Put two technical experts in a room following a simulated cyberattack and ask them what went wrong.
One will likely focus on the technology gap, hunting for an unpatched server, a misconfigured cloud environment or a bypassed firewall. The other might look right past the screens and ask a different question: Were the employees trained properly?
That difference in instinct exposes a reality the security industry frequently overlooks. Cybersecurity is not just a technology problem; it is fundamentally a human one. While security frameworks are supposed to be built around people, processes and technology, the technology pillar almost always dominates the conversation. Yet, in practice, the human element sits at the absolute core of digital defence.
The industry has a powerful opportunity to strengthen cybersecurity by bringing more diverse perspectives to the forefront.
The maths does not work
Over the course of my career, I have seen incidents where the technical controls were in place, yet human behaviour became the weakest link. Equally, I have seen diverse teams identify risks and challenge assumptions that others missed. That experience has reinforced my belief that cybersecurity is ultimately about people.
The global cybersecurity profession is under immense strain. Attack surfaces are expanding, threat actors are weaponising artificial intelligence, and cloud environments are scaling faster than many organisations can secure them. Against this backdrop of escalating digital risk, the industry faces a staggering global shortage of nearly four million professionals.
At the same time, recent ISC2 data shows that women make up only about 25 percent of the cybersecurity workforce. The industry simply cannot close a multi-million-person talent gap while leaving a massive portion of its best potential talent on the sidelines.
The crisis, however, extends beyond headcounts. The industry is short on specialised skills. AI adoption is driving an urgent need for hybrid expertise across cloud, machine learning and security operations. Excluding women from this narrative is not just inequitable — from an operational and business standpoint, it is entirely unsustainable. This challenge is particularly relevant in the UAE, where ambitious digital transformation and AI adoption are accelerating demand for cybersecurity talent.
Thinking like the attacker
There is a common saying in the field: to defend a network, you have to think like a hacker.
The reality is that threat actors are incredibly diverse. They operate across every geography and background, driven by motivations ranging from financial greed to state-backed disruption. Defending against such a multifaceted threat requires teams that are equally dynamic.
As AI lowers the barrier to entry for attackers and accelerates the speed of cyber threats, organisations need teams that combine technical expertise with human judgment, creativity and critical thinking. When a defence team thinks exactly the same way, blind spots inevitably appear. Integrating more women into cybersecurity teams disrupts that uniformity. It challenges ingrained assumptions and introduces crucial behavioural awareness into incident response and system design. More diverse teams ensure defensive strategies account for how humans actually behave, rather than just how machines are programmed.
Moving beyond rhetoric
For years, the broader technology sector has championed the inclusion of women in STEM. However, rhetoric without structural support does not fill security operations centres.
Many young women view the cybersecurity field as an intimidating, impenetrable fortress. Even those who earn specialised degrees frequently hit a wall known as the ‘experience paradox’. Employers demand practical experience for entry-level roles, but graduates cannot acquire that experience without first securing a job.
Breaking that cycle requires decisive action. To move beyond mere advocacy, the industry needs structured, hands-on employment pathways and initiatives that turn academic theory into real-world readiness. Research consistently shows that diverse teams make better decisions, challenge assumptions more effectively, and improve problem-solving under pressure.
An example of this blueprint in action is ‘She Protects’, an initiative launched in the UAE to directly address this operational shortfall. Endorsed by the UAE Cyber Security Council and developed by CPX and Microsoft, the six-month national programme was designed to serve as an industry model. Rather than leaving graduates to navigate a complex job market alone, it structurally bridges the gap between university theory and the high-stakes reality of the frontline.
Building the complete professional
Technical expertise alone does not make a fully equipped security professional. To yield genuine results, industry capacity-building programmes must embed recognised certifications directly alongside live cyber labs and exposure to real-world incidents. Participants must move beyond lectures; they need to sit alongside active practitioners, face objective assessments, and learn directly from industry veterans.
Surviving the high-pressure reality of a cyber crisis also requires sharp soft skills. Integrating professional development focused on emotional intelligence, effective communication and personal branding is just as vital as teaching threat hunting. Cybersecurity is not static, and continuous learning must be ingrained in the mindset of new entrants from day one.
When these elements are combined, the results speak for themselves. In June, She Protects saw its first cohort graduate. Over 50 talented, job-ready young women stepped directly into the national cybersecurity ecosystem. It serves as a powerful proof of concept: when the right doors are opened with the proper framework, the talent is ready and waiting.
A shared national responsibility
Securing critical infrastructure — from financial hubs to power grids — carries the highest possible stakes. As the UAE advances AI and digital transformation, its defences must evolve at the same pace. Deploying world-class technology yields little if the teams guarding it do not reflect the society they serve.
Diverse teams bring a broader range of experiences, perspectives and approaches to problem-solving, reducing the risk of collective blind spots. Empowering women in cybersecurity is far more than a corporate diversity metric. It is about understanding behavioural risk and anticipating complex threats. Elevating women to the frontlines of digital defence is the missing layer required to build a stronger, smarter and infinitely more secure digital nation. The question is no longer whether the industry can afford to invest in women in cybersecurity. The question is whether it can afford not to.
