Celebrating Women in Cybersecurity
In honor of International Women's Day, two leading female voices in cybersecurity share their experiences working in the field.
*Correction: A previous version of this post shared on March 8, 2023 incorrectly spelled Enveil. It has been updated below.
In 2017, I first wrote about the lack of female representation in cybersecurity.
To follow that up, in 2020 I conducted an informal study to understand the percentage of women holding C-level positions at cybersecurity companies. The finding was that 5.07% of cybersecurity companies were led by women. I found this woefully inadequate and decided to reach out to a small number of female cybersecurity startup founders and leaders. Together, we wrote an article exploring the state of the industry and how cybersecurity practitioners and leaders could encourage more female inclusion.
Today, I revisit the topic with two leading voices in security.
When I first entered cybersecurity (as opposed to the more general “tech industry”) in 2009, I had no idea what an anomaly that was. I had been working in sales my whole career and was used to being in the gender minority. Mostly I blocked it out. Occasionally I let rude comments slide. But it was my job so I forged on.
As I became more entrenched in the industry and moved into a position in which I could hire speakers, writers, and collaborators, it became painfully obvious that there was a terrible imbalance. Among the pool of approximately 40-50 smart and talented people I could hire, there were two females. One of them was inactive. By the time I left that role in 2013, there were a few more women cybersecurity experts I was hiring regularly, but the percentage hovered at around 10%.
That’s no coincidence; in 2013, only 10% of the industry was female. When I wrote my “Where Are All My Ladies…” post in 2017, the number of women holding security positions had crept up one percentage point. One.
By 2020, according to my research and generally available research, estimates were between 20% and 25%.
Surely the industry has made progress in its efforts toward diversity and inclusion between 2020 and now. Heck, there are now formal diversity, equity, and inclusion (DE&I) initiatives at many organizations. “Chief Diversity Officer” is even a recognized job title today.
So why do the numbers remain stagnant? Searching for demographic information today reveals that the cyber industry remains stagnant, with only 25% of cybersecurity jobs staffed by women. This is despite the fact that the latest Bureau of Labor Statistics report shows that women make up 57.4% of the workforce in the US. Globally, women hold just under 47% of jobs.
The world did have a tumultuous few years since my last accounting. Perhaps that was a contributing factor. Nonetheless, we’ve got a lot of work to do as a cybersecurity community to make good on our promises to improve female representation in the field.1
There are numerous ways we can go about welcoming more women into the industry. Education, mentorship, easier/free access to tools, dedicated programs (e.g., Girls Who Code, The Girl Scouts of America), and much more are cited frequently. One of the easiest and most effective ways to start, though, is by highlighting women who have not only succeeded at working in security, but where they’ve thrived, when they’ve carved out paths for themselves and others, and how they’ve overcome adversity.
Two groundbreaking women shared their thoughts with me on why they love cybersecurity and what we can do, collectively, to promote more female representation. They are: Dr. Ellison Anne Williams, Founder and CEO of Enveil, and Dr. Inka Karppinen, Lead Behavioral Scientist at Cybsafe. And, oh! Did you notice that the leadership teams of all these companies include higher than average female representation? No coincidence there.
Why Cyber?
Williams and Karppinen started their careers in cybersecurity under very different conditions. Williams earned masters’ degrees in mathematics and computer science, and a PhD in mathematics. After her formal education, she knew she wanted to be an entrepreneur, but ultimately chose to begin her career in the intelligence community. After about a decade of experience, she knew she had the skills and drive to build a startup and, more generally, help pioneer solutions in the area of privacy enhancing technologies.
To do so, Williams had to block out extraneous “noise” from external entities that may not have wanted her to succeed. From the start, and to this day, she focuses on her mission: enabling critical business functions in a way that prioritizes the security and privacy of companies’ most sensitive data assets.
Karppinen’s path was very different. She earned her undergraduate and master’s degrees in psychology. Following graduate school, Karppinen found her way to University College of London (UCL) and the Security and Crime Science department where she obtained her PhD. Understanding human behavior and its effects on crime were fascinating to her, and she felt there was so much to explore: Why do employees not follow security processes and procedures? What are the drivers of human behavior? How can we protect people better, without fear and doubt? These questions, and more, drove her to want to find counter solutions to attacker behavior.
Challenges facing women in security
Over the course of my career in security, there haven’t been many women working in the industry that have dwelled on adversity. Behind the scenes, and if pushed, women will acknowledge that they have, at times, been dismissed and not taken as seriously as men. They have told me that they have felt they had to work harder and attain more knowledge to achieve similar success. They have also privately admitted that they’ve been passed over for promotions, or had to fight harder to get what they deserve.
