Neurodivergence in Cyber

0:00:00.0 Emily Wearmouth: Hello and welcome to the Security Visionaries Podcast, a place where we bring experts together to talk about things that should interest anybody in the data, cyber or broader tech industry. Today we're going to talk about neurodiversity and cybersecurity, and I'm your host, Emily Wearmouth. But let me introduce my guest. Holly Foxcroft is the head of neurodiversity research in cyber and consulting at Stott and May consulting. Holly, who is autistic with ADHD and has a son with autism, began her career in electrical and cyber warfare. She now combines her two worlds of neurodiversity and cyber by running employer awareness events, writing policies, and championing inclusion. She's contributed to academic and industry research, and in her current role, she supports employers in becoming neuro-inclusive. So welcome to the podcast, Holly.

0:00:49.8 Holly Foxcroft: Thank you so much for inviting me and having me. Such a pleasure to be here.

0:00:54.0 Emily Wearmouth: We are gonna dig into some really interesting questions I've got here all about neurodiversity, but before we do that, I wanted to start by letting our listeners know a little bit more about yourself. So do you want to, in your own words, who you are and what your personal experiences with neurodiversity?

0:01:11.3 Holly Foxcroft: Yeah. I mean, you gave me such a fabulous introduction, I say thank you. And sometimes when I hear people talking about myself, I kind of get lost thinking they're actually talking about someone else. I actually started my career in the defence in the Royal Navy, and I've always been attracted to very analytical things, things that are just very black and white. And electrical warfare and cyber warfare really turned my head and I really loved my career there. And what I did within the capacity of those roles was actually a lot of awareness and working with people who I felt at the time as an undiagnosed neurodivergent person, very comfortable with our social standards, perhaps in those environments were easier. And then when I actually entered civilian life, I went into cybersecurity recruiting, and that's when I came about understanding that we do not have a cybersecurity skills gap. We have a communication issue, in actually finding those individuals or supporting those individuals who have that particular skillset and welcoming them and keeping them into this industry.

0:02:24.4 Emily Wearmouth: Do you think then that conversations about neurodiversity in cybersecurity are always constructive to have?

0:02:31.1 Holly Foxcroft: I think conversations about neurodiversity in any industry are going to be constructive. Through research, we have found that there is a higher number of neurodivergent individuals in the cybersecurity industry than perhaps others. The research is limited. I'm hoping that there will be more research. Let's think of our brains. We have a neuro type, all of us, we have neuro types, and that makes us all neurodiverse. It's that 15-20% of us are neurodivergent, and that means that we may either think, learn, and process information differently, either by diagnosis such as autism, ADHD, dyslexia, dyscalculia. There are many neuro types that we can include within neurodivergence, but we are all neurodiverse. But the way that a neurodivergent brain thinks naturally, the way it's wired, particularly honours cybersecurity skillsets.

0:03:34.9 Emily Wearmouth: Right.

0:03:35.4 Holly Foxcroft: The creative thinking, analytical thinking.

0:03:39.4 Emily Wearmouth: Fantastic in a crisis.

0:03:43.0 Holly Foxcroft: I've always said, if you have an IR team, then you're gonna want to hope that you have what I would say is an ADHD profile within that team. As the way that neuro type thinks and works, they really are your best asset in a crisis.

0:03:58.1 Emily Wearmouth: That's interesting because often you think about team planning in terms of skillsets or experience, but you are adding another layer in there about actually how an individual within the team's brain is wired and why you might need to plan for that diversity.

0:04:12.5 Holly Foxcroft: Absolutely. And also when we are talking about human risk management, it's also understanding outside of your security teams, how does your organisation think, learn, process information? Because when you are delivering security awareness or when you are working with individuals who may be handling specific information, are you ensuring that you are supporting their neuro type? Because that's a cybersecurity consideration within your cybersecurity awareness space. We know we have seen in research, and it's pretty obvious that diversity of thought brings so many benefits. But what is different here is it's accepting neurodivergence for how it wholly looks, not just on the celebrated stuff, that analytical thinking, that hyperfocus, that creative thinking. The neurodiversity is also asking to respect wholly how that person presents with their neuro type.

Emily Wearmouth [00:05:03] Okay. All right. What do I have next on my list? I wanted to know which you've talked about. What was interesting, which is the episode that you think is most worth scrolling back and listening to.

0:05:14.8 Emily Wearmouth: Right. So you can't just get the advantages of these neurodiverse people, you have to also acknowledge that they're a complete package that might also have other needs, or you might just need to work with them differently to other members of the team?

Emily Wearmouth Yeah that's a good pick. It was very honest. And they talk not only about their own resilience, but also their team and how to manage resilience within their team. So I enjoyed that one a lot as well as a good one to pick.

0:05:27.7 Holly Foxcroft: You approach neurodiversity respecting a person as an individual, not by their diagnosis. And with neurodivergence, it's almost like to be accepted within our society, we have to have that superhero status. Let's just think, and I invite our listeners to think of a person with autism. Quite often we will think of a male and we will often think of used to be mathematician, but now it's more computer genius and that's fed to us through media representation. Let's look at Rain Man. This is very much generational because I've spoken to some younger people in training and they don't know who Rain Man is.

0:06:11.1 Emily Wearmouth: No, I was gonna say. It's definitely dating.

0:06:16.0 Holly Foxcroft: And, or we think of Sheldon Cooper in the Big Bang Theory or Mr. Robot in the Netflix series. However, they have a superhero status, and that's the only way for us to be a welcome part of society. And some of us, we don't have those superpowers just because I'm autistic. Like I said earlier, I'm driven to the analytical and the creative thinking part, but my maths, GCSE will tell you otherwise that I'm definitely not a mathematical genius. Again, that's stereotyping. Who knows, perhaps if I did study in that field, I probably could be because of the way my brain works, but it doesn't come naturally to me. And it builds again into what we think we know about specific neurodivergence. And also, when we say neurodivergence, a lot of us only think of autism. We only think it means autism.

0:07:16.1 Emily Wearmouth: I wanted to ask a question about that because, and I've come into this conversation, I'm very excited about this conversation because I know I will learn a lot from it. But when I think back to how we used to talk about neurodiversity, almost before it was called that, we would always talk about a spectrum which allowed for nuance and was sort of the way of illustrating that we all sit on it somewhere. But now it feels like conversations have become a bit more binary because I think diagnoses have picked up and people are more comfortable saying they are or they aren't. It feels like a more binary conversation. What's your take on that? Has it become more binary?

0:07:49.7 Holly Foxcroft: So the very concept of neurodiversity, which is we all as humans think, learn and process information and our environment differently, that is just a natural form of human variation. So the concept of neurodiversity, it has evolved over time. So understanding why there seems to be this shift where it's been discussed as a spectrum and now we're looking at it as more binary conversation, you have to look into what scientific advancements there has been, but also the socio-cultural changes as well. So the original spectrum concept that comes from the recognition of neurological differences. Earlier, I mentioned autism, ADHD, dyslexia, but other kind of cognitive variations, and that they manifest in wide range. We can have various degrees and traits of abilities, and that's the understanding of the spectrum. And many of us have then said that really unhelpful term that is, Well, we're all on the spectrum somewhere.

0:08:58.8 Emily Wearmouth: Yeah. And you hear that a lot. Yeah.

0:09:01.8 Holly Foxcroft: Now, this comes from, I believe, and I trust this, that it does come from people just wanting to show that they have empathy or understanding and acceptance. Well, actually, it's very unhelpful, because we are not all on the spectrum, we are not all autistic. To dissect that, we all share characteristics. So we all share characteristics of what can make up autism as a diagnosis, but it's how much or how little that we experience the differences that warrants that diagnosis of autism spectrum condition. You may say autism spectrum disorder. I choose to use the language autistic spectrum condition, just to take away that negative narrative language. And there's been a lot more research in recent years into neurological conditions and the conditions themselves, but also into how they affect gender. This is one of the new ones, actually. So representation, how does a person with autism present? Well, it was only up until 1993, that the diagnostic criteria for autism in the UK was only on young boys.

0:10:13.1 Emily Wearmouth: Right.

0:10:13.3 Holly Foxcroft: Now, after that, so you're actually gonna have a lot.

0:10:17.9 Emily Wearmouth: 1-3. Wow!

0:10:20.1 Holly Foxcroft: Yeah. It was only in the early 2000s that ADHD was recognized in adults. But also research historically has been mainly on men and I think we know that. So we are doing more research into neurological conditions, but also they don't neatly fit into binary categories. And instead, they do present as a range of characteristics that can overlap and vary in intensity, but also because it's intersectional and there are gonna be other factors.

0:10:51.9 Emily Wearmouth: Actually, the first time we spoke, you introduced me to a new phrase that I've never come across before. You talked about acquired neurodivergence and this was totally new for me. So can you explain what you mean by that? What is acquired neurodivergence? And how does thinking about it perhaps change the way we think about neurodiversity in general?

0:11:09.3 Holly Foxcroft: Yeah, so acquired neurodivergence means you pick one up on the way. So on your journey through life, you pick up what is considered to be neurodivergence. Examples of this can be through health. So you may have a stroke, you can have periods of neurodivergence, which can be brought on through periods of poor mental health. And other examples, what I really love talking about is actually the menopause.

0:11:33.1 Emily Wearmouth: Wow.

0:11:33.3 Holly Foxcroft: Because of the 27 menopausal symptoms, 27, that's taken from our NHS website, what can be considered as neurodivergence is that heightened anxiety and brain fog. Now what makes that neurodivergence? Neurodivergence is when we recognize that an individual is not learning, thinking, behaving or interpreting the environment or information given to them to what our neurotypical standards are. So what are those standards? Let's talk about heightened anxiety and brain fog.

0:12:10.5 Holly Foxcroft: And we have a woman who is in a senior position within our company. She's always led with meetings and has quite a lot of responsibility. She comes into a meeting and suddenly she can't remember the word for cup. She has heightened anxiety that for a woman experiencing perimenopause or in the menopause, that heightened anxiety is brought on through that wave or influx of testosterone. And it can see, it can appear through everyday tasks. It could be driving or it can be just leading in meetings. It can be holding conversations and otherwise up until that