by Lisa Ventura MBE FCIIS, Founder, Cyber Kindness
I have spent over sixteen years in cyber security, and before that I worked in journalism and broadcasting. In all that time, I have rarely seen the industry as honest about its own culture as it likes to believe it is. We talk a great deal about inclusion. We run the events, write the policies and post all the right words. And then a quieter set of behaviours carries on underneath it, mostly unchallenged.
I want to talk about four of them, because they are connected, and because treating them as separate problems is exactly what allows each of them to keep going.
Envy and Jealousy Are Not the Same Thing
We tend to use these two words interchangeably, but they describe very different things, and the difference matters here.
Envy is wanting something that belongs to someone else. Their recognition, their platform, the award on their shelf. It is a two-way feeling, just you and the thing you do not have.
Jealousy is something else. Jealousy is the fear of losing something you already hold, to someone you see as a threat. It is possessive and protective. It involves you, the thing you are guarding, and the person you have decided is coming for it.
When I look at how some established people in this industry behave towards those who are rising, I do not think we are only watching envy. I think we are watching jealousy. The contempt that gets aimed at people who are gaining visibility is rarely about a shelf of trophies. It is about status, territory and the quiet power that comes from deciding who counts. People do not sneer at a newcomer because they want her certificate. They sneer because her presence threatens an order they were comfortable sitting at the top of.
That is worth understanding, because it changes how you read the attacks. When someone with a large following takes a public swing at someone just for being recognised, the instinct is to assume they must have a point. They are senior, after all. But jealousy is not analysis. It is a reaction to feeling encroached upon. The seniority does not make the swing fair. It just gives it a bigger audience.
There is a name for part of this. Tall poppy syndrome, the habit of resenting people who stand out and wanting to cut them back down to everyone else’s height. It shows up wherever someone’s success is treated as something to be taken down a peg rather than celebrated. I have watched it happen to others, and I have felt it aimed at me. The poppy did nothing wrong by growing. It simply grew taller than the people around it were comfortable with.
When Self-Promotion Only Ever Seems to Mean Women
There is a particular accusation that gets thrown almost exclusively at accomplished women in this field, and it is the charge of self-promotion.
A man shares his achievements, and it is leadership. He posts about a new role, a speaking slot, an award win or nomination, and it reads as confidence and thought leadership. We nod along, we say congratulations to him and we champion his achievements.
On the flip side, a woman shares the same kind of thing and the language shifts. Now she is attention-seeking. Now she is all about self-promotion. Now she is doing too much. Now she is too visible. Now, in the uglier corners, she is a fraud.
I have had this aimed at me directly, and I want to be clear about what it is. Sharing your work, your achievements, your nominations and your awards is normal professional visibility and for many of us, it is literally part of the job. The idea that a woman talking about what she has done and achieved is somehow distasteful, while a man doing the same is simply ambitious, is not feedback worth acting on. Let me name it for what it is. It is misogyny with a respectable vocabulary.
There is a particular twist on this that has been aimed at me more than once. The accusation that I must be paying a PR company to write my award entries, because surely the recognition could not be my own. I want to put that to bed because I do not have a PR company, I could not afford one if I wanted to.
When that does not land, the story simply shifts. If it is not a PR company, then it must be people I know quietly doing it all for me. The honest answer is that I do not know who nominates me. Nominations always arrive without my knowledge, sometimes from people I have never met, and the first I hear of one is a message of congratulations. That is rather the point of a nomination. Someone has decided your work is worth putting forward. Choosing to believe instead that there must be a hidden hand behind it, rather than the work itself, says a great deal about what some people are willing to assume about a woman’s success.
The cruellest part of this is how well it works. It plants a big seed of doubt, and you start wondering whether you really are doing something wrong simply by existing visibly. Recently I deleted my own accomplishments because of being on the receiving end of exactly this kind of behaviour and pressure. I want to say plainly to anyone reading who has felt the same pull: shrinking yourself does not protect you from people who talk about you like that. It just hands them the result they wanted, and it costs you something real that you worked years to earn.
I am working with a coach, and she was the one who encouraged me to start sharing my award nominations, very much against my better judgement. Left to my own devices I would have said nothing. Her reasoning stayed with me. Sharing them, she felt, might inspire someone else to consider a career in cyber security, or help a person who already feels like an outsider to look at my path and think, that could be me. That is the only reason I do it. Not for applause, but because visibility can be a door held open for the person coming up behind you.
Cliques Are Gatekeeping with a Friendly Face
The third thing sits underneath the other two and gives them somewhere to live.
