Fewer women than ever in UK's 'old boys' club' cyber industry

The pro­por­tion of wor­kers in the UK cy­ber­se­cu­rity in­dustry iden­tif­ying as women has drop­ped to 16 per­cent, the lo­west level since 2021. Gen­der di­ver­sity has long been an issue per­va­ding the STEM fields, although in cy­ber­se­cu­rity this is es­pe­cially pro­noun­ced, both at se­nior lea­dership and edu­ca­tion le­vels. This is des­pi­te evi­den­ce that girls re­gu­larly out­per­form boys in STEM sub­jects at UK schools when they do par­ti­ci­pa­te. Not only are there still fewer women stu­dents in cy­ber­se­cu­rity cour­ses than those op­ting for com­pu­ter scien­ce, but the per­cen­ta­ge of women in the se­nior work­for­ce (6+ years of ex­pe­rien­ce) drops further to 12 per­cent – a fi­gu­re that has re­mai­ned broadly con­sis­tent since re­cords began. For con­text, the UK ave­ra­ge across all in­dus­tries for fe­ma­le-iden­tif­ying wor­kers is 48 per­cent. Across the di­gi­tal work­for­ce, as of last year’s data, the ave­ra­ge is 30 per­cent. The UK go­vern­ment in­ter­vie­wed va­rious sta­kehol­ders in the cyber in­dustry, fin­ding that the ba­rriers to se­nior lea­dership po­si­tions were struc­tu­ral – em­plo­yers are pur­po­sely ex­clu­ding women at higher le­vels. His­tory plays a part too – older heads re­mai­ning in their po­si­tions from back when gen­der di­ver­sity was a mat­ter less dis­cus­sed – but re­crui­ters say em­plo­yers are still hol­ding women back based on their per­cei­ved fa­mily am­bi­tions. One re­cruit­ment agent was quo­ted in the re­port as sa­ying: “When I’ve spo­ken to a bu­si­ness and said to them ‘why don’t you hire a more di­ver­se work­for­ce?’ You’ll get the nor­mal com­mon ones of ‘well if we hire a fe­ma­le, she’ll get preg­nant, she’ll be off for 12 months,’ which isn’t right.” Re­fu­sing to hire women based on as­sum­ptions or fears about fu­tu­re preg­nancy is a form of ille­gal gen­der dis­cri­mi­na­tion that di­rectly vio­la­tes the UK's Equa­lity Act 2010. Other com­mon ba­rriers to se­nior po­si­tions in­clu­de as­sum­ptions they did not have the re­qui­si­te tech­ni­cal skills for the role, and that cy­ber­se­cu­rity is still seen as “an old boys’ club.” “This tied into a broa­der fin­ding that ste­reoty­pes about women not being in­ter­es­ted in cy­ber­se­cu­rity con­ti­nued to per­sist,” the re­port noted. “A cy­ber­se­cu­rity firm noted that du­ring a ca­reer talk on cy­ber­se­cu­rity, a group of girls wal­ked out of the talk, and the ca­reers tea­cher re­in­for­ced the per­cep­tion that the sec­tor did not ap­peal to women.” The bu­si­ness told the go­vern­ment: “I went to the ca­reers lady ‘What was the story with the five girls that left?’ And she went ‘Oh, cyber se­cu­rity is not really a girl’s job’.” Jill Broom, head of cyber re­si­lien­ce at te­chUK, said the onus is on em­plo­yers to work har­der on brea­king down the lin­ge­ring ste­reoty­pes about women in cy­ber­se­cu­rity. “Cy­ber­se­cu­rity un­der­pins our growth, our eco­nomy and the sa­fety of our so­ciety, with the sec­tor of­fe­ring gro­wing em­ploy­ment op­por­tu­ni­ties and ca­reer pros­pects,” she told The Re­gis­ter. “Ho­we­ver, the un­de­rre­pre­sen­ta­tion of women in this in­dustry re­mains a sig­ni­fi­cant con­cern. “A lack of gen­der di­ver­sity not only li­mits op­por­tu­ni­ties for women to be­ne­fit from this gro­wing sec­tor but also risks na­rro­wing the range of pers­pec­ti­ves and ideas that are es­sen­tial to tac­kling in­crea­singly com­plex cyber th­reats. Edu­ca­tors and em­plo­yers must work to­gether to cha­llen­ge ste­reoty­pes, break down ba­rriers and pro­mo­te cy­ber­se­cu­rity as an ac­ces­si­ble and in­clu­si­ve ca­reer path.” Re­pre­sen­ta­tion for other groups fared com­pa­ra­ti­vely bet­ter. This past year set a new re­cord for neu­ro­di­ver­gent wor­kers in the cy­ber­se­cu­rity in­dustry, with 22 per­cent of UK staff iden­tif­ying as neu­ro­di­ver­gent. The fi­gu­re re­pre­sents a sharp in­crea­se from 16 per­cent the year be­fo­re, one that has grown each year con­sis­tently since the 9 per­cent re­por­ted in 2020, and ex­ceeds the di­gi­tal sec­tor ave­ra­ge of 19 per­cent. “Cy­ber­se­cu­rity is the most neu­ro­di­ver­se sec­tor I have ever seen, and I think per­so­nally it’s ce­le­bra­ted, es­pe­cially in­ter­nally within the sec­tor,” one res­pon­dent from a small cy­ber­se­cu­rity bu­si­ness told the re­port's authors.