March 15, 2017 By Heather Ricciuto 4 min read

The skills gap we face in the cybersecurity profession has been well-documented for the past several years. In 2015, Frost and Sullivan estimated that 1.5 million positions will be open and unfilled by 2020 and that women make up only 10 percent of the cyber workforce. In other words, not only do we have a skills gap, we have a serious gender gap.

Raising the Profile of Women in Cybersecurity

Hot on the heels of International Women’s Day, the Center for Cybersecurity Safety and Education just released the 2017 Global Information Security Workforce Study (GISWS): Women in Cybersecurity. Although participation in the 2017 GISWS increased by 40.9 percent, the report confirmed that representation of women in the cybersecurity workforce remains stagnant at 11 percent. Essentially, no progress has been made over the past two years, despite efforts by industry, government and academic agencies.

With women representing roughly 50 percent of the world’s population and half of U.S. college graduates, according to the National Center for Education Statistics, why is it that only 11 percent of the cybersecurity workforce are women? Is it due to differences in educational background, the inability of women to advance in the profession, discrimination, a feeling of inadequacy or a simple lack of awareness related to career opportunities in the field?


The study indicated that women enter the cybersecurity profession with higher education levels than men. Fifty-one percent of women in the profession have a master’s degree or higher, compared to 45 percent of men. However, men hold a greater percentage of technical degrees, be it in computer and information sciences or in engineering and engineering technologies.

Having said that, a closer look at the millennial population by the Center of Cyber Safety and Education revealed that a shift is underway. In fact, 52 percent of women under the age of 29 have an undergraduate degree in computer science. It will be interesting to watch the impact this shift has on the balance of women versus men in the cybersecurity workforce, particularly in the upper ranks.

Women’s Advancement

According to the study, men dominate senior roles in the cybersecurity profession. Globally, men are four times more likely to hold C-level and executive management positions. Women disproportionately occupy entry-level and nonmanagerial positions. If you are a woman who places high priority on career advancement, statistics like these are certainly not going to attract you to this profession, unless you are ready to put you game face on and be a change-maker.


Does discrimination contribute to the lack of women in cybersecurity? For the first time, the GISWS asked male and female participants in North America and Latin America questions about diversity and inclusion. Unfortunately, 51 percent of women in those regions indicated that they have experienced multiple forms of discrimination.

Topping the list of challenges respondents faced were unconscious discrimination such as stereotyping and unexplained denial or delay of career advancement. Interestingly, Canada and Mexico reported the lowest percentage of discrimination.

When asked about their impact on the security posture of the organization, 28 percent of women indicated that their opinions are not valued. Not surprisingly, women who did report feeling valued in their positions were more likely to indicate greater access to training, mentoring and sponsorship.


As leader of academic programs and outreach for IBM Security, I spend a significant amount of time talking to students from middle to graduate school. I am always amazed by how little students know about the opportunities to be found in the world of cybersecurity.

While roles like security analysts and researchers are in high demand, the cybersecurity field boasts a complete ecosystem of positions, from human resource professionals to lawyers, policymakers, designers, business strategists and product developers. No matter what your interests are, there is a good chance you can find a fit in cybersecurity.

The next generation’s security workforce will require a broad set of skills to fill roles such as product designers, risk consultants and policymakers. We need a diverse set of backgrounds and talents to build the cybersecurity workforce of the future.

A 2013 London Business School study revealed that teams with equal numbers of men and women are more likely to experiment, be creative and share knowledge. The security industry needs the best and brightest talent available, and that requires attracting more women to the field.

Changing the Balance

There is plenty of work ahead of us if we are to change the balance of men and women in cybersecurity. Here are just a few of the steps we can take together:

  • Attract more women. Attracting more women to the profession has the potential to shrink the workforce gap, but only if women can be hired, trained and retained in significant numbers.
  • Break down barriers. Train all employees on unconscious bias.
  • Build awareness. In a 2015 ISACA study, 77 percent of young women stated that neither a high school teacher nor guidance counselor ever mentioned cybersecurity as a career option. Clearly, K-12 outreach is key to changing this statistic and growing the pipeline of women entering the cybersecurity workforce. Programs such as #IBMCyberDay4Girls, GenCyber and Girls Who Code can make all the difference. Reaching girls at a young age to get them informed and interested in cybersecurity careers is one key way we can help reduce the gender gap in the industry.
  • Collaborate. Enterprises, academia and government need to work together. No single entity has the manpower to solve this problem alone. Collaboration is key — security leaders need to take an active role in working with educators to drive awareness and training for the next generation of security professionals.
  • Develop. Ongoing development, as well as access to mentors and sponsors, is critical to attracting, developing and retaining women in the cybersecurity workforce.

Organizations must take significant actions to attract, develop and retain women, otherwise the global cybersecurity workforce gap will continue to grow. IBM is committed to reducing the cybersecurity skills gap and drawing more women to cybersecurity through:

  • Partnerships with universities and initiatives to provide IBM security tools to train the next generation of security professionals;
  • Programs to attract women and millennials to the workforce;
  • IBM Security’s Women in Security Excelling (WISE) program, which encourages women to embrace security within the company and has more than 800 members worldwide; and
  • Continued support of diversity initiatives.

IBM is proud to sponsor the Women in Cyber Security Conference again in 2017. WiCyS 2017, which runs from March 30 to April 1 in Tucson, Arizona, will bring over 800 women together from around the globe to network and learn more about career opportunities in cybersecurity.

Read the 2017 Global Information Security Workforce Study: Women in Cybersecurity

More from CISO

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Boardroom cyber expertise comes under scrutiny

3 min read - Why are companies concerned about cybersecurity? Some of the main drivers are data protection, compliance, risk management and ensuring business continuity. None of these are minor issues. Then why do board members frequently keep their distance when it comes to cyber concerns?A report released last year showed that just 5% of CISOs reported directly to the CEO. This was actually down from 8% in 2022 and 11% in 2021. But even if board members don’t want to get too close…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today