TL;DR: Women remain underrepresented in IT even as demand for talent stays high, according to StrongDM's guide, citing Gartner's 31% female share of IT employees, 500,000 cybersecurity openings, and BLS projections of 667,600 new computer and information technology jobs through 2030. The governance lesson is that access to technical careers depends not only on skills but on culture, support, and fair progression structures.
At a glance
What this is: This is a career and culture guide that says women are still underrepresented in IT despite strong labour demand and clear advancement opportunities.
Why it matters: It matters because identity and access teams do not build resilient programmes in a vacuum, and hiring, promotion, and support structures shape who enters and stays in security and IT roles.
By the numbers:
- According to Gartner, only 31% of IT employees are women.
- The U.S. Bureau of Labor Statistics says computer and information technology jobs are expected to grow by 13 percent from 2020 to 2030.
Context
Women remain underrepresented in information technology even though the field continues to expand and the hiring gap is widely acknowledged. The article frames this as a people-and-culture problem, not a technology shortage, and uses labour-market data to show that opportunity exists while representation still lags.
For IAM, IGA, PAM, and security leaders, the practical takeaway is that workforce diversity affects who designs controls, who reviews access decisions, and who advances into technical authority. That makes talent pipelines and workplace culture part of broader identity programme resilience, even when the article is not about access control itself.
The guide also treats persistence as a career control: skills, mentoring, and environments that support progression determine whether women can convert demand into durable participation. That lens is useful for organisations that want to recruit better, retain more talent, and reduce avoidable friction in technical teams.
Key questions
Q: What do organisations get wrong when they treat women in IT as a recruiting problem only?
A: They miss the post-hire controls that determine whether people stay and progress. Culture, sponsorship, manager behaviour, and promotion fairness all shape retention, so the real issue is lifecycle management, not just talent acquisition.
Q: Why does representation matter for technical and identity teams?
A: Because the people who design and run controls influence which assumptions get embedded in processes. Broader representation can reduce blind spots, improve user empathy, and make access and support workflows easier to use correctly.
Q: What are the signs that a technical culture is pushing women out?
A: Uneven promotions, poor access to high-visibility work, weak harassment response, and repeated reports of not feeling supported are strong warning signs. When those patterns persist, retention problems usually follow.
Q: How should leaders improve retention for women in IT?
A: They should pair skills development with fair opportunity structures, visible sponsorship, and manager accountability. If the environment rewards only one kind of technical profile, the organisation will keep losing capable people.
Technical breakdown
Why underrepresentation persists despite demand
Women entering IT face a structural mismatch: the market needs talent, but workplace culture still filters who can stay and advance. The article points to bias, harassment, uneven promotion paths, and a lack of support as recurring conditions that shape outcomes more than raw interest does. In practice, this is a governance problem as much as a hiring problem, because talent loss often starts after onboarding, not before it. The organisations that treat representation as a lifecycle issue tend to see better retention and healthier team composition.
Practical implication: review hiring, onboarding, promotion, and manager training as one retention system, not separate HR tasks.
How representation affects technical decision-making
A more balanced workforce changes how teams interpret problems, challenge assumptions, and design user-facing controls. The article argues that broader representation can improve empathy, reduce blind spots, and bring more customer perspective into technical work. That matters in identity and security programmes because access policies, support flows, and escalation paths are all shaped by the people who build them. When the team lacks diversity, the resulting controls may still function, but they are more likely to encode narrow assumptions about users, context, and acceptable friction.
Practical implication: involve a diverse set of practitioners in design reviews for access, support, and escalation workflows.
What career durability looks like in a fast-changing IT market
The article emphasises continual skill-building, flexible career paths, and choosing roles that fit personal strengths. That is a realistic model for IT because technical roles evolve quickly, and career durability depends on learning velocity as much as credentials. The guide also makes clear that not every path is the same: support, analysis, architecture, development, and security each reward different working styles. For employers, the lesson is that keeping talent requires room for different trajectories, not a single narrow definition of technical success.
Practical implication: create multiple advancement paths so technical staff can grow without being forced into one career template.
NHI Mgmt Group analysis
Representation gaps are a governance problem, not just a hiring problem. The article makes clear that women do not leave technical fields only because they cannot enter them. They also encounter culture, support, and advancement failures after hiring. For identity and security leaders, that means workforce resilience depends on the same lifecycle thinking used in access governance: entry, support, progression, and retention all matter.
Broader representation changes how technical controls are designed and reviewed. Teams that include different lived experiences are more likely to spot hidden assumptions in workflows, escalation paths, and support experiences. That matters in IAM, PAM, and security operations because those controls are judged not only by policy correctness but by how people actually use them. The practical conclusion is that control quality improves when the team itself is not culturally narrow.
