Australia’s cybersecurity workforce problem: language that repels the people we need
Australia’s cybersecurity workforce problem: language that repels the people we need
Publish Date: 2026-06-03 21:04:00
Source Domain: www.aspistrategist.org.au
Australia has a cybersecurity workforce problem, and part of the explanation is hiding in plain sight: the language of the field actively repels the people we need. Last year, I was on a panel for the Canberra Cyber Hubs Career Symposium, discussing career pathways with an audience of high school students. When one panelist mentioned working as a penetration tester, a male student in the audience started sniggering. I remember thinking little of it at the time. But later I reflected on the term itself: why did we name that job ‘penetration tester’? When examined, it carries connotations that have nothing to do with the work.
I have nothing against penetration testers. We need more of them. But the naming choice is symptomatic of something larger. Language in cybersecurity is deeply masculine or militarised. Consider the standard vocabulary: man-in-the-middle attack, kill chain, brute force. The list goes on. The problem is not merely aesthetic. Militaristic language creates the professional culture it describes – one that reads as homogenous, combative and accessible only to those fluent in combat jargon.
This framing was, in part, a deliberate institutional choice. In the early 2000s, the US Department of Defense shifted from information warfare to the cyberspace domain. By the late 2000s, cyberspace was officially defined as a ‘global domain’ within the information environment. The move was strategic: it gave the military legitimate authority to operate there, just as it does in physical spaces. But it also handed cybersecurity a conceptual vocabulary that has since shaped professional culture far beyond defence institutions and narrowed who feels entitled to work in the field.
That narrowing has real consequences. It feeds the hacker-in-a-hoodie stereotype and perpetuates the misconception that cybersecurity belongs to those who write code and think in adversarial terms. This ignores the reality of modern cybersecurity practice, where effective defence…