Cyber security has a clique problem. Not the harmless kind where people who meet and get on stay in touch. I mean the kind that locks others out. The same small circles amplifying each other on repeat. The praise that only ever flows in one direction. The photos from events on LinkedIn with the cliques smiling and accompanying posts bigging each other up. The groups where you can feel the invisible rope drawn around who is in and who is not.
Cliques are not benign. They decide who gets the opportunities, who gets the visibility, who gets likes and comments on LinkedIn, who gets praised and who gets believed when something goes wrong. They are gatekeeping dressed up as friendship. And they are what gives envy and misogyny their audience. A cruel post about an accomplished woman lands very differently when there is a ready-made circle waiting to like it, share it and potentially pile on. The clique is often what turns a private nasty thought into a public spectacle.
Often this sits right alongside all the talk of inclusion. Some of the same people writing about belonging in the morning go straight back to their closed circles and private WhatsApp groups in the afternoon. That contradiction does not make the clique culture less damaging. It makes it more so, because it teaches people that the use of inclusive language is for the public stage and the gatekeeping along with going underground to mock someone for their achievements is for real life.
The Myth That Human Factors Is Not a Proper Cyber Job
There is a fourth thing, and it arrives dressed as a question about credibility. The suggestion that someone is not technical enough to belong in cyber security. That the human factors and security awareness work someone does, along with the founding of communities, membership bodies and trade associations, is not a proper job in this industry at all.
I want to take that apart, because it does real damage to a lot of good people.
Cyber security is not only firewalls, code and configurations. The overwhelming majority of breaches involve a person somewhere in the chain. Someone who clicked, someone who was deceived, someone who was tired or rushed or never given the support to spot what was coming. Human factors is the work of understanding why that happens and culturally changing the behaviours behind it. Reducing the conditions that lead to mistakes. Building cultures where people feel safe to report incidents rather than hide them. None of that is soft and none of it is decorative. It is some of the hardest and most consequential work in the field, precisely because people are far harder to patch than software is.
Treating it as lesser says more about the person saying it than the person they are aiming at. It reveals a very narrow idea of what security actually is, one that has not caught up with where most of the risk now sits. The technical side of cyber security and the human side is not in competition. A brilliant control that nobody understands or follows is not security at all. It is nothing more than a diagram on a wall.
There is a close cousin to this, the belief that if you are posting about your achievements, you cannot possibly be busy doing real work. As though visibility and competence cannot live in the same person. As though sharing an award win is proof you have abandoned your actual job to do it.
It is a bizarre and strange accusation when you think about it. Nobody assumes a man who shares he has won an award has downed tools to write the post. The achievements I share are the work, or rather the outcome of it. Sharing them takes a few minutes. The work behind them takes months, often years, and most of it happens in the parts of my day that nobody ever sees.
What I Am Choosing to Do About It
I am not writing this to settle a score, and I have deliberately named no one. I am sure those involved know who they are if they read this, and that is enough.
I am writing it because I know I am not the only person who has felt this, and far too many of those people do not feel psychologically safe enough to say so out loud. Those of us who are neurodivergent like me will have felt this tenfold. Our faces don’t fit, and the cliques know this and capitalise on it. Workplace bullies, who often have narcissistic personality disorder or narcissistic personality traits, also know this and target us relentlessly. I’ve been on the receiving end of bullying and abuse more times than I care to mention in every area of my life which is soul destroying.
I also want to say something that matters more to me than any of the above. For every person who has tried to make me feel small, there have been others who did the opposite. People in this industry who checked in on me, who reminded me of my worth, who stood beside me quietly and wanted nothing in return. Their kindness arrived exactly when I needed it most, and I will not forget it.
There was a point not long ago when I had decided to walk away from cyber security altogether. The reason I am still here, still writing, still doing this work, is the haters, bullies and abusers. I am not going to name them, partly because there are more of them than any one post could hold, and partly because I do not want to turn an act of gratitude into yet another list of who is in and who is out. But I hope every one of them knows exactly who they are. To all of you, thank you. You changed my mind, and you may well have changed my path.
My work has always been about psychological safety, about building a cyber security industry that is genuinely human and genuinely inclusive. That work does not stop at the edge of the uncomfortable conversations. If anything, it must start there. So, I will keep sharing what I do. I will keep championing the amazing people in our industry, and I will keep calling this culture what it is, toxic, because staying quiet has never once made it better. And if you have ever felt on the outside of a circle that seemed to decide who matters, or watched a woman in the industry get torn down for the crime of being visible, winning awards and doing well while a man doing the same was applauded, you were not imagining it.
We are capable of a kinder industry than this. I would like us to choose it, and to that end, I have launched Cyber Kindness.
We can and must be the change we want to see in our industry. It starts with us, and it starts now.
