Women Still Only 11% Of Global InfoSec Workforce

The global cybersecurity workforce remains stagnant at just 11 percent, according to the 2017 Women in Cybersecurity Report, co-authored by The Executive Women’s Forum on Information Security, Risk Management and Privacy (EWF) and the Center for Cyber Safety and Education, which partnered with (ISC)2. The report is based on survey responses from over 19,000 information security professionals in 170 countries.

Report co-author and EWF founder Joyce Brocaglia says the most important finding of the report is that "it isn't just one thing" causing the persistent shortage of women in information security, but rather a "confluence of events."

More on Security
Live at Interop ITX

The findings, says Brocaglia, show that women are underrepresented, are paid less than their male colleagues, feel undervalued, and feel discriminated against. "That's what's leading to this stagnation." 

The shortage is severe in North America, with only 14 percent of the infosec workforce composed of women, but even more striking elsewhere; women only claim 7 percent of the workforce in Europe, 8 percent in Asia, and 5 percent in the Middle East, according to the report.  

"Common sense should tell you we should be doing more about this," says co-author and EWF executive director Lynn Terwoerds, noting that in order to solve the cybersecurity skills shortage, the industry must do a better engaging the female population.

In general, the underrepresentation extends to cybersecurity management, but women were beginning to fare better when it comes to obtaining positions at the very top: while men are nine times more likely to hold managerial positions, they are only four times more likely to hold C-level or executive positions. 

However, those high-level positions for women come at a price; the survey found that the higher a woman rises in an organization, the more discrimination she experiences in the workplace, rising from 35% at entry-level to 67% at C-level.( This could also be a result of respondents providing answers that reflect experiences accrued over the entirety of longer careers, as opposed to only answering about experiences of the past year.) 

Overall, 51 percent of female respondents reported at least one type of discrimination, as compared to 15 percent of male respondents. Of these women, 87% reported unconscious discrimination, 19% overt discrimination, 22% tokenism, 53% unexplained delay or denial of career advancement, and 22% exaggerated highlighting of mistakes. 

The wage gap also persisted, with women earning less than men at every level - $5,000 less at non-managerial positions, $4,630 less for managers, and $4,530 for executive management. Over the past two years, the gap has narrowed for senior positions, but widened for non-managerial positions.

"You look at all of these statistics," says Brocaglia, "and say 'well maybe that's why'" the number of women in infosecurity has not increased.  

The study also unearthed ways to better retain and encourage women in infosec. The report showed that women respondents who underwent leadership training, executive coaching, mentorship, or had "sponsors" who recommended them for high-profile projects, recommended them for promotions, or introduced them to people in their professional networks felt far more valued in their careers.  

"There's a huge issue of developing and advancing these women so they don't opt out," says Brocaglia. "We have to stop losing them mid-career."  

The report also found that while more millenial women are pursuing degrees in computer science and engineering fields, older women are highly educated, but in a wider range of fields. Brocaglia advises employers to remember that there are many, many influential roles in cybersecurity that don't require technical degrees.

Will the women in infosec needle not move upward, however, simply because women are not interested in the job?

"It's a very dubious comment to make," says Terwoerds, noting that throughout history women have "embraced and excelled in" other fields they were presumed to be uninterested in before. "I would consider that Exhibit A of an unconscious bias." 

Related Content: