Abstract
Cybersecurity is a critical shield in today’s hyper-connected world protecting networks, systems, and data from increasingly sophisticated attacks. The need for innovative solutions to cyber defense is now more urgent than ever. However, the industry faces a substantial skills and workforce gap as the supply of cybersecurity workers cannot keep pace with growing demand. The global workforce gap increased by over 25% from 2021 to 2022, and nearly 70% of cyber professionals say their organization has a worker shortage. 1 One potential solution to this escalating crisis: recruiting a more diverse population of neurodiverse individuals and advocating for inclusive hiring practices to better support this group. According to MITRE’s pilot program, the inclusion of neurodiverse individuals in cybersecurity roles not only addresses the skills gap but also enhances problem-solving and innovation within the field. 2
The term “neurodivergent” refers to people with cognitive differences such as autism spectrum disorder (ASD), attention-deficit/hyperactivity disorder (ADHD), and dyslexia. 3 In comparison, people who have brains that function in conventional ways are called “neurotypical.” Neurodiverse individuals possess unique abilities that are highly advantageous in cybersecurity roles, including problem-solving abilities, pattern recognition, and attention to detail. These individuals think differently because their brains do not work the same as the average neurotypical person—a trait which can lend itself to an innate ability to draw new connections that others may not see. RAND reported that in public and private discussions, officials and experts have addressed the need for neurodiversity in the cybersecurity community because some missions are too important and too difficult to be left to people who think in typical ways. 3 Furthermore, neurodiverse employees at JP Morgan Chase have demonstrated significantly higher productivity, with some being 90–140% more productive than their neurotypical peers. 4
The potential contribution of the neurodiverse population to cyber defense is substantial—but they remain largely untapped and insufficiently supported in the workforce. Neurodivergent people face social and professional stigmas that may impede their ability or willingness to advocate for their needs. Moreover, traditional hiring practices and working habits favor neurotypical workers, which can prevent neurodiverse hires from thriving in their roles. Programs like MITRE’s pilot with federal agencies have shown promising results by providing tailored training and support for neurodiverse hires. 2 Building a neuroinclusive workplace involves reimagining job descriptions, hiring processes, and workplace accommodations to support neurodiverse individuals effectively. 5
The cybersecurity sector is grappling with a sizable shortage of skilled professionals. In addition to pervasive burnout and long hours, traditional cybersecurity education and hiring practices have not kept pace with the evolving and increasingly complex cyber threats. 6 Forecasts suggest that by 2025, a lack of talent will be responsible for more than half of all significant cyber-attacks. 7 Additionally, an overwhelming majority (86%) of business leaders believe a significant cyber incident is likely over the next 2 years—but 34% lack the necessary skills to prevent it with their current security systems. 8 This deficit leaves organizations vulnerable to increasingly complex attacks, highlighting the need for innovative solutions and diverse skill sets to bolster defenses. Bringing more neurodiverse individuals into the workforce not only addresses the pressing skill gap but also enhances the quality and creativity of cybersecurity solutions.
Neurodiverse individuals often possess exceptional cognitive abilities that are particularly valuable in cybersecurity roles where the abilities to detect anomalies, manage repetitive tasks, and analyze complex patterns are crucial. For instance, individuals with ASD frequently excel in tasks requiring high precision and focus, such as in software quality assurance and threat analysis. 9 A landmark study found that autistic individuals are up to 40% faster at some forms of problem-solving than non-autistics and have higher levels of visual processing capacity and faster processing times. 10 Neurodiverse employees often approach challenges differently, providing new insights and solutions that may not be apparent to neurotypical colleagues. This ability to think differently is crucial in outmaneuvering cybercriminals and detecting cyber threats that others may overlook. 11 This group’s strengths in focus and precision can lead to increased productivity and reduced errors in cybersecurity operations, particularly in roles involving continuous monitoring and quality assurance, ensuring that security measures remain robust and effective. 6
Supporting Neurodiverse Individuals in the Workplace
Recruiting and retaining neurodiverse workers requires a shift in both hiring practices and workplace culture. Currently, the employment rate of autistic people is only 15% in comparison to the 54% employment rate of people with other types of disabilities. 12 This gap suggests that neurodivergent people are lacking sufficient advocacy in the workplace. Several programs have demonstrated the successful integration of neurodiverse talent into cybersecurity roles. The DXC Dandelion Program in Australia has effectively employed individuals with autism in various IT and cybersecurity positions with a 92% retention rate, showing that with the right support, neurodiverse individuals can significantly contribute to the field. 6 These programs often include tailored support measures such as performance-based interview processes rather than questions based on soft skills, flexible work environments, clear and structured tasks, and accommodations for sensory sensitivities. Additionally, creating a neuroinclusive workplace involves comprehensive planning and design, individualized roles, continuous coaching and development, and effective management and measurement. Providing clear communication, flexible schedules, and sensory accommodations can help neurodiverse employees thrive. 13
