QSai LLC, a Texas limited liability company doing business as CISO Marketplace, [registered business address], Texas [ZIP] ("Sponsor"). Contact: giveaway@cyberaware.win. Sponsor is solely responsible for this Promotion.
This Promotion (the "Promotion") consists of three separate components, each with its own rules below:
The Promotion begins October 1, 2026 at 12:00:00 AM Central Time ("CT") and ends October 31, 2026 at 11:59:59 PM CT (the "Promotion Period"). Sponsor's server clock is the official timekeeper. Bonus Codes (Section 5.2) are released throughout the Promotion Period, including at least one per week.
5.1 Free entry. Visit cyberaware.win, sign in with or create a free CISO Marketplace account (which verifies your email address by a one-time link sent to it), and complete the entry form (name, US state or country of residence, age confirmation and acceptance of these Rules). One (1) verified account = one (1) entry. Creating an account is free and requires no purchase. Limit one free entry per person and per email address for the Promotion Period. Entries by script, macro, bot or any automated means, and entries with disposable or invalid addresses, are void.
5.2 Bonus entries. Confirmed entrants may earn additional entries as follows. Bonus entries do not improve the odds of any single entry; they add entries to the pool. Every number of bonus entries available through a purchase is also available without one (Free Bonus Entries, below).
| Action | Bonus entries | Limit |
|---|---|---|
| A friend enters via your personal share link | +1 per friend | 25 |
| Redeem a Bonus Code published by Sponsor: spoken in each weekly CISO Insights podcast episode, and shown as typed or QR codes in Sponsor's blog articles, videos and social posts and at cisoinsights.show/security-awareness-2026. Every Bonus Code is published somewhere free to access; no purchase, membership or paid service is needed to find one | +1, +2 or +3, as stated where the code is published | Once per code per entrant; each code valid from release until the end of the Promotion Period |
| Community submission approved by Sponsor (photo / video / featured) | +1 / +2 / +5 | 50 in total |
| Free Bonus Entries: your first community submission (Section 7.2: a photo, 60-second tip, tabletop scenario, teardown or desk shot), whether or not it wins. No purchase or payment required. Removed if Sponsor declines the submission as spam, off-topic or in breach of Section 7.3, and you may submit again. | +25 | Once per entrant |
| Reach Shop Rewards Tier 1 / 2 / 3 / 4 / 5 (Section 6) | +1 / +5 / +10 / +25 / +25 | Highest tier reached only, not cumulative |
5.3 Prizes and Community Unlock. The Grand Prize, one (1) NitroPhone 5a (ARV [$___]), is awarded regardless of the number of entrants. The following prizes are added to the drawing only if the Unlock Count reaches the stated milestone during the Promotion Period. The Unlock Count is the number of confirmed entrants plus Gifted Unlocks (Section 6.2). A live count is shown at cyberaware.win.
| Unlock Count | Prizes added to the drawing | Approx. retail value (each) |
|---|---|---|
| 250 | Five (5) bundles: Nitrokey Start + USB data blocker | [$___] |
| 500 | Three (3) Nitrokey 3 (USB-A or USB-C, by stock) | [$___] |
| 750 | Three (3) three-month CISO Marketplace Practitioner memberships (details), and one (1) bundle: Nitrokey Passkey + USB data blocker | [$___] / [$___] |
| 1,000 | One (1) NovaCustom NUC | [$___] |
If a milestone is not reached, its prizes are not awarded in the Sweepstakes; Sponsor may, at its sole discretion, award them through the Skill Contest or a future promotion. Winners are drawn in the order: Grand Prize first, then unlock prizes from highest to lowest value. Limit one Sweepstakes prize per person.
5.4 Drawing. After the Promotion Period ends, Sponsor freezes the pool of eligible entries and publishes, at cyberaware.win/winners, the SHA-256 fingerprint of a file listing each eligible entrant by a pseudonymous draw ID with their number of entries, together with a future round number of the drand public randomness beacon (League of Entropy, "quicknet" chain). On November 5, 2026, the randomness published by drand for that round is used as the seed. For each pick, the seed and the pick number are hashed with SHA-256 and mapped, without bias, to one entry in the pool, so each entrant's chance equals their entries divided by all entries remaining; a winner is removed before the next pick. The first pick receives the Grand Prize and later picks receive the unlocked prizes in descending order of value (Section 5.3); further picks are alternates in order. The pool file, the seed and the results are published so that anyone can reproduce the draw with the published verification script. The fingerprint, pool file and results are retained for twelve (12) months as the audit record. Odds of winning depend on the total number of eligible entries received.