But in public, it’s no surprise that most enterprising women in security say they try to block out less-than-welcoming people and negative attitudes. This is not to say that these women ignore discrimination or harassment. Most certainly not. But the challenge of being “the only woman in the room” is just something that comes with the territory. And successful women adjust.
For Karppinen, she said she finds it easier to explain herself as a social scientist in security than to say she works in security. She says it’s “Where the soft science meets the hard science.” It is a little hard to believe that, in 2023, women still have to explain themselves in this way. But as a behavioral scientist, Karppinen smiled when she told me, “It is interesting to watch how people react to me, in particular when there is a culture difference. It’s tough to navigate being an expert and being strong willed with getting things done and not being perceived negatively.” She seems to find this amusing rather than challenging.
For Williams, she explained, “I’ve spent my adult life working in male-dominated fields. And while some might consider that position challenging, I am typically too busy pushing forward to notice. I’m proud to be a tech leader, not just a ‘woman in tech’ and when I mentor other women pursuing technical fields, my message is simple: pursue substantive, meaningful work and don’t spend time worrying about the faces around you.”
Slow but steady progress
In the three years since I last published on women in security, the world changed substantively. The pandemic forced entirely new working conditions, which offered both challenges and opportunities for working women.
At Enveil, William describes her company as “being built on math and grit,” meaning, her personal attitude is “have the willingness to persevere despite setbacks.” She advises her team to prioritize people and embrace flexibility, which she sees as an advantage for all team members, not just women.
Not surprisingly, due to her area of expertise, Karppinen said the work-from-home situation “made it hard to read people” and took away the interpersonal connections that are so important to her. However, she also feels that the pandemic was “The Great Equalizer,” of sorts, as it put both men and women in the same situations, where working mothers and fathers had to deal with home and family pressures equally. As a result, she said she now sees more empathy in the workplace. “The pandemic forced men to see and step up in a more equal way. Societal pressures and responsibilities have changed over the decades, and it has helped,” she said.
An approach to success
One thing every woman working in a male-dominated field has to accept is that they will have to speak up, often, and without hesitation. They have to accept that not everyone will like what they have to say…and then learn to brush it off.
Both Karppinen and Williams say it is extremely important for women and under-represented groups to focus on substance and meaningful contributions. They both say it takes courage, but that women should find their confidence and rely on the knowledge and skills they’ve acquired. To be successful, women must believe in their own ability to make a positive difference through their contributions.
In a past interview, Williams talked to me about the positive impact of mentorship on her career. Finding a mentor and/or an advocate—or even someone outside the industry to vent to and work through things with—can be a great tool to help push aside any noise or fears.
Karppinen talked to me about how important it has been to have advocated for not only herself, but for female colleagues. In a world that still accepts—even if it’s to a much lesser degree—some forms of discrimination, it’s crucial to be a voice for someone who isn’t ready to, or feels they can’t, speak for themselves when put in an unwelcoming position. Karppinen also shares that “experience and age have helped [her] feel more confident and able to counter poor behavior toward women.” In her situation, it was also a benefit that the company she works for hired a female COO early on. At Enveil, it’s likely that other women have flocked to the company and learned empowerment from Williams’ example.
What does the future hold?
When I asked Williams and Karppinen for advice they could give to women or girls interested in exploring the field, their verbatim answers were more impressive than my paraphrasing could ever be.
Williams: “My advice to anyone with aspirations in tech is to just go for it. Don’t let fear or any other assumptions hold you back—find meaningful work that you’re interested in and pursue it. Don’t be afraid to ask for help from people who are walking a similar path. I’m blessed to have been surrounded by a number of fantastic mentors and colleagues who have helped me achieve more than I could have on my own.
“I like to ensure I’m never so focused on my own lane that I lose perspective on bigger picture tech trends and market opportunities, so I tend to consume a wide cross-section of research and media. I also particularly enjoy outlets focused on founder stories and leadership—Harvard Business Review and First Round Review are a few of my favorites.”
Karppinen: “Whether you have a technical or non-technical background, if you are interested in helping people or applying your skills to the cybersecurity field, all kinds of skills have space in security. We need all types of backgrounds, expertise, and experiences if we want the industry to move forward with the times. Cyber criminals are a diverse group of people—not just your hoodie-wearing ‘scary’ guy behind the computer screen—so let’s also have diversity in the workforce that aims to protect people.
“You can come from anywhere, any background, and work in tech. Explore degree programs or free courses online. There are plenty of opportunities, especially in psychology because attackers are going to keep on attacking—and they’re human! It’s not all about coding.
“Women are not going to give up just because we’re in the minority. We are here to stay, and we’ll show the world that we are strong and capable.”
N.B. This post is written in celebration of International Women’s Day and in no way implies that the only diversity changes required, in cybersecurity or the business world at large, are those that involve women.