By Samantha Jennings
Building stronger cyber security means bringing more perspectives, experiences, and ways of thinking into the teams responsible for anticipating risk.
I believe that we need to change the way we talk about diversity in cyber security; and today being Women in Cyber Day is a good chance to highlight this.
Diversity is a resilience issue. If organizations want to become more resilient to an increasingly complex threat landscape, the breadth of thinking within their security teams has to be part of that conversation.
The UK Government’s Department for Science, Innovation, and Technology’s latest Cyber security skills in the UK labour market report shows that women account for just 17% of the cyber sector workforce, compared with 30% of the wider digital workforce and 48% of the UK workforce. At senior level, female representation falls to 12%.
Those figures expose a significant imbalance and raise the question of what perspectives, questions, and ways of thinking we miss because some voices are absent or go unheard and what that means for our ability to anticipate and respond to risk.
Resilience requires imagination
There is a lesson from the wider security world that feels particularly relevant.
Following the September 11 attacks, the 9/11 Commission examined how such an enormous threat had not been anticipated or prevented. Its report identified failures in four areas: imagination, policy, capabilities, and management, with imagination described as the most important.
For me, that finding was a lightbulb moment in understanding the importance of diversity in security. If a failure of imagination can leave us vulnerable, then who we involve in imagining threats matters. People with different backgrounds, experiences, and ways of thinking bring different frames of reference. They ask different questions, challenge different assumptions, and may see risks that others overlook.
Threat actors look for the route we have not considered and exploit assumptions we have failed to question. If everybody tackling a problem has followed a similar educational and professional route, we increase the possibility of collective blind spots. A resilient security function therefore needs diversity not simply in its technologies and controls, but in the thinking behind them.
The action for cyber leaders is to start treating diversity as part of resilience planning.
Resilient teams need different routes into cyber
My own route into cyber security was anything but conventional.
I did not study computer science or start my career as a coder. I loved English and the power of language. I studied business and finance before becoming an account director, commercial manager, and bid manager in recruitment advertising. At one point, I even worked abroad as a holiday entertainer.
On paper, none of that looks like an obvious route to becoming head of operations at a cyber security company.
In practice, every experience gave me skills I rely on today.
Being an account director taught me about people, relationships, and communication. Bid management taught me how to translate requirements for different teams, from finance and HR to IT and client services, and bring them together towards a shared goal. Working as an entertainer taught me confidence and adaptability. Throughout those roles, curiosity encouraged me to ask a question that remains important in cyber security: is there another way of looking at this?
Cyber resilience needs more than technical expertise
Technical expertise is fundamental. We need people who understand systems, networks, vulnerabilities, architecture, and emerging technologies. But technical experience alone does not create cyber resilience.
An organization can have sophisticated security controls and still be vulnerable because somebody does not understand a process, an employee responds to social engineering, a board does not grasp the significance of a technical risk, or teams cannot communicate effectively during an incident.
Cyber security also needs communication, psychology, creativity, empathy, critical thinking, and commercial understanding.
We need people who can translate a technical vulnerability into language a board can act upon. We need people who understand how humans behave under pressure. We need creative thinkers because adversaries are creative.
Employers should reflect that in how they define cyber roles. Separate the technical skills genuinely essential on day one from those that can be developed; and give greater weight to transferable skills and potential.
Stop shrinking the resilience talent pool before people apply
The UK Government’s research identifies persistent barriers to improving diversity, including negative stereotypes about the industry and the cost of degrees and technical qualifications.
Cyber security itself can reinforce those barriers through acronyms, certifications, specialist terminology, and highly specific job requirements.
It can send an unintended message: unless you studied the right subject, gained the right certification, or started experimenting with computers at an early age, this industry is not for you.
That matters not only because talented people miss out on cyber careers, but because cyber teams miss out on the experiences and capabilities those people could bring. By defining cyber talent too narrowly, organizations may inadvertently narrow their own capacity to anticipate risk.
There are encouraging signs in the above report. Among cyber businesses that had recruited, 63% said they had hired through non-degree routes and 41% had run talks or events in schools, colleges, or universities to attract more diverse applicants.
Those actions need to become the norm. We should audit job descriptions for unnecessary barriers. Challenge jargon. Make transferable skills visible. Create non-degree entry routes. Engage with schools and communities. Show people the breadth of careers that exist across cyber.
Recruitment alone doesn’t build resilience
Recruitment is only the start. If we recruit different voices but those voices disappear as we move up the organization, we have not solved the problem.
Leaders need to measure progression as seriously as recruitment. Look at who receives stretch opportunities, who has access to mentors and sponsors, whose ideas are heard, and who progresses into positions where security decisions are made.
Organizations need people who feel able to question the prevailing view, raise uncomfortable possibilities, and identify weaknesses before an attacker does. Diversity without an environment in which those differences can be expressed risks leaving the same blind spots in place.
Make Women in Cyber Day a catalyst for greater resilience
The case for action is becoming harder to ignore. The UK cyber sector is growing rapidly, making the question of who builds its future increasingly important. The Government’s Cyber Security Sectoral Analysis 2026 shows that the sector now employs 69,600 people across 2,603 firms and generates £14.7bn in annual revenue – an 11% increase in just one year.
Women in Cyber Day gives us an opportunity to celebrate the women already protecting organizations, infrastructure, and communities. But celebration needs to translate into change.
We need to broaden entry pathways. Remove unnecessary barriers. Invest in mentoring and sponsorship. Create routes into leadership. Engage girls earlier. And measure whether different voices are genuinely being heard. The more varied the thinking around the table, the greater our chance of spotting the assumption, vulnerability, or emerging risk that somebody else has missed.
This Women in Cyber Day, the question should not be how we help more women fit into cyber security. It should be: what is cyber security missing by not having more women there to shape it – and how much more resilient could our organizations become if they were?
The author
Samantha Jennings is head of operations at Avella Security.