5.5 Winner notification. Potential winners are notified by email within three (3) business days of the drawing and must respond, and return a signed Affidavit of Eligibility, Liability Release and (where lawful) Publicity Release, plus an IRS Form W-9 (US) or the applicable tax form where requested, and, for Canadian residents, a correct answer to the skill-testing question in Section 4, within seven (7) days of notification. Failure to respond, an undeliverable notice, or non-compliance with these Rules results in disqualification and selection of an alternate winner. Limit one Sweepstakes prize per person or household.
5.6 Guaranteed entrant perks (not drawn). These are given to every confirmed entrant, involve no chance, and are not Sweepstakes prizes: (a) one month of ThreatWatch News network access (threatwatch.news/pricing); (b) if the Unlock Count reaches 500, twenty-five (25) CISO Marketplace credits (cisomarketplace.services/membership); (c) if it reaches 750, one month of the CyberBrief AI newsletter (cyberbrief.news/pricing). They are open to every entrant permitted to enter under Section 4, including residents of places excluded from the Sweepstakes. All perks start on November 1, 2026, are applied to the CISO Marketplace account used to enter (visible at my.cisomarketplace.com), have no cash value, are non-transferable, and follow the CISO Marketplace terms; credits follow Section 6.3.
6.1 How it works. Purchases made during the Promotion Period at ciso.diy, cyberpolicy.shop, generatepolicy.com, securitybydesign.shop, securitygadgets.shop and my.cisomarketplace.com, made with the same email address, are summed on a net basis (after discounts and refunds, before tax and shipping). Hardware purchased at securitygadgets.shop counts toward your Tier at full price; the CYBERAWARE26 discount does not apply to it (Section 6.6). Your cumulative net spend determines your Tier. Each Tier's reward is guaranteed, not a chance to win, and is not limited by stock. Rewards are cumulative up the tiers.
| Tier | Cumulative net spend | Guaranteed reward | Approx. retail value |
|---|---|---|---|
| 1 | $25 – $99.99 | One policy template or ciso.diy mini-kit (digital) | [$___] |
| 2 | $100 – $249.99 | Tier 1 + one SecurityByDesign t-shirt or awareness poster | [$___] |
| 3 | $250 – $499.99 | Tier 2 + $50 in CISO Marketplace credits | $50 + Tier 2 |
| 4 | $500 – $999.99 | Tier 3 + three (3) months of CISO Marketplace Practitioner membership (details) | [$___] |
| 5 | $1,000+ | Tier 4 + a Gifted Unlock of one hundred (100) added to the Unlock Count for all entrants (Section 6.2) | Tier 4 |
6.2 Gifted Unlocks. Each purchaser who reaches Tier 5 adds one hundred (100) to the Unlock Count (Section 5.3), once per purchaser. A Gifted Unlock adds prizes to the drawing for every entrant; it does not give the purchaser any additional entries. Purchasers may choose to be named publicly or remain anonymous.
6.3 Credits and membership. Credits and membership time are applied to the CISO Marketplace account that uses the purchasing email, have no cash value, are non-transferable, and follow the CISO Marketplace terms. Credits expire twelve (12) months after they are issued.
6.4 Refunds. A refunded or charged-back purchase removes the corresponding amount from your cumulative spend. Rewards for a Tier you no longer qualify for are withdrawn, or, if a physical item has already shipped, Sponsor may deduct its retail value from the refund.
6.5 Fulfilment. Digital rewards, credits and membership time are issued, and physical items ship worldwide (excluding the places listed in Section 4), within thirty (30) days after the Promotion Period closes. Import duties and taxes are the recipient's responsibility. A refunded purchase that drops a purchaser below Tier 5 does not remove a Gifted Unlock already counted.
6.6 The CYBERAWARE26 discount is a separate promotional offer: 20% off eligible digital products and membership, one use per order, not combinable with member pricing, excludes hardware, expires October 31, 2026. Use of the code is not required to participate in Shop Rewards.
7.1 Weekly prizes. One prize is awarded for each contest week to the best community submission received in that week, of any type:
| Week | Submissions received (CT) | Prize | Approx. retail value |
|---|---|---|---|
| 1 | Oct 1 – Oct 11, 2026 | Nitrokey Start + USB data blocker | [$___] |
| 2 | Oct 12 – Oct 18, 2026 | Nitrokey Passkey + USB data blocker | [$___] |
| 3 | Oct 19 – Oct 25, 2026 | Nitrokey 3 + $50 in CISO Marketplace credits (Section 6.3 terms apply) | [$___] |
| 4 | Oct 26 – Oct 31, 2026, 11:59 PM | Nitrokey 3 + $100 in CISO Marketplace credits (Section 6.3 terms apply) | [$___] |
Each weekly winner also receives three (3) months of MicroSec.tools Starter (75 credits per month; microsec.tools/pricing), starting November 1, 2026. Winners are selected in their week; all digital prizes start November 1, 2026 and physical prizes ship after winner verification.
