Held Back: What Exclusion Looks Like in Cybersecurity

Most of us do not want to be excluded at work – especially if we are trying to innovate, collaborate, and make a meaningful impact in our role. Making connections with colleagues, ensuring you are invited to key meetings, and getting face time with important executives in the company are all essential elements to learning and growing in an organization. But systemic exclusion is a troubling reality for many in the cybersecurity industry.

Olivia Rose, IANS Research faculty member and CISO/founder of Rose CISO Group, is a 17-year CISO and industry veteran. She has experienced exclusionary practices based on her gender throughout her career.

"I believe the interference is rooted in making assumptions about women," Rose says. "When I got married years ago and was in cybersecurity consulting, a leader told my manager to keep my workload light for a few months as I would surely be planning my wedding. I've not been invited to happy hours and to company trips as I have kids and who would watch them? Whether it's intentional or not, making assumptions about women and the various roles we play puts us into a box where it's just another hurdle we need to overcome to be regarded equally."

Women are five times more likely to report exclusion from direct managers and peers, according to Women in CyberSecurity's (WiCyS) "2023 State of Inclusion Benchmark in Cybersecurity Report." But exclusion is not just limited to gender. Individuals with disabilities and intersectional identities experience levels of workplace exclusion comparable to, or even exceeding, those related to gender, emphasizing the compounded impact of multiple differing identity traits.

Microaggressions Are Subtle

It’s not just about being left out of the room. Being on the receiving end of disrespectful behaviors, sexually inappropriate advances, and a lack of appreciation for skills and experience can also make it hard to advance in the workplace. These kinds of microaggressions are difficult to pin down, Rose says.

"I don't personally believe research can help much when it comes to understanding microaggressions and how they are the silent killer for women's careers," she says. "I speak from experience when I say that these microaggressions are so slight and menial that women can't go to HR to report them."

Rose recalls a corporate leader at one point in her career who would attempt to undermine her regularly during meetings by sharply blowing air out of his nostrils whenever she spoke.

"By itself, this doesn't mean anything," Rose says. "[But] add it to the multiple instances where I had seen this individual trying to cut me out of the picture, by sending emails 'forgetting' to copy me, and not providing requested information to my team, and the puzzle starts to come together. How do you even start to explain this, though, to your manager or HR?"

Rose advises managers she works with to take what employees say seriously and write down every instance of reported discrimination and exclusion to form a larger picture of a pattern of problematic behavior.

Pressure in the Room Where It Happens

Umaimah Khan, founder and CEO of identity security company Opal Security, says cybersecurity is more asymmetrical than other tech sectors, largely due to the emphasis on product development processes and sales-driven culture, which often targets executives. This high-risk and high-pressure environment amplifies biases and is resistant to change, says Khan, whose background is in academia and research labs before founding Opal.

Women are also pressured to be both business-savvy and technically adept in their roles, and assertiveness can be misconstrued as aggressiveness. This dichotomy can deter many from entering or remaining in the cybersecurity field, Khan says, noting that "they are not willing to go through pain and frustration and having to be second-guessed."

For her part, Khan strives to build a diverse team at Opal. But even under the best circumstances, she thinks resilience is an essential attribute for women to thrive. Women often need to prove themselves repeatedly and must develop a thick skin, she says.

"I think there is truth to having to be twice as good," Khan adds. "I found myself in my early days having to prove myself in those rooms. You have this feeling that [you] have to be right 100% of the time."

Steps to Change and Improve Inclusion

Exclusion is intricately intertwined with career issues, such as inadequate compensation and being passed over for promotions. Combating these issues requires communicating clearly with both peers and management, says Larci Robertson, a senior sales engineer at Obsidian Security. Document accomplishments and have metrics to demonstrate success, she suggests.

"Talk about pay with your peers," Robertson says. "Have a clear path to promotions and raises for people from management. Expectations and a pathway clearly communicated will take care of the, 'Why didn’t I get promoted over someone else?'"

Finally, find an internal mentor who can help shepherd you along the right path and get the kudos you deserve.

"It's very hard to learn and grow without an advocate," Robertson says.