Overview: The State of the Cybersecurity Gender Gap

Though the numbers of women in the cybersecurity¹ field are increasing, it is still overwhelmingly male. And this gender disparity is not simply an optics issue. In fact, research suggests that homogeneity in the industry can lead to less innovation as well as to inferior ideas and design. Diversity in cybersecurity contributes to the efficacy of teams and sustainability of solutions, making it both important for national security,² and a business imperative.³ In short, diversity in the field matters for all of our security—both on and offline.

Beyond the critical importance of diversity in improving security, the sheer number of unfilled jobs presents a very strong case for bringing more people into the talent pool. The latest figures estimate that the United States is facing 313,735 unfilled cybersecurity jobs.⁴ The cybersecurity community as a whole needs better ways to access and harness untapped talent in order to fill these jobs.

Depending on the source of the data, women make up 11 percent,⁵ more than 20 percent,⁶ or 24 percent of the cybersecurity workforce.⁷ However, overall participation in the field is just part of a complex problem. Women at nearly every level of cybersecurity are paid less than their male counterparts, and 51 percent report that they have experienced discrimination, compared with only 15 percent of men.⁸

In light of these findings, the community could certainly use ideas to help accelerate progress. The National Initiative for Cybersecurity Education (NICE), led by the National Institute of Standards and Technology (NIST), has recognized this need, and driven by a strategic goal to nurture a diverse learning community in cybersecurity, a partnership was formed with New America. This project, supported by NICE under grant #60NANB18D023, was designed to generate new, implementable solutions by convening a diverse group of experts to consider our central question: How can the cybersecurity community bring more women into and up through careers in cybersecurity?

The project centered on this convening of experts, but it also incorporated a number of written products in addition to this report. Specific ideas and strategies developed in the convening are gathered in a series of one-pagers suggesting concrete steps for different groups within the community. They are available for download along with this report. The project also included a community scan that aggregates many of the resources available on the topic of women in cybersecurity. The scan is available here.

What’s one thing you learned as a result of being part of the convening?

“As a guy in the field, I’m undoubtedly blind to much of what goes on, much of what the problems are, etc. I learned something of the scope of efforts trying to address the myriad challenges, including some that I didn’t even know existed.”

This report serves three purposes. First, it is intended to reflect and describe the discussion that took place.⁹ As explained below, both space and ease of discussion tightly constrained the number of participants. Practical considerations meant that many valued members of the community and important outside voices were not able to be in the room, but very clearly have a role in carrying the work forward. Thus, this report is an effort to bring these stakeholders up to speed and into the ongoing conversation. Second, the authors recognize that this conversation cannot stand alone; it must be one of many, each generating progress in different ways. For this reason, we have attempted to capture the motivations and implementation plans of the project as a resource to others that may be interested in a similar effort.

The group discussions central to the convening were far ranging and immensely successful at generating ideas. However, as can be the case in the aftermath of a thought-provoking conversation, there is added value in aggregating, organizing, and processing the information surfaced. In turn, the third purpose of this report is to pull together the various strands of thinking, highlight trends, and suggest next steps that members of the community may take to keep the work moving forward.