7.2 How to enter. Every community submission made through the form at cyberaware.win/community.html#submit (or the CISO Community Discord /submit command) is automatically entered for the week in which it is received. Submission types: weekly challenge, 60-second tip, setup tour, teardown, tabletop scenario, DIY guide, poster or t-shirt design, and awareness talk. Video and social entries must be posted publicly with the hashtag #CyberAwareWin and the link submitted through the form. You may submit as often as you like, subject to the daily limit shown on the form, but you may win at most one weekly prize.
7.3 Content requirements. Entries must be your original work, in English or with an English summary or captions, not previously published commercially, and must not contain: third-party content you lack rights to; confidential or client information; personal data of others; anything unlawful, defamatory or that violates the hosting platform's terms. Teardowns must be of devices, software or documents you own or are authorised to examine, and must not disclose unpatched vulnerabilities in third-party products outside a coordinated-disclosure process.
7.4 Judging. A panel of at least two judges appointed by Sponsor scores each eligible submission: relevance and accuracy (40%), usefulness to practitioners or the public (30%), creativity and clarity (30%). The winning submission is the one with the highest average score, and the judges' average scores are published with each winner. Ties are broken on relevance and accuracy. Judges' decisions are final. Each week's winner is announced on the following CISO Insights episode and at cyberaware.win/winners; Week 4 is announced with the November 5 draw. If a week receives fewer than three (3) eligible submissions, its prize rolls over and is awarded in addition to the next week's prize (Week 4 prizes roll to a runner-up).
7.5 Licence. You keep ownership of your entry and of any community submission. By submitting you grant Sponsor a perpetual, worldwide, royalty-free, non-exclusive licence to reproduce, adapt (for format and length), publish and distribute it, with attribution, across CISO Marketplace properties, the podcast and social channels, to promote this Promotion and Sponsor's community, and to feature winning and standout tabletop scenarios free on tabletopsec.com. You represent you have the right to grant this licence.
7.6 Selling your work. This licence does not let Sponsor sell your work. Sponsor will put a design on products for sale (for example on securitybydesign.shop) or include a guide or scenario in a paid product (for example on ciso.diy or tabletopsec.com) only under a separate written creator agreement with you that includes a revenue share. Sponsor may invite winning or standout submitters to the creator program (securitybydesign.shop/creators) or the affiliate program (cyberadx.network/affiliate). Joining either is optional, is separate from this Promotion, and has no effect on entries or odds.
Information collected is used to administer the Promotion, verify eligibility, deliver prizes, and, only if you tick the separate, optional newsletter box, to send the CISO Marketplace newsletter. Subscribing is never a condition of entry. You may unsubscribe at any time without affecting your entry. Sponsor does not sell entrant data. Entrant data is processed by Cloudflare (hosting), Stripe (payments), Resend (email) and CISO Marketplace ID (account sign-in). Residents of the EU/UK/EEA: the lawful basis is consent (Art. 6(1)(a) GDPR); you may request access, correction or deletion at giveaway@cyberaware.win. See the Privacy Notice.
Except where prohibited, acceptance of a prize constitutes permission for Sponsor to use the winner's first name, last initial, city/state (or country), likeness, entry and statements for promotional purposes in any media without further compensation. Skill Contest winners' entries are published with attribution as described in Section 7.5.
By participating, you release and hold harmless Sponsor, its members, officers, employees, contractors and agents, and Nitrokey GmbH, NovaCustom, YouTube/Google, TikTok and Podbean (the "Released Parties") from any claim, liability, loss or damage arising from participation in the Promotion or the acceptance, possession, use or misuse of any prize, including any injury, loss of data, or breach of a device. The Released Parties' aggregate liability to any participant shall not exceed the approximate retail value of the prize at issue. Nothing in these Rules limits liability that cannot be limited under applicable law.
These Rules and the Promotion are governed by the laws of the State of Texas without regard to conflict-of-law principles. Except where prohibited, any dispute arising from the Promotion shall be resolved individually, without resort to any form of class action, exclusively in the state or federal courts located in [county] County, Texas, and participants waive any right to a jury trial. Any claim for damages is limited to actual out-of-pocket costs (excluding attorneys' fees) and excludes indirect, punitive, incidental and consequential damages.
Winners (first name, last initial, state or country) are posted at cyberaware.win/winners by November 15, 2026 and remain for at least sixty (60) days. To request the list, email giveaway@cyberaware.win by December 31, 2026.
This Promotion is in no way sponsored, endorsed, administered by, or associated with YouTube, Google LLC, TikTok, ByteDance, Podbean or any social media platform. Participants release those platforms from any responsibility. Any questions, comments or complaints regarding the Promotion must be directed to Sponsor, not to any platform. Participation on a platform is subject to that platform's terms of service.