Exclusion Is a Vulnerability: Patching the Gender Gap in Tech
Where
Talks
Disobey 2026
Duration
30 min
Argues that gender bias in tech hiring and teams creates security risk, and proposes controls to measure and reduce it.
Summary
The talk treats exclusion in tech as a systemic weakness rather than a question of individual character. Using European statistics, it notes that women make up roughly a fifth of the EU's roughly 10 million ICT workers, with wide differences between countries. It measures this against the Digital Decade goals of 20 million ICT workers and at least a quarter of them women by 2030.
The middle section looks at where bias enters. Hiring filters are affected by name-based callbacks and stereotyped job roles, and interview panels tend to favour candidates who resemble the panel. Everyday microaggressions and role assumptions add friction over time. The speaker cites an open-source study in which code contributions were accepted more often when author names and genders were hidden, and suggests bug bounty triage may face a similar effect, though no study was found on that point. Attrition figures, consultancy claims linking diversity to performance, and a 2016 World Bank estimate of lost GDP are presented as the cost to businesses and security, including blind spots and biased AI systems.
The closing part offers practical controls: apply merit-based criteria consistently rather than only when convenient, use structured interviews with clear promotion criteria, mentor and sponsor talent, and take exit interviews seriously to understand why people leave. The main takeaway is to make bias visible and measure it, since unexamined bias persists and weakens the teams that depend on the talent it pushes out.
Related talks
Talks·40 min
Rafal Los
Draws parallels between raising children and running security programs, covering containment, behavior change, and leadership.
Talks·49 min
Luke McOmie · Qasim Ijaz
Real stories about scoping, disabled controls, and vendor frustrations show how clients and pentesters can work together better.
Talks·50 min
Sean Poris
Shows security practitioners how to frame findings in business terms, using empathy, active listening and influence with stakeholders.


