Why valuing neurodivergent workers is a cyber security essential

The importance of visible appreciation

“For neurodivergent staff, visible appreciation is particularly important because many have spent years masking, overcompensating or being misunderstood,” says King. “If their effort is invisible, or if their difference is only noticed when something becomes difficult, the workplace can start to feel unsafe rather than supportive.”

In cyber security, this matters enormously as the work often requires vigilance, deep focus, pattern recognition and problem-solving – areas in which neurodiverse professionals frequently excel.

But warns King: “If the environment is high pressure, ambiguous, socially complex, constantly reactive, or poorly adjusted, those strengths can become very costly to sustain.”

Maria Paviour, an occupational psychologist, training facilitator and executive coach, who is autistic herself, agrees. She acknowledges that to feel safe, everyone – whether neurodivergent or not – needs to feel part of a community, and feeling valued for your contribution is an important part of that.

This is because such recognition creates a “dopamine hit, which makes the brain experience pleasure and, over time, becomes intrinsic”, she explains.

But recognition is a slightly different beast for neurodivergent and neurotypical people. The idea here is that neurotypical people tend to use social interaction to build connection and feel part of the group. If their contribution, both social and work-related, is not recognised, they may feel hurt or resentful, and their self-esteem could be impacted.

Neurodiverse people, on the other hand, often feel a strong need to follow their special interest, which, if it is their work, becomes a core part of their identity. This means that for them, it is about using their expertise and knowledge to feel part of the group. If this contribution is undervalued, “they’ll feel alienated”, which negatively impacts their psychological safety, Paviour says.

The mental health impact of not feeling valued

But there are other issues, too. For instance, the ISC2 report points to certain workplace conditions that are particularly damaging to neurodivergent workers’ job satisfaction. Top of the list is feeling drained by the need to stay current on emerging threats and technologies (53% versus 46% of neurotypical colleagues).

Next are overwork due to staff or skills shortages (31% versus 27% of neurotypical respondents) and a lack of career development opportunities (31% versus 26%). Having to cover security responsibilities outside of their role or expertise (23% versus 18%) is also problematic.

The mental health impact for neurodivergent employees of not feeling valued, combined with the ongoing pressure of working in the cyber security profession and the stresses and strains of everyday employment, can be severe. Symptoms include anxiety, low mood, lack of confidence and withdrawal

A key consideration here, says King, is that neurodivergent people’s nervous systems are particularly sensitive to the demands of uncertainty, sensory input, social processing, executive functioning and change. This is because they register information more intensely, which requires more energy to filter, organise and recover.

The upshot is that neurodivergent workers often struggle with issues such as too much context switching, too many urgent demands and interruptions, too much ambiguity, and too little recovery time.

“In the right conditions, that sensitivity can support deep focus, pattern recognition, creativity and precision,” King explains. “In the wrong conditions [which include unclear expectations, unspoken social rules, poorly communicated feedback, and a lack of meaningful adjustments], it can become exhausting and create a greater risk of burnout.”

The key point is that the mental health impact for neurodivergent employees of not feeling valued, combined with the ongoing pressure of working in the cyber security profession and the stresses and strains of everyday employment, can be severe. Symptoms include anxiety, low mood, lack of confidence and withdrawal.

To make matters worse, some people find the situation may also “echo earlier experiences of being misunderstood in education, family systems or previous workplaces,” King points out. This means a lack of recognition is “not neutral”. In fact, “it can activate a much deeper sense of not belonging”.

Concern over career longevity

Unsurprisingly then, a significant 32% (versus 27% of neurotypical respondents) feel uncertain about how long their cyber security careers are likely to last. But exhaustion and mental health challenges, as important as they are, are not the sole considerations here.

Will Reed is head of cyber threat exposure management at cyber security services firm Bridewell and chair of its Neurodiversity Network. He is dyslexic, has ADHD, and earlier in his career regularly burned out five or six times a year. This debilitating cycle ceased once he was diagnosed, received appropriate mental health and well-being support, and learned various coping mechanisms.

Reed estimates that as many as 30% to 40% of employees in the average cyber security team are neurodivergent. This, he believes, is because the profession appeals to people with a strong sense of justice and the ability to see right from wrong. But many worry about the longevity of their career due to imposter syndrome.

“The level of imposter syndrome is higher in the neurodiverse community because if you’ve had a lifetime of people saying, ‘if you tried harder, you’d be better’, it impacts on your ability to quantify your own value,” Reed explains. “If not feeling that you’re good enough is something you grew up with, it extends into your adult life too.”

A neurodivergent virtual CISO associate at cyber security services firm Cyberhash – who preferred not to be named due to concerns over facing discrimination and stigmatisation – agrees.

“It comes down to masking because, if you’re putting on a different face, you’re constantly in fear of having it ripped off,” they say. “So, there’s a fear of how long you can keep this going, particularly because in most organisations, management is seen as the only skill worth rewarding in the long run, but is not necessarily something that many neurodivergent people take easily to.”

Therefore, they are a fan of pathways, such as the distinguished engineer career route. This runs in parallel to management in terms of status and remuneration but remains a rarity in most organisations today.

How to better support neurodiverse teams

As to what cyber security leaders can do to better support their neurodiverse team members and create a more neuroinclusive workplace, the CISO makes various points.

One of the most important factors is having a supportive line manager who listens to them and makes them feel understood. This is essential, they point out, because “feeling othered or outed has a big impact on managing the stress of work”.

Being neurodivergent is like riding a bike on a motorway. It’s very intimidating, and having management support is like having a police escort to help you get to your destination

“Being neurodivergent is like riding a bike on a motorway,” they explain. “It’s very intimidating, and having management support is like having a police escort to help you get to your destination.”

An essential activity here includes explicitly monitoring individual stress levels and calling the situation out if things appear to be going wrong.

“You can’t just hope it will be dealt with, but you also need to tailor any response to the individual as we all deal with stress in different ways,” they indicate. “I, for example, get stressed as much by underwork as overwork, so things like that have to be taken into consideration.”

Other things to think about include moving your management style away from old-school, traditionally directive approaches – although they point out that it is necessary to “make a judgement and tailor it to different people”.

“If you provide scaffolding for someone to hit a target, you force them to take the route you prefer, which can make life harder for them,” the CISO explains. “I’ve found providing clear goals and flexibility about how to deliver on them works better for neurodiverse people, while neurotypical people sometimes benefit from more scaffolding.”

Getting meetings right

Just as vital is creating space for everyone to contribute effectively in meetings.

“In poorly run meetings, you find the same people talk and the rest give up, many of whom will be neurodivergent,” they say. “So, it’s important to ensure everyone gets a chance to speak and that everyone is listened to, not just the ‘squeaky wheels’.”

Another consideration is being willing to accommodate other people’s non-standard behaviour.

Bridewell’s Reed explains: “My normal stance is to pace around a lot when I’m thinking as it helps me focus, but during meetings, others will ask why I’m doing that. Luckily, my CEO is supportive when I ask if I can mooch about at the back of the room, and that makes a big difference.”

Another point is providing documents in advance of a meeting as his dyslexia makes it difficult to read and absorb them on the fly.

“You need to respect that the business has needs too, and to balance it out, but these are small but meaningful changes that make neurodivergent people feel more included,” Reed explains. “Sometimes it’s difficult to explain difference, but the way I frame it is that it’s like trying to explain colour to a blind person – it’s a different reality.”

Why flexibility matters

Another area that needs to be thought about differently, the CISO believes, is annual performance appraisals. In fact, he describes them as “one of the biggest tools of oppression of neurodivergent people in the workplace”.

The problem is that such reviews may be set up with good intentions but, in their experience, they tend to be undertaken by managers with little training and few skills in the area. The upshot is that they are mainly “based on gut instinct”. But such a subjective, as opposed to objective, data-based approach makes little sense to most neurodiverse people.

“People are too complex to be reduced to a sheet of paper. You have to understand their performance on a day-by-day, week-by-week basis, rather than making a judgement once or twice a year,” the CISO points out.

As a result, they recommend having weekly conversations covering issues like career development and how individuals could best be supported to take on more responsibility.

What they are a big fan of is flexible working, which is also reflected in the findings of the ISC2 study. In fact, the association describes the approach as the one most likely to engage neurodivergent employees (43% versus 38% of neurotypical workers).

“I’d suggest managers be very wary of return to office policies as many neurodivergent people find that being able to work remotely, and not having to mask or meet social expectations, is a very positive thing,” the CISO says. “Otherwise, you’ll find people can work less well under pressure, and you’ll lose good staff.”

Reed agrees. It is this desire for flexibility, he believes, that leads many neurodivergent people to set up their own businesses.

“Irrespective of changes in society, it makes sense to hold onto remote working practices as it enables people to build routines that complement their strengths and weaknesses. Ultimately, it’s about trusting and empowering people to make the best decisions for themselves,” he concludes.