How Neurodiversity Can Help Fill the Cybersecurity Workforce Shortage

COMMENTARY

One of the most vexing issues in cybersecurity doesn't have to do with technology; it has to do with people. Finding enough cybersecurity professionals to fill open positions in the public and private sectors has been a problem for more than a decade, and, despite efforts from both sectors, the situation has not improved. The most recent (2022) report from ISC2 puts the US cyber workforce gap at 410,695 — up 9% from the 2021 report. ISC2 says the global gap is 3.4 million, noting that the supply of cybersecurity workers cannot keep up with the demand. The global workforce gap increased by over 25% from 2021 to 2022, and nearly 70% of the cyber professionals surveyed for the ISC2 report said their organization has a worker shortage.

One ISC2 recommendation for filling the gap is to recruit a more diverse population, as cybersecurity work requires a variety of skills at a variety of levels, and a good portion of the work comes down to problem-solving. Having a diverse workforce generates different perspectives and ways to solve problems, adding important dimensions to the cyber skill set.

While many companies are focusing on important diversity, equity, and inclusion (DEI) efforts around race and gender, many of the top science, technology, engineering, and math (STEM) companies, such as Microsoft, SAP, and EY, are looking to increase neurodiversity in their workforce. Neurodiversity describes the natural variation in human brains that leads to differences in the way we think, learn, and work. While neurodiversity hiring programs originally focused on autism, many employers have expanded their recruitment to include attention-deficit/hyperactivity disorder (ADHD), dyslexia, and other (sometimes nonlabeled) differences that bring a new perspective to their workforce.

Neurodiversity as a Competitive Advantage

Research in psychology and neuroscience points to several assets that neurodivergent people may bring to the workforce. Some people with autism excel in detailed pattern recognition and systematic thinking — talents that software companies have leveraged in areas such as quality assurance and debugging. These skills are remarkably well-suited for cybersecurity tasks such as monitoring and detecting security breaches.

ADHD and dyslexia are associated with increased idea generation and the ability to see connections between new ideas. In addition, employers have found the nonconformity and innovative thinking that people with ADHD or dyslexia bring to the workforce valuable for approaching problems in new and different ways. Employers also appreciate the persistence and focus many of their neurodivergent employees demonstrate, which leads to thorough problem-solving and follow through. Many STEM employers say that neurodiversity in their workforce is a competitive advantage.

How to Recruit Neurodiverse Talent

One problem these companies face is not finding enough neurodivergent talent. Unfortunately, many of our best learners are discouraged from STEM through schooling that focuses on their deficits rather than their talents. Many brilliant problem solvers leave school thinking they are intellectually unfit for any professional career, let alone cybersecurity.

This is why we must start looking at neurodiversity differently in our education systems. We must engage learners in student-centered learning, where their own interests and talents guide the learning process. When this happens, each learner can discover their own strengths and work from those. When they feel confident and strong as learners, their deficits can also be addressed. But if we make them feel like losers from the start, we've given up on them before they can play the game.

My research shows that companies that have successful neurodiversity workforce programs have changed the way they recruit, interview, hire, and manage their employees.

Not surprisingly, many companies find that the accommodations they make for neurodivergent learners are what all their employees see as good management. Everyone benefits from the new ways of working.

The need for cybersecurity professionals will expand as artificial intelligence (AI) and other new technologies come online. Meeting these needs will require an innovative, creative, persistent workforce with a keen eye for detail and systematic thinking. These folks are out there. They are in our classrooms today. Educators and cybersecurity companies just need to reach them where they are and give them a chance.