Fewer women than ever in UK's 'old boys' club' cyber industry

The proportion of workers in the UK cybersecurity industry identifying as women has dropped to 16 percent, the lowest level since 2021. Gender diversity has long been an issue pervading the STEM fields, although in cybersecurity this is especially pronounced, both at senior leadership and education levels. This is despite …

[Anonymous Coward]

Place I once worked

They definitely refused to hire women of child-bearing age.

I never managed to get anything in writing that I could use to report them.

[LybsterRoy]

Re: Place I once worked

The UK's birthrate is declining - maybe the place you worked was trying to address the problem?

[Anonymous Coward]

Self correcting in the long run

All the businesses passing on the benefits of a diverse management team will lose out and be overtaken due to corporate Darwinism.

[Anonymous Coward]

Re: Self correcting in the long run

realise this could be misread, I mean missing out on the benefits by passing on opportunities to recruit diverse individuals to management

[LybsterRoy]

Re: Self correcting in the long run

Rather then recruiting for diversity why not recruit for ability (and yes I know few organisations do)

[Filippo]

Re: Self correcting in the long run

The problem isn't "recruit for diversity instead of for ability", the problem is "recruit for ability instead of for homogeneity". Recruiting for homogeneity is inefficient, although the inefficiency can be masked indefinitely by clique effects, so long as you don't mind pushing all the externalities of that inefficiency onto an underclass composed of everyone outside the cliques.

Recruiting for ability instead of homogeneity is extremely difficult to do when the homogeneity bias is subconscious. All the good traits of the in-clique candidate, and all the negative traits of the out-of-clique candidate, will instinctively stand out. This is so ingrained that it bleeds into most models, unless the person crafting the model is being exceptionally careful, so even automation won't fix it.

Paying explicit attention to diversity is a way to compensate for that a bit, and hopefully to wear down the subconscious homogeneity bias. Ideally, eventually we'll have a generation of leaders grown without a homogeneity bias (which might turn out not be literally possible due to how the mind works, but at least they'd be consciously aware of it), and that will be the actual fix.

[Cliffwilliams44]

Re: Self correcting in the long run

Do you know who recruits for homogeneity? Women and Blacks. HR is the US is dominated by women, in particular in some regions, black women. My experience has been if you try to hire a qualified white male, you run into the diversity roadblock. They won't say it to your face, but they will do whatever that can to prevent that hire. One time I asked why my candidate was not made an offer, the reply was "they don't fit "our" goals", no "my" goals, "their" goals. Those goals are not corporate goals, they are HR goals, unwritten, personal goals of the HR director, a black female!

[Anonymous Coward]

Re: Self correcting in the long run

Meritocracy is a misleading ideal because you're assuming that the best person for a job is the best performing one. The unique perspectives that can only be obtained through a diverse workforce are a far greater benefit than any short term performance metrics.

[Harpist057]

Re: Self correcting in the long run

There are unique perspectives from everyone. Just don't hire identical twins if you want unique perspectives.

[Filippo]

Re: Self correcting in the long run

I wish it was that simple. Unfortunately, belonging to the right clique can prove more beneficial than being competent. Everyone has seen this to be true at some point, on an individual level. But it can and does scale up to business-scale interactions. If three quarters of managers in a whole industry won't treat out-of-clique peers equally simply because they're out-of-clique, that's a very strong drag on those peers.

[Anonymous Coward]

It's not just women...

...cybersecurity in general is a closed off walled garden if you don't know a guy who knows a guy.

Whole industry has turned into this closed off shadow of itself. Packed with "vouching", "verifying" and other associated "one dog sniffing another dogs arse" style certifications...none of the certs out there are particularly difficult and all of them have a second step that requires looking beyond the capability of the candidate and into their past / into who they know.

If you're a youngster wanting to get in, you don't want to follow the academic path (either can't afford it or it's not for you), you don't know anyone already in the industry...you're essentially fucked. Doesn't matter if you're male, female, martian...whatever...you're just fucked.

It's not wonder tons of teenagers build up the skillset, find they can't actually get a legitimate job because they don't know the right people or haven't got enough money and end up "hacking shit for the lulz".

The reason the cybersecurity industry consistently has it's pants pulled down by teenagers is because the cybersecurity industry refuses to employ said teenagers that don't pass a "gentlemanly sniff test" consisting of a high cost of entry barrier and a "do you know who I am?" test.

Until barriers for *all* skilled people are lowered and the bullshit disappears, the cybersecurity sector deserves to be bent over and fucked on a regular basis.

[Bebu sa Ware]

'pass a 'gentlemanly sniff test' "

Conceptually, I have some trouble reconciling the 'gentlemanly sniff test' with 22% of cybersecurity industry identifying as neurodivergent. From experience, the neurodivergence, I can easily believe.

I suppose if your Profumo era bum sniffing gentleman equates kinkiness with neurodivergence, reconcilation is possible.

On that basis "the cybersecurity sector deserves to be bent over and fucked on a regular basis" might be exciting the gentlemen.

Seriously, I suspect how security is approached is fundamentally and fatally flawed. Much of it perimeter fortification of, or bolt-on to, existing insecure systems at best. Security in the most general terms is intrinsically holistic permeating everything from hardware to high level policies.

Not really surprising the cybersecurity business hasn't been conspicuously successful and a few own goals like clownstrike are less than unexpected.

You just know that the cybersec industry is pinning its hopes on AI being the magic elixer that leads the industry some idyllic state of perfection. Perhaps the ultimate own goal.

[VoiceOfTruth]

Re: 'pass a 'gentlemanly sniff test' "

>> Profumo era bum sniffing gentleman

I must remember this phrase for a rainy day.

[Cliffwilliams44]

Re: 'pass a 'gentlemanly sniff test' "

The problem is that all this security initiatives are all based around arbitrary standards.

We are going through this now,

Audit question: "Do you have local firewalls on your endpoints?"

Answer: Yes.

The firewalls could be wide open ANY/ANY, they don't care, they just want their question answered!

[LybsterRoy]

Re: It's not just women...

Don't forget opaque jargon

[IanRS]

Little has changed

There was a similar survey a few years ago (see https://www.theregister.com/security/2022/10/15/infosec-still-mostly-a-boys-club/1142961) and while some of the issues such as gender related employment bias or pay gap, are things which ought to have been (but probably aren't) sorted by now, there was one aspect to the earlier survey which surprised me. Over half the respondents thought it was too complex an area to get into, but this was significantly higher for women, 71% of whom thought so, versus 61% of men.I wonder whether this is still the case.

[Anonymous Coward]

I don't know why this is considered a big deal. Most of the time it's just not that many applicants. It's not that places are refusing to hire people of a certain gender or race. If you get 100 applications, 20% are women, you're going to have low numbers. It just is what it is. What they sure as hell shouldn't do is hire one gender over another simply to balance their numbers. Hire the best.

[Korev]

Age

No mention of age discrimination in the article

[cyberdemon]

Re: Age

Claude 5.5 was born yesterday!

[Taliesinawen]

Women in tech

> The proportion of workers in the UK cybersecurity industry identifying as women has dropped to 16 percent, the lowest level since 2021.

Jordan Peterson: “The big difference between women and men seems to be that women prefer working with people and men prefer working with things.” “Men show stronger realistic and investigative interests, and women show strong artistic, social, and conventional interests.”

--

I identify as ‘a yellow-scaled wingless dragonkin’ except on Thursdays when I'm ‘an expansive ornate building’ ref :o

[Anonymous Coward]

My Ethnic niece graduated with a first, 2 years ago in Computer Science with Cyber Security from a well known uni. Over 100 applications and still nothing. Its getting beyond a joke.

[Michael]

identifying as women?

Seriously?

You can identify as an abdominal snowman. The issue I think is meant to be the lower number of women in cyber security roles.

However, with a smaller number going into the area to work I can't tell if these are good or bad numbers. Also, why should women want or choose to work in a specific area? I am honestly fed up with this sort of article because it doesn't provide enough context or understanding to show if the problem is sexual discrimination, which should be stamped out, expected numbers per gender based on percentage male and female candidates, or women out performing men in the roles generally.

We can't stand with guns to peoples heads and say you must study this subject and attempt to get this job. How about doing more at an early age to encourage more girls to pick science and engineering. This needs to start in primary school not secondary or university. Why not do more to improve science and technology skills in primary school teachers. Hell, why not get more male primary school teachers?

I still remember the women in my engineering course refusing to take part in photoshoots after the first couple of years after they realised the university were presenting the course as being split equally by gender. There were 6 women in a course of 120 students. To be honest the department would have happily had an equal gender split if they could, however, not enough applied and even when offered a place they didn't all accept. They couldn't get women to apply and those that did were outstanding.

Most of the women in my life with science and engineering backgrounds have chosen careers which in the UK generally pay better than cyber security roles and provide better benefits while having kids. Those that don't want kids and never plan on having them are also in similar roles as they can earn more money. The ones that did go into cyber security roles are also doing well. I understand that selection bias may be the issue here. This goes back to the point that the article doesn't have compelling data.

[LybsterRoy]

Re: identifying as women?

When I read that phrase my first thought was "I can fix the problem - just get the men to identify as women" - problem solved,

[LybsterRoy]

Re: identifying as women?

I thing its something to do with politicians and journalists not really understanding statistics and the difference between possibility and probability. Just because 50% of the human race is female doesn't mean that every occupation should be 50% female. Some have more than 50% some less Why should it be any different?

[Harpist057]

> While this year’s results may prove especially welcome to the neurodiverse crowd, the report noted this may reflect the rising awareness of neurodiversity among employers, rather than a true increase in numbers.

Sounds like they just want people who can do the job and don't care about non-job-related diversity stats.

[Anonymous Coward]

Sad but true

The single biggest reason for so few females working in IT is that they are not willing to put up' with the crap.

Males are quite willing to work stupid hours, get blamed for everything and have the fun work given to whichever outsourcing is the flavour of the month.

The women look at the crap that managers ask and tell them where to go (not literally. They get work somewhere else first).

[Anonymous Coward]

Most sewerage farm workers are male too

We need more women in the shit, now!