Being a female role model in the cybersecurity industry

By Samantha Humphries, Head of Security Strategy EMEA, Exabeam

“Beating down the waves of imposter syndrome”

In 2014 I was approached by an event organiser to speak at their ULCC FOTE14 conference. They’d had attendee feedback that there were not enough female speakers at the previous year’s event, so were actively looking to address the balance. I can’t for the life of me remember how they’d found me, given at the time I’d spent the previous 15 years in cybersecurity, and my speaking career had been mostly limited to customer talks and an on-stage interview with Betty Webb, one of the incredible Bletchley Park codebreakers, who recently celebrated her 100^th birthday. I’d done a small amount of press work too, but that was about it.

I was asked to do a keynote speech and be part of an all-female panel, which I agreed to, whilst frantically beating down the giant waves of imposter syndrome and wondering what the hell I would have to say that would be of interest to an audience of educators with an interest in IT.

I chose to speak about ‘Promoting positive role models to bridge the technology gender gap’, a talk that was rooted in some research that my then employer had undertaken, but also included a bit of my journey into technology, who my role models were, and some thoughts on how the audience could become role models for others. I remember feeling utterly terrified when taking to the stage, I’d never spoken in front of so many people before in my life, and I definitely didn’t feel like anything verging on what I thought a role model should be.

Then, when the questions came in, one person made the remark that they didn’t want to be a role model, and why should they have to be just because they’re a woman. Fair point, to be honest, and it’s stayed with me longer than any other memory of the talk.

The other things I recall vividly was how much my feet hurt in heels on that stage, and how tired I felt as I was amid the first trimester of pregnancy carrying my second child. The blur of 1000+ audience members is just that – a blur, and I can’t remember anything much about the panel, other than the fellow panellists were really lovely, and I thought they had more of a right being there than I did as they actually worked in education.

“Rolemodelness is in the eye of the beholder”

Nine years down the line, and I’ve learned a lot about what role models mean to me, and how I think about it. So, whilst the title of this article begins with ‘Being a female role model’, I’ve realised that actually you don’t really get to choose whether you are one or not. Rolemodelness (yes, I did just make that up) for me is definitely in the eye of the beholder. I’ll give you a real world example – and heads up Jenny Radcliffe, I know you’ll cringe a little at this, but it doesn’t make it any less true.

I feel lucky to be able to call Jenny both a friend and a colleague, but also, she is a huge role model of mine. She’s a pioneer of what is now known as Social Engineering, a bestselling author, an international superstar (certainly in the realms of cybersecurity), a regular presenter on This Morning (a UK daytime TV show), AND is working with a Hollywood production team on turning her book into a TV series. Yet whilst these things are sooooo incredibly cool, what makes her a role model to me are her passions for education, learning, and helping others. She genuinely cares about making the world a better and safer place, and she’s using her platform to do this in great swathes, and without ego. And yes, we queue for the same toilets at events, on the odd occasion that there even is a queue. Every time I see something new and awesome that she’s up to, my heart absolutely sings. Jenny is walking, talking, living proof that women can not only succeed in cybersecurity, but can absolutely ace a domain, and therefore people can choose them to be their role model. Sorry but also #notsorry, Jenny, you can stop mini-cringing now, promise.

On the flip side, living in the time of the ‘influencer’ as we are now, I do see some people, women included, try to promote themselves as role models to others whilst pushing a selfish agenda and bad advice to do it purely to be popular. For the ‘likes’ if you will. This obviously isn’t a behaviour that’s specific to cybersecurity by any means, but in this community, which is there to predominantly help other people, I think it’s frankly vile.

One woman once told me that we should be going into high schools and telling teenage girls that they could “learn to hack their ex-boyfriend’s social media accounts” to get them interested in a career in cybersecurity. For the record, I think this is a dreadful take. Rightly or wrongly, it bothers me more when I see women doing it, as so many of us have worked incredibly hard for our seats at the table, and to ensure we give others a helping hand into and within an industry that still is very cis male dominated.

“Diversity comes in many beautiful flavours”

Since the heady days of the aforementioned keynote in London, I’ve gone on to do a lot more speaking engagements around the world, plus help organise cybersecurity community conferences, and had the pleasure of mentoring first-time speakers. My employer, Exabeam, and my fabulous manager, are very supportive of me doing this, and I am thrilled to work for a company that believes wholeheartedly in the benefits of diversity, equity, and inclusion. I’ve spoken on stage and online on a vast array of topics, including but definitely not limited to being a woman in cybersecurity – and I genuinely cannot wait for the day that no-one is interested in hearing about that anymore because it’s finally not a ‘thing’ we need to solve for. I’ve had people tell me they see me as a role model, and (oh hi imposter syndrome) whilst it does also make me cringe a tiny bit too, I am always very grateful that my efforts to help others are being seen as a Good Thing™.

I do sometimes wonder that I’ve got here purely by repeatedly showing up and making the best of opportunities. I don’t think I’ve ever said no to doing a talk provided it’s on a topic I have knowledge on, even if on occasion I’ve had a nagging ‘but am I just a token’ feeling in the back of my mind, but honestly, I don’t even care if that’s true or not. A lot of event organisers are doing a wonderful job of making the effort to truly diversify their speakers line-ups – examples include Digital Transformation Expo Europe (DTX) events and many of the cybersecurity community events, such as BSides<insert city of choice>, and I’m not just talking about toilet queues; diversity clearly comes in many beautiful flavours.

To horrendously misquote Spiderman, with great rolemodelness does come great responsibility. So, if you do decide you want to speak at events, blog, podcast, get involved with running conferences, or put yourself forward as a mentor, it’s a moral imperative that you do this with your heart and eyes fully open. Your actions, words, and deeds will be analysed by many, some of whom will disagree with you or try to bring you down, many more of whom will see you as a role model. For me, hearing the positive feedback is wonderful, but more importantly I love the stories of those who have chosen a career in cybersecurity because they’ve felt represented in a community where minorities are somewhat rife, and that’s what inspires me the most.

“Representation 100% matters”

Being a woman in cybersecurity is certainly not as unusual as it once was when I was getting started, back in the previous millennium. The industry that’s been dominated by (often) white cis men for a long time is finally seeing a huge shift in representation, with cybersecurity experts from different backgrounds taking the spotlight. In fact, if you happen to attend BlackHat MEA, you’ll find that the ratio of male to female cybersecurity professionals attending the event is now at 60:40, which is very significant, given Saudi Arabia wasn’t always so keen for women to have careers, or even drive themselves to an event.

Ultimately representation 100% matters, and that’s where I think showing up really comes into play. You don’t necessarily need to take to the stage, vlog, or build a huge following on whichever social media platform we decide we like today, unless of course you want to. Attending events (including virtual events), joining communities, being present and interested, making connections, asking questions, and sharing your experiences in person or online will all help inspire people, and help you in the process. Certainly, no-one’s forcing anyone to go out there and somehow be a role model, and as I said before I don’t think you can really choose to be one anyway.