the evidence matters. Check current USCIS guidance for how it applies the framework.

How do I show impact if my results are confidential?

Rely on public context, published methods, adoption by others, independent letters, and any employer-approved summaries. Avoid inventing numbers to compensate for what you cannot share.

Do I need peer-reviewed publications?

Not necessarily. Publications can help, but practitioners often build the case through tools, disclosures, standards contributions, training, and independent adoption. Our article on practitioners without a research record explains this route.

Is working for a government contractor an advantage?

It can provide context, but it is not a substitute for a defined endeavor and evidence. An officer still needs to see how your work has prospective national impact and why you are well positioned.

How specific should my future plan be?

Specific enough to be assessed. Name the type of project, intended deliverables, likely partners, and interim milestones. Avoid promises you could not plausibly keep, and note that plans can change.

Can I cite news coverage of a major incident to show the problem matters?

You can use credible reporting as context, but prefer official or institutional sources where possible. Do not imply that the incident was connected to your work unless you can document the connection.

Should I get letters from my employer's customers?

Possibly, if they are independent and permitted by contract. Letters from other organizations that adopted your method or tool tend to be more persuasive than internal endorsements.

What if I changed employers during the work?

This can actually help show the endeavor is not tied to a single position, provided the thread connecting your roles is clear and documented.

Does a certification such as a security credential matter?

It may support your qualifications and training, but it rarely establishes national importance by itself. Treat it as background, not as the core of the argument.

Is an NIW always better than other routes?

Not always. The right path depends on your record, timeline, and goals. Every case is different, and you should evaluate options with qualified guidance and current USCIS information.

Conclusion

Preventive work is some of the most valuable work in modern society precisely because its success looks like nothing happening. For an NIW, that means the burden shifts from showing a dramatic result to showing a credible chain: a recognized problem, a defined endeavor, an approach that others have adopted or reviewed, and a clear plan to continue. The petitions that succeed with this kind of work do not shout. They document.

If your work protects systems, people, or processes in ways that rarely make headlines, a structured portfolio review can help you identify which parts can be proven and how. Every immigration case is unique, and professional guidance can help you build a stronger, more accurate portfolio. You can contact EB1 Mentor to discuss your profile, learn about our EB-2 NIW services, take the profile evaluation, or browse the EB1 Mentor blog. EB1 Mentor is not a law firm and does not provide legal advice; for legal questions, consult a qualified immigration attorney.

References and Further Reading

• USCIS Policy Manual, Volume 6, Part F, Chapter 5: Advanced Degree or Exceptional Ability (National Interest Waiver)
• USCIS: Employment-Based Immigration, Second Preference EB-2
• 8 CFR 204.5: Petitions for employment-based immigrants
• NIST: Cybersecurity Framework
• CISA: Critical Infrastructure Security and Resilience
• OSHA: Process Safety Management

Requirements, policies, and procedures may change. Verify current requirements with official USCIS guidance or qualified legal counsel.