September 1 is International Women In Cyber Day, an initiative founded in 2018 by Lisa Kearney, CEO of the Women CyberSecurity Society.

Yet the latest figures from the ISC2 Cybersecurity Workforce Study paint a bleak picture of the current UK cybersecurity job market. The number of women in UK cyber roles is just 17%, trailing behind other digital sectors and many other countries, with even smaller representation at leadership level.

Women are still reporting multiple cultural barriers at work, including sexism, ageism and a lack of opportunity compared to their male counterparts.

But at the same time, ISC2's study found 72% of women describe cybersecurity as a welcoming career, with job satisfaction increasing from 67% to 71%. 

“That's important,” says Nikki Webb, director at Custodian360. “There are a lot of brilliant people and organisations genuinely trying to make things better.” 

However, women were also more likely than men to report layoffs in their organisations over the previous 12 months, and many still do not feel completely comfortable being themselves at work.

“For me though, the bigger question is not how many women are joining cyber,” says Webb. “It is why some still do not think they can fully belong once they are here.”

Technical Ego 

Cybersecurity can still carry a culture of ‘technical ego,” where “confidence is mistaken for competence and challenge is sometimes met with defensiveness,” says Carole Reeves, director of security operations at digital transformation company ANS. “As a woman, I have faced situations throughout my career that I find difficult to imagine a man with the same experience and track record being expected to navigate.”

Barriers aren’t always overt. They can take the form of being dismissed, having your judgement questioned, or repeatedly having to prove your credibility, according to Reeves. “Each incident may appear small in isolation, but the cumulative effect can cause talented women to change direction – or leave the profession altogether.”

Cultural barriers are an issue, agrees Jenny Leah, sales and operations director at RightCue. “Boys’ clubs still exist and are something I’ve experienced directly,” she says.

In some cases, opportunities are determined by golf days or boys-only ski trips. “The casual invitation to the rugby that’s not extended to female colleagues,” explains Leah. “It’s that slight push to the side, the sense of exclusion that can lock women out of conversations, decision making and access – and it’s really damaging.”

Proving Yourself 

 The biggest issue, according to Webb is “having to prove yourself, constantly.”

 “It is being interrupted, having your ideas ignored until someone else says exactly the same thing,” Webb says.

Then there are the pressures women put on themselves because of this. “I myself have felt the need to work harder, say yes to all the things, and prove my commitment,” says Webb. She acknowledges it is “a one-way road to burnout.”

Webb also thinks the cybersecurity industry needs to talk more openly about harassment and inappropriate behaviour. “The fact that a lot of women still have to think very carefully about what they report, who they report it to, and the consequences, tells us something pretty scary about some workplace cultures,” points out Webb. “Nobody in any industry should have to weigh up whether speaking up is going to damage their career.”

Age is another problem. “There is a strange point in a woman's career where she has gained years of experience, confidence and knowledge, yet she suddenly feels she is becoming less visible,” Webb says.

Cate Pye, global head of cybersecurity and digital trust, PA Consulting believes a lot of issues are societal. “With the lion’s share of family responsibility still falling on women – with exceptions of course – they spend more time looking after family members and less time in the workforce.”

Webb concurs. There is the pressure of “caring for children, ageing parents, relationships, changing bodies, perimenopause, menopause, and all the hormonal chaos that comes with all of that.”

“None of this makes us less capable, but pretending it does not affect us is so damaging,” says Webb.

Stagnation 

Mid-career stagnation is another problem many women face, says Lauren Taggart, sales manager, EMEA at Huntress. “Women in security tend to get stuck at mid-level roles noticeably longer than men, waiting three-plus years for promotions compared to two for male colleagues. Without executive sponsorship, career growth stalls.”

At the same time cybersecurity still glorifies a “24/7 hero” culture “praising frantic, midnight incident responses over proactive, systematic risk management,” says Taggart. This environment inevitably “penalises anyone needing predictable hours or flexibility.”

Building a career in security and compliance, Patricia Leppert, team manager customer trust and security at TeamViewer, was accustomed to being the only woman in the room. “It started early, when I was one of three women in my programming studies, and it followed me into the workplace. More than once, I've watched a male colleague's surprise register when he realised I held the same credentials and years of experience as he did. I didn't let that define me, but it did change how I lead.”

Now Leppert makes a point of being visible and approachable with her team. “I know what it's like to hold back a question or a concern because you're not sure the room will take you seriously. I want people to feel they can bring me a problem without worrying how it'll land.”

Izabella Stueflotten is VP of digital security strategy at cybersecurity giant Elasticito. She says there are more women on tech calls now than five years ago, which is “a welcome change.”

However, she mentions one instance when a potential client “told her off” for speaking. “They quipped something similar to, ‘who let this kitty cat talk?’. Luckily, my boss came to the rescue, and we never heard from the lead again.”

Changing Cultures

 Despite some progress, all the women SC Media UK spoke to agree that work culture still needs to change.

“Please stop asking women to adapt to bad cultures,” says Webb. “Change the culture.”

 At the same time, listen when women say they are burnt out, adds Webb. “Listen when they say a behaviour is making them feel uncomfortable, and most importantly, do something about it.”

 Leah believes mentoring is one of the few strategies that can consistently make a real difference. “Seeing is believing: If every senior figure in the room looks the same, it's easy to make the assumption that the room – or leadership – isn't for you.”

Meanwhile, firms should modernise security operations, says Taggart. “Fix the operational model. Normalise structured shift rotations, asynchronous handovers, and flexible working so incident management doesn't rely on constant personal sacrifice.”

While there are certainly major issues, not least the tiny figure of women working in cybersecurity in the UK, Webb does think things are improving overall and more conversations are being had. “Getting women into cyber is the easy bit. What we really need to do is create a culture where they want to stay.”

Pye thinks businesses should provide more balanced parental and care leave to start to equalise the responsibilities on the home and the career prospects of women. “This has worked well in Northern Europe to rebalance home roles and effort.”

Pye also suggests grants and additional support for retraining, with a focus on groups that otherwise struggle to take the time such as single mothers returning to work. “Cyber can be a very flexible career, once you can get into it.”

Kate O'Flaherty Cybersecurity and privacy journalist