What Brings Women to Cybersecurity?
ACM Reference format:
While the proportion of women in IT education and IT work
is low in Norway similar to most western countries even
fewer women find their way to fields of cybersecurity . This
study aims to identify factors that affect women's entry to IT
disciplines in general and cybersecurity in particular, to build
knowledge for future strategies to recruit more women to these
fields. The study includes structured in-depth interviews with
female students and researchers, 12 in various IT disciplines
and 12 in cybersecurity at universities in Norway . The
research question in this paper is: what makes women decide
to enter fields of cybersecurity?
Notable challenges for increasing women's participation in
fields of IT have been identified within institutional cultures
and structures  and gendered stereotypes  that makes IT
appear as a field for men . A major challenge is youth's lack
of knowledge about IT disciplines, recognized to have a more
negative effect on girls than boys [7, 8]. A strong association of
IT with gaming and programming also makes it more attractive
for boys than for girls [8, 9]. This has given rise to stereotypes
associating IT competence more with men than with women
, making it challenging for women to identify female role
models as well as identifying themselves with fields of IT [8,
11]. Previous studies have found similarities in women's
experiences in cybersecurity and other IT fields, but also
differences : Cybersecurity is recognized with an even
stronger association with "men's jobs" , reflecting its
military roots [12, 14]. Cybersecurity requires a wider set of
expertise including non-technical and creative disciplines [8,
15], suggesting it could attract a varied group, including
women. This first study of women in cybersecurity in a
Norwegian context adds to this literature by analyzing how
women find ways of identifying themselves with this field.
2 Theoretical and Methodological Framework
The study relies on insights from feminist technology
studies emphasizing gender and technology as socially
constructed and co-constructed . Images of IT experts; who
they are and what they do , often involve perceptions of
gender that have more negative effects for women. The study
also relies on the "individual difference theory" 
acknowledging that women are not a uniform group.
Permission to make digital or hard copies of part or all of this work for personal
or classroom use is granted without fee provided that copies are not made or
distributed for profit or commercial advantage and that copies bear this notice
and the full citation on the first page. Copyrights for third-party components of
this work must be honored. For all other uses, contact the owner/author(s).
EICC 2020, November 18, 2020, Rennes, France
© 2020 Copyright held by the owner/author(s).
ACM ISBN 978-1-4503-7599-3/20/11.
EICC 2020, November, 2020, Rennes, France
H. G. Corneliussen
structured interview guide was used,
including questions about what had brought them to their
chosen IT discipline. The analysis is based on the Grounded
Theory Method (GTM) inspired by Charmaz . She describes
GTM as a strategy for seeking data, describing events, and while
exploring the data, answering the question: "What is going on
here?" The he study is
approved by the Norwegian Centre for Research Data.
The analysis confirms that women in cybersecurity do
indeed have many things in common with women in other IT
disciplines. The most challenging is their lack of knowledge
about IT when they are in the transition phase from high school
to higher education. Nearly all the women described their
expectations of IT at university as dominated by men in
stereotypical images of "geeks" and "hooded gamers" who had
started programming early. They did not see themselves fit: "I
had never programmed before in my life". IT is an important
gateway to cybersecurity and the association of IT with
masculine stereotypes is still a major barrier for women.
Another common trait between the two groups was the
women's tendency to avoid competing with the male figures of
"geeks" and "gamers" by emphasizing their own interests as
different from these images. Rather than an interest in IT, their
narratives included other perspectives. The women in
cybersecurity emphasized "controlling the technology" to
"limit its effects"; to take part in decisions defining
"boundaries" for technologies' impact on society.
The women in cybersecurity stood out by identifying this
field as open for a varied set of competences. Thus, the women
recognized their own strengths and expertise from other
disciplines, for instance in arts and social sciences, as relevant.
This was an important door opener for many of them, as they
could define their belonging in cybersecurity based on a "safe
and familiar" platform within disciplines that involved less
Another difference was the women's ability to understand
and associate themselves with the field of cybersecurity. While
even their own IT discipline could be difficult for some of the
female students to define, cybersecurity was not only easier to
describe but the women also saw cybersecurity as a field
concerning "everybody" and everyday life. Thus, different from
how many of the women distanced themselves from core fields
of IT competence that they associated with a stereotypical male
image of IT, they described cybersecurity not only as relevant
for women, but also in need of women.
Comparing the two groups has revealed differences that
can be valuable for future recruitment strategies. The study
shows an unused potential for recruiting women to
cybersecurity by acknowledging a wider set of interests and
competences that motivate women. The study also found IT to
be an important gateway to cybersecurity, suggesting
develop more inclusive images of IT as well as cybersecurity to
increase women's participation in either field.
This study is based on a relatively small number of women
with the aim of exploring perceptions and experiences that
shape women's entries to IT and cybersecurity. The study
cannot be generalized to all women and it would be of great
value to test the findings on a larger group, including men.
The study was funded by Norwegian Center for Science
Recruitment. This publication was developed for Nordwit
funded by Nordforsk.
 EUROSTAT. ICT specialists in employment - Statistics Explained.
 SO. The Norwegian Universities and Colleges Admission Service
(Samordna opptak). https://www.samordnaopptak.no/info/om/sokertall/; 2020.
 Corneliussen HG. "Dette har jeg aldri gjort før, så dette er jeg sikkert
skikkelig flink på" – Rapport om kvinner i IKT og IKT-sikkerhet: VF-rapport
 Frieze C, Quesenberry JL. Cracking the Digital Ceiling: Women in
Computing around the World: Cambridge University Press (2019).
 Master A, Cheryan S, Meltzoff AN. Computing whether she belongs:
Stereotypes undermine girls’ interest and sense of belonging in computer
science. Journal of Educational Psychology;108(3):424 2016.
 Faulkner W. Doing gender in engineering workplace cultures. II. Gender
in/authenticity and the in/visibility paradox. Engineering Studies;1(3):169-89
 Grover S, Pea R, Cooper S, editors. Remedying misperceptions of
computer science among middle school students. Proceedings of the 45th
ACM technical symposium on Computer science education; 2014: ACM.
 Jethwani MM, Memon N, Seo W, Richer A. “I Can Actually Be a Super
Sleuth”: Promising Practices for Engaging Adolescent Girls in Cybersecurity
Education. Journal of Educational Computing Research;55(1):3-25 2016
 Denning P, McGettrick A. Re-centering Computer Science - Position Paper
for ICER06 2006.
 Cheryan S, Master A, Meltzoff AN. Cultural stereotypes as gatekeepers:
increasing girls’ interest in computer science and engineering by diversifying
stereotypes. Frontiers in psychology;6 2015.
 Corneliussen HG, Seddighi G, Dralega CA. Women's Experience of Role
Models in IT: Landmark women, substitutes, and supporters. In: Helgesen Ø,
Nesset E, Mustafa G, Rice P, Glavee-Geo R, editors. Modeller:
Fjordantologien 2019: Universitetsforlaget (2019).
 D'Hondt K. Women in Cybersecurity: Harvard University (2016).
 Peacock D, Irons A. Gender inequality in cybersecurity: Exploring the
gender gap in opportunities and progression. International Journal of Gender,
Science and Technology;9(1):25-44 2017.
 Reed J, Zhong Y, Terwoerds L, Brocaglia J. The 2017 Global Information
Security Workforce Study: Women in Cybersecurity. Frost & Sullivan, Santa
 Shumba R, Ferguson-Boucher K, Sweedyk E, Taylor C, Franklin G, Turner
C, et al., editors. Cybersecurity, women and minorities: findings and
recommendations from a preliminary investigation. Proceedings of the ITiCSE
working group reports conference on Innovation and technology in computer
science education-working group reports; 2013: ACM.
 Cockburn C. The circuit of technology: gender, identity and power. In:
Silverstone R, Hirsch E, editors. Consuming Technologies: Media and
Information in Domestic Spaces. pp. 32-47. London: Routledge (1992).
 Trauth EA, Quesenberry JL. Gender and the information technology
workforce: issues of theory and practice. Managing IT professionals in the
Internet age. pp. 18-36: IGI Global (2007).
 Charmaz K. Constructing grounded theory: A practical guide through
qualitative research. London: Sage Publications Ltd (2006).