Women in Cybersecurity Face Unequal Access, Pay and Recognition

Women in cybersecurity report twice as much workplace exclusion as men, according to a 2023 study by Women in CyberSecurity (WiCyS). The findings point to problems that reach beyond representation: women describe unequal access to projects and training, lower pay, overlooked contributions and barriers to promotion. For employers, these patterns can affect productivity, hiring costs and the ability to attract skilled people.

Interviews with women working across the field show how those barriers play out day to day. Monique Becenti, product director at Zimperium, said gender stereotypes early in her nearly eight years in cybersecurity led colleagues to underestimate or overlook her. She also described work being undervalued and disrespectful behavior in public settings.

Poornima DeBolle, co-founder and chief product officer at Menlo Security, described a recurring dynamic in customer and partner meetings: people direct questions to her male teammates, even when she is the relevant person to answer. Her colleagues have learned to redirect those questions to her.

These accounts are individual experiences, but the WiCyS report offers a broader measure of the problem. Released April 10, 2024, and developed with Aleria, the report set out to examine why inclusion gaps persist and what organizations might change. Earlier work had documented women’s low representation in cybersecurity; this study focused on employees’ experiences inside the workplace.

What the WiCyS benchmark found

The report found that women experience exclusion at twice the rate of men. Women were also five times more likely to identify their direct managers and peers as interfering with their workplace satisfaction and ability to perform at their best.

Reported experiences included barriers to advancement, inadequate compensation, being passed over for promotions and having skills left unused. The study also considered disability and the ways overlapping aspects of a person’s identity can shape workplace experiences.

WiCyS Executive Director Lynn Dohm said respect was the category with the highest exclusion index. She described the gap between respect and other categories as unusually sharp for cybersecurity, a technical field where respect-related concerns often rank highly.

That finding helps explain why general statements about inclusion may not reflect employees’ everyday experiences. The report points to the role of managers and leaders: respondents described insensitive public remarks, leaders modeling behavior that others then treated as acceptable, and statements about inclusion that were not matched by action.

Dohm said complaints about how inclusion initiatives were designed or carried out came from both majority and underrepresented groups. Respondents often identified leadership as a source of those problems. That suggests an initiative’s name or stated purpose tells employers little about whether it changes behavior; employees need to see the effects in how teams work and opportunities are distributed.

Access and advancement remain uneven

DeBolle said she has had to make a case for each step in her career over more than 25 years in cybersecurity. She would lay out her accomplishments and prepare a multi-year plan for a new role, yet still sometimes miss out on advancement. She said she had not seen male colleagues need to manage their careers with the same degree of deliberate effort.

Her experience echoes the WiCyS findings on promotion barriers and underused skills. Dohm said women may not receive the same access as peers to special training, higher-profile projects or better clients. She also noted that women can receive less positive evaluations despite doing as much work, or more.

These patterns matter because access to visible work and development opportunities can shape later evaluations and promotion decisions. If employees must repeatedly make a case for opportunities that others receive routinely, the burden of managing an organization’s uneven practices falls on the people affected by them.

Pay data offers another view of the gap. An ISC2 report on U.S. cybersecurity professionals found that women in nonmanagerial and mid-advanced roles earned an average of $131,000, compared with $138,000 for men—a 5% difference. Women managers averaged $138,000, while men in comparable roles averaged $150,000, a 9% gap. Women at C-suite and executive levels earned 4% less than men in the same roles.

Those figures describe reported pay differences; on their own, they do not explain why the differences exist. The WiCyS findings add workplace context by identifying respect, access and advancement as recurring concerns.

Training needs accountability

Organizations often turn to diversity training when they want to address workplace bias, but the evidence cited in the source article is mixed. A Boston University researchers’ review of workplace diversity and antiracism training research from 2000 through 2022 found that few programs robustly measured their impact. The review also identified limitations in many studies, including one-off training, small participant groups and a lack of control groups.

A separate 2024 report from the Aristotle Foundation for Public Policy argued that diversity training can be divisive and counterproductive. That conclusion differs from the case made by several cybersecurity leaders interviewed here, who support bias education while also emphasizing that training alone cannot fix workplace structures.

Theresa Payton, chief executive of Fortalice Solutions and the first woman to serve as chief information officer for the Executive Office of the U.S. President, called for training that helps leaders recognize and challenge unconscious bias. She also pointed to mentorship and sponsorship as ways to help underrepresented employees navigate career growth.