Geoffrey Tandy’s role in WWII exemplifies how diverse talents can contribute to critical fields. Although a botanist by training, Tandy’s expertise proved invaluable in cryptanalysis, demonstrating that diverse skills and perspectives can lead to innovative solutions in cybersecurity as well. Modern intelligence agencies like GCHQ actively recruit neurodiverse individuals, recognizing their unique cognitive strengths such as enhanced visual perception, which are crucial for interpreting complex data. 14
These considerations are important because neurodiverse individuals often face barriers during the hiring process. Traditional interviews and job descriptions, which emphasize social and behavioral norms over technical competencies, can disadvantage candidates who communicate or interact differently than their neurotypical colleagues. 11 For instance, some neurodiverse individuals may struggle with eye contact or voice regulation, which interviewers might interpret negatively. To overcome these barriers, organizations should adopt skill-based assessments for cybersecurity roles and write clear, straightforward job descriptions that focus on the technical requirements of the job. For example, job descriptions that use high-level language instead of specific descriptions can be discouraging for neurodiverse individuals. RAND notes that a traditional job description for a cyber operations analyst may include something like “Prepares oral and written correspondence and other documentation,” which fails to actually explain what the individual will do. A more effective way to phrase this would be “Explains ongoing cyber operations to military leaders who do not have cyber expertise. Explains the significance of new cyber threats in terms of how previously unknown vulnerabilities are being exploited by adversaries. Documents results for use by future analysts.” 3 While this level of detail may require more work for the hiring manager and recruiter upfront, it will pay dividends down the line by more clearly presenting the tasks required for the role for neurodiverse candidates. To help in this effort, the U.S. federal government has released the Neurodiversity@Work Playbook Federal Edition in order to create opportunities for individuals with autism and other neurodivergent conditions. And the Department of Labor and Department of Commerce have resources to help businesses recruit, hire and retain neurodivergent workers. 6
Once hired, neurodiverse individuals may face challenges in workplaces not designed to accommodate their needs. Issues such as sensory overload, rigid schedules, and unclear instructions can hinder their performance. 9 Without proper support, employees may hide (also known as “masking”) their neurodivergence at the workplace to avoid any negative professional and social stigmas—which in turn can spike anxiety levels and negatively impact their mental health and job performance. To foster an inclusive environment, organizations that wish to hire and retain neurodiverse employees should implement supportive measures such as providing access to noise-canceling headphones and the ability to choose a desk location as well as company-wide initiatives that help employees understand neurodiversity. Neurotypical employees may not be aware that sending meeting invites without an agenda or goals can be stressful for neurodiverse individuals; making a habit to send clear notes ahead of time and recapping tasks after the meeting can help everyone stay on the same page and make action items more tangible. Additionally, the simple act of checking in and asking if colleagues have any specific needs in the workplace can help make neurodiverse individuals feel seen, recognized, and safe. A culture of inclusivity is a daily practice, and educating employees about harmful stereotypes and how to work with their neurodiverse colleagues can help shape a healthy workplace culture for all employees.
Tools such as virtual reality (VR), biofeedback, and cognitive-behavioral therapy can further support neurodiverse professionals by helping to manage social anxiety and improve focus. These interventions can be integrated into workplace practices to enhance the well-being and productivity of neurodiverse employees. For example, VR has been studied as an effective medium to provide vocational support for autistic people, enabling them to practice social communication skills for interviews or job tasks.15,16 VR allows individuals to enhance their social and professional skills in a safe, controlled environment, which can not only aid in skill development but also help in reducing workplace anxiety. Organizations may offer VR training as part of their onboarding practices for neurodiverse individuals—and for neurotypical employees, VR training can help build empathy and understanding as they consider the challenges their neurodiverse colleagues may face.
Looking ahead, the integration of advanced technologies like artificial intelligence (AI) and machine learning (ML) can further support neurodiverse employees. AI-driven tools can offer personalized learning experiences, adapting to individual needs and preferences. Moreover, Extended reality training modules can simulate real-world scenarios, allowing neurodiverse individuals to practice and develop their skills in safe and controlled environments. These innovations hold the promise of creating more inclusive workplaces, where neurodiverse talent can flourish and contribute to the evolving landscape of cybersecurity.