• Rebecca Shalom , Partner |
6 min read

Diversity and inclusion have been rising significantly up the corporate agenda in recent years, and rightly so. There is widespread recognition that having diverse and inclusive workplaces creates better and more productive teams. It is also simply the right thing to do – the moral case is clear. The business case is also evident, numerous studies  show that high levels of diversity and inclusion create better business outcomes.

That being so, what is the picture in the cyber security industry? The sector is a significant employer in its own right, meaning that having diverse and inclusive workplaces affects many thousands of people. What’s more, with ever-growing demand for cyber security experts and well-publicised skills shortages, attracting a wider range of talent into the industry has become critically important.

In 2020, the National Cyber Security Centre (NCSC) and KPMG were proud to publish a comprehensive study of diversity and inclusion in the sector. This inaugural report formed the baseline against which to measure progress over the coming years. So the publication of the second year’s research – Decrypting Diversity 2021  - which was released towards the end of last year, is a significant measure of what progress had been made in the subsequent 12 months.

Diversity: above average, further to go

So, what did last year’s research find? Firstly, on the diversity of the workforce itself, the research showed that in many respects the cyber security industry is performing reasonably well – although there is certainly further to go. Over a third of the sector is female, which is better than some related industries even if it leaves plenty of scope for improvement. One in ten survey respondents were lesbian, gay or bisexual (LGB) – significantly higher than the 2 percent estimate for the UK population as a whole. Ethnic minority representation in the sector (15 percent) was roughly equivalent to the proportion of the national population.

For 2021 year, the study also asked about two important new characteristics – disability and neurodivergence (which includes a wide range of conditions such as dyslexia, autism and Aspergers Syndrome). And the cyber sector has higher than average proportions of both – with 25 percent of respondents identifying as having a disability (compared to around 20 percent of the working population) and 19 percent identifying as neurodivergent (nearly double the 10 percent estimate for the population at large). We wanted to seek more detail on what impacts people’s experiences at work, this creates a more rounded and complete picture.

In some senses, then, there is reason to be encouraged: the cyber industry appears to be more diverse than many others. However, the really crucial question is whether there is an inclusive culture that enables individuals to be themselves at work and to progress fairly according to their abilities and achievements – without this, diversity is effectively meaningless.

Inclusion: a lot more to do

The results here are mixed and show that there is much more to be done. Seven in ten respondents felt able to be themselves at work – that sounds quite good, until you realise that one in five people working in cyber don’t feel confident to be themselves. Then there is the fact that a similar proportion – 22 percent - of respondents said they have experienced some form of discrimination based on diversity in the last year. This is an increase from 2020, when the figure was 16 percent.

There has also been a concerning rise in the percentage of people who said they have experienced a career barrier due to a diversity and inclusion issue – from 14 percent in 2020 to 25 percent in 2021. It is sobering to think that fully a quarter of the industry has experienced a blockage on the basis of their personal characteristics.

Perhaps unsurprisingly in the light of this, individuals with confidence in their organisation’s response to inappropriate behaviour or incidents had also fallen, from 88 percent to 81 percent. This still tells us that organisations are not doing enough to act when required. It can take a lot of courage for someone to speak up about inappropriate behaviour at work, but there are very mixed and disappointing results on the ability of organisations to deal compassionately and effectively with complaints. 

Concerning variations in experience

These findings give real pause for thought. But even more so when you look at the significant variations that exist between groups. It is still the case that minority groups experience much higher levels of discrimination and barriers than others. As an example, 37 percent of neurodivergent individuals, 36 percent of those with a disability, 40 percent of Black professionals and 30 percent of Asian colleagues had experienced a career barrier in the last year – compared to only 24 percent of White respondents. So, what does this mean? It tells us that minorities in every area of diversity and what they experience as discrimination is very different from the experiences of the majority. Many people will have multiple forms of discrimination, so we have to take caution in how we understand or anticipate people’s experiences. The real positive is there had been a significant drop in race-related incidents and for this positive trend to continue, there needs to be focus and constant work to ensure it remains as such.

Meanwhile, 19 percent of women experienced a gender-based incident compared to only 1 percent of men; while 14 percent of gay and lesbian respondents suffered an incident related to sexual orientation, compared to just 1 percent of heterosexuals.

The issues are undoubtedly even more pronounced for those with more than one minority characteristic. For example, negative incidents suffered in relation to ethnicity were higher amongst women than men. These intersections are an area that we want to delve into more deeply in future years’ reports.

Recommendations and the path ahead

In short, while much good work is being done, the industry has to do better. The report sets out six key recommendations, ranging from collaboration and senior leadership accountability to effective use of data and learning from best practice.

Making real headway is a long-term issue rather than a quick fix. Nevertheless, action is needed now – and we can all play a part. In this vein, the panel discussion at the report’s launch threw up a couple of points that really struck me. Firstly, there was talk of the need for ‘cultural humility’ – we should all recognise that we have cultural blind spots and have more to learn. We need to make space for others and keep trying to improve our understanding.

Secondly, there was discussion of the concept of ‘othering’ – the way in which sometimes the majority makes the minority feel like they are separate or ‘other’. We all need to build a deeper understanding of others’ lived experiences to create truly inclusive environments.

Another panellist made the perceptive point that small things make a big difference. We can all find ways to support, acknowledge and respect each other each and every day. Cumulatively, this has an effect within the prevailing culture.

I hope everyone who reads the report will find it useful and illuminating.

If you have any queries about the research, the team would be delighted to help – simply email us here