Cyber security has a well-documented skills shortage, and a less-documented but equally critical challenge: women remain a small minority of our workforce, and an even smaller minority of its leadership.
The ISC2 Cybersecurity Workforce Study placed the percentage of women working in UK cyber security teams at roughly 17%, trailing other digital sectors. And we know the impact that this narrow representation has on the industry. In 2025, The Lovelace Report found that overlooking women costs the UK tech sector up to £3.5 billion as more women leave or stall mid-career.
Every industry report on the subject raises the same question: how does the sector close its skills gap while drawing from such a narrow pool of talent?
Mentoring is one of the few strategies I’ve seen consistently make a real difference, precisely because it works on the part of the problem that policy can’t reach. Seeing is believing: if every senior figure in the room looks the same, it’s easy to conclude, consciously or not, that leadership isn’t for you. Mentoring puts a real person, with a real story, lived experience and tangible evidence in front of someone trying to work out their own pathway. It shows what’s possible.
While the ISC2 report also showed that access to assigned or structured formal mentorship was noted by 40% of women participants, there’s scope to do so much more. Here’s where we can start.
Patterns of barriers
Having mentored a number of women into and through cyber careers, I see the same barriers come up time and time again. Spoiler: it has nothing to do with talent, ambition or capability.
The first is confidence. Women I mentor are frequently more qualified than they believe themselves to be, and yet, will list every gap in their knowledge before they’ll share what they already know. We know too, that men are often comfortable applying for a role they’re half-ready for, while women wait until they’re 100% ready. Mentoring is key to building confidence, inspiring daily actions in women towards their career goals.
The second is not knowing where to start. Cyber isn’t a single, clearly signposted career path, so from the outside it can feel like a closed door. Mentoring can offer guideposts and a pathway that’s been mapped out for you – should you choose to follow it.
The last – and one, as a sales leader, one I feel particularly passionate about – is the assumption that cyber is purely technical. There are technical specialisms, and they’re brilliant if that’s your skillset, but cyber also needs people who can translate risk into plain English for a board, manage clients and teams, and tell the story of why security matters to people who aren’t engineers. That’s a huge part of what I do day to day, and exactly the kind of work that draws in people with communication and relationship-building strengths – skillsets women have in abundance.
What works in cyber
Mentoring works best when it’s specific. This could be reviewing a CV line by line, rehearsing a specific promotion interview question, or helping to negotiate a pay-rise request. In my experience, confidence follows competence being reflected back at someone, not the other way round.
Sharing my own path openly has mattered too. I didn’t arrive in cyber via a traditional technical route and saying that out loud gives female colleagues the permission to bring their individual backgrounds into the industry – perhaps even celebrating them.
Shifting company cultures
Mentoring can only take an individual so far if the organisation isn’t investing in the same direction. Too many companies – I see this in cyber a lot – talk about representation without putting real infrastructure behind it: structured mentoring, sponsorship that puts women forward for opportunities, platforms for sharing their work, and visibility built into development frameworks.
Visibility is too often treated as something women are expected to figure out for themselves. It should be something organisations actively build: senior leaders being deliberate about who they put in front of a client, who they credit publicly, who they suggest for a panel or promotion. Small, repeated acts of sponsorship do more for representation over time than any diversity statement.
A network of support
Formal mentoring isn’t the only structure that matters. Employee resource groups for women, and internal networks more broadly, create a shared space where a whole community facing familiar challenges can compare notes, share stories, collaborate on solutions.
So much of what holds women back isn’t unique to them individually, it’s a collective experience. ERGs are a valuable source of peer mentoring: colleagues swap advice on negotiating a pay rise or recommend a contact for a stretch project. They give internal advocates a natural home, and with genuine leadership sponsorship behind them, can transform how an organisation behaves as conversations filter into day-to-day culture.
Realistically, not every company has the scale to run a dedicated women’s network. This is where external industry groups come in. Communities like Women in Tech, SheCanCode and the wider ecosystem of women-in-cyber meetups and conferences, can offer the same kind of support, connection and community. Again, it’s about giving women earlier in their career or working somewhere they’re one of very few women in the room, the experience and benefits of genuine peer support and visible role models beyond their own employer. I’d encourage any woman considering cyber, or already in it and feeling isolated, to seek one out.
Building the industry we want
We want to build an industry rich in innovation, talent, and diversity. Every woman I’ve mentored has brought something the industry needed and didn’t know it was missing: a unique perspective shared in a meeting, a client relationship built differently, a risk finally explained in a way that landed with a board.
If we want a genuinely inclusive and supportive industry, mentoring is where it starts. And while many of my peers are eager to mentor younger colleagues, we can’t rely on this alone. Organisations need to match individual effort with structural investment. Do both well, and cyber stops being a career women have to be persuaded into. Rather, it becomes one they walk into, thrive in and lead.