For advancement processes, Payton recommended transparent hiring and promotion criteria so employees have fair opportunities to progress. DeBolle likewise called for anti-bias training and greater participation by women in workplace discussions. In her view, managers can make better decisions by seeking women’s feedback and building a culture where they are heard.

Kate Terrell, chief human resources officer at Menlo Security, suggested practical interventions in meetings. Colleagues can speak up when a woman is talked over or when an idea goes unrecognized until a male colleague repeats it. Redirecting attention to the person who first raised the idea is a small step, but it can address a familiar form of exclusion in the moment.

Measure what changes

Chaitra Vedullapalli, co-founder and president of Women in Cloud, described two sources of exclusion: workplace structures and culture, and gaps in preparation that can affect whether people feel ready to take part. Her proposed response addresses both.

On preparation, she recommended skills and confidence-building programs, including certification-based development tailored to women and other underrepresented groups. These programs should connect training to challenges the organization actually needs to solve and help participants prepare for career progression.

On workplace culture, Vedullapalli said change needs commitment from senior leaders, supported by clear measures and accountability for pay equity, harassment and racial bias. She also called for internal networks that provide mentorship, guidance and advocacy, including for women and people with disabilities.

Payton recommended tracking who appears on interview candidate lists and how women and people with disabilities are represented across roles and leadership positions. She also urged employers to recruit proactively, rather than assuming qualified applicants will find open roles on their own. Surveys and feedback can provide a view of employees’ experiences; monitoring mentorship and training programs can show whether those efforts are having an effect.

WiCyS’s Dohm advised organizations to conduct their own assessment of workplace inclusion. A company-wide average can conceal the experiences of particular teams or groups, while an assessment can help identify where employees see barriers and where changes may be needed.

Measurement is useful only if leaders act on what it shows. Tracking representation, pay, promotion and access to development can give employers a clearer picture of disparities; employee feedback can help explain them. Together, those measures offer a stronger basis for change than training attendance or public commitments alone.

Why exclusion has business costs

Dohm linked lower inclusion to lower productivity and higher rehiring costs, describing the consequences as a material financial impact. She also cited reputational harm, difficulty attracting talent and challenges reaching broader markets.

Callie Guenther, senior manager of cyber threat research at Critical Start, said that working in a predominantly male environment can leave women feeling isolated and underrepresented. When bias leads colleagues to overlook or undervalue women’s contributions, the problem compounds: employees may have less access to opportunities and less recognition for the work they do.

Guenther recommended finding mentors and allies who can offer support and guidance. She also pointed to building professional credibility through speaking engagements, publications and active participation in cybersecurity communities, alongside continuing education and certifications. These can help an individual demonstrate expertise, though they do not replace employers’ responsibility to provide fair access and recognition.

Vedullapalli argued that excluding skilled professionals deprives companies of perspectives that can strengthen problem-solving. Her broader point is practical: employers facing ongoing demand for cybersecurity skills should examine whether their hiring and advancement practices make it harder for qualified people to contribute.

Early barriers and the next steps

The source article also connects workplace inclusion to earlier experiences with technology. It says that girls’ exposure to cybersecurity in high school may center on cyberbullying, account compromise and identity risks, rather than opportunities to build technical skills. Such experiences can reinforce fear and leave students less confident about pursuing technical work.

The industry’s challenge, then, starts before recruitment. But workplace practices remain a direct area for employers to address: set clear criteria for hiring and promotion, review pay and access to valuable assignments, listen to employees’ accounts, and check whether mentorship and skills programs lead to meaningful opportunities.

The most consistent message from the WiCyS findings and the women interviewed is that inclusion can’t be judged by stated intentions. It shows up in who gets heard, who receives challenging work, who is paid fairly and who can advance. Leaders can start by measuring those outcomes and acting on what employees say needs to change.

According to the 2023 ISC2 Cybersecurity Workforce Study, women under 30 made up 26% of the cybersecurity workforce. The share was 22% among those aged 30 to 39, 14% in each of the 39-to-49 and 50-to-59 age groups, and 13% among people aged 60 and older.

Cybersecurity can be a career for anyone with the interest, education and skills required for a particular role. Wider participation can bring varied perspectives to technical work and help address the field’s talent needs. The practical test for employers is whether people with those skills receive fair access to the work, recognition and advancement that allow them to contribute.