The talent gap will keep widening unless organisations treat inclusion as an operational control. Demand for technical skills is rising, but the article shows that many workplaces still undermine participation through bias or weak manager behaviour. In practice, that means retention and progression should be monitored like any other business-critical control surface. If the environment is hostile or stagnant, the pipeline leaks before capability matures.
Career durability in IT now depends on flexible learning pathways. The article repeatedly stresses growth, experimentation, and matching roles to strengths. That is a reminder that modern identity and security programmes benefit from teams built around complementary skills rather than a single archetype. The implication for practitioners is to design career structures that keep diverse talent advancing instead of forcing it out.
Women in IT still face a representation gap because the field has not yet normalised equitable access to opportunity. The article ties this to culture, mentorship, and uneven advancement, not to lack of ability. For practitioners, the lesson is straightforward: if the workforce is part of your security and technology delivery model, then inclusion is part of programme strength, not a side topic.
What this signals
Inclusive workforce design influences control quality. Teams that reflect different experiences are less likely to normalise friction, exclusion, or one-size-fits-all workflows. For identity, access, and security programmes, that means the people side of the operating model directly affects how usable and durable the controls are.
Retention is the hidden variable in technical capacity. Hiring more women into IT helps only if the organisation can keep them progressing through the lifecycle. That puts manager behaviour, sponsorship, and equitable opportunity into the same category as other programme dependencies.
Broader participation strengthens the bench that identity programmes depend on. The issue is not just fairness in principle. It is whether organisations can sustain enough skill, judgment, and leadership depth to keep pace with change.
For practitioners
- Audit promotion and sponsorship patterns Review whether women receive the same access to high-visibility projects, stretch assignments, and advancement opportunities as peers. Track manager behaviour, internal mobility, and attrition by role family to find where progression stalls.
- Strengthen inclusive manager training Train people leaders to recognise biased feedback loops, exclusionary team behaviour, and harassment escalation responsibilities. Make respectful conduct and fair opportunity part of managerial performance expectations, not optional culture work.
- Build multiple technical career paths Create growth tracks for support, analysis, architecture, security, and development so employees can advance without being forced into a single mould. Different strengths should map to different ways of contributing.
- Measure retention as a workforce control Use attrition, promotion rates, and employee feedback to identify whether the environment is actually supporting women in technical roles. Treat those signals as operational evidence, not soft metrics.
Key takeaways
- Women remain underrepresented in IT even as demand for technical talent continues to grow.
- The article frames culture, support, and promotion fairness as the main reasons representation still lags.
- Organisations that want stronger technical teams should treat retention and progression as operational priorities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RR-02 — Roles, Responsibilities, and Authorities | The article centers on organisational responsibility for culture, progression, and support. |
| GV.PO-01 — Policies, Processes, and Procedures | Fair advancement and harassment response depend on documented people processes. | |
| ID.RA-05 — Risk Response Prioritization | Retention and culture risks affect the resilience of technical programmes. | |
| Recommendation — Assign clear ownership for inclusive hiring, promotion, and retention outcomes. Document and enforce promotion, conduct, and support processes across technical teams. Prioritise workforce risks that undermine staffing, capability, and continuity. | ||
| NIST SP 800-53 Rev 5 | PS-1 — Personnel Security Policy and Procedures | The article is fundamentally about the people side of security and technology work. |
| AT-2 — Literacy Training and Awareness | The guide explicitly calls for education on harassment and respectful workplace conduct. | |
| Recommendation — Use personnel security governance to support fair access, conduct, and progression practices. Deliver recurring training on respectful conduct, bias awareness, and escalation expectations. | ||
Key terms
- Resolution Gap: The resolution gap is the distance between identifying a security issue and actually eliminating the risk it creates. In AppSec, it appears when scanners produce findings faster than teams can triage, fix, test, and deploy them. The gap is operational, not theoretical.
- Bro culture: A workplace environment that rewards exclusion, aggression, or in-group behaviour over professional respect. In technical teams, it can suppress participation, increase attrition, and make it harder for underrepresented staff to progress into senior roles or speak up about risks.
- Talent pipeline: The path people take from education or adjacent roles into a technical career. Strong pipelines are not just recruitment channels. They include training, mentoring, progression, and retention, which together determine whether organisations can fill and keep critical identity and security roles.
- Career Durability: Career durability is the ability to remain relevant, grow skills, and keep progressing as roles and technologies change. For IT practitioners, it depends on continual learning, support structures, and access to opportunities that match both strengths and changing market demand.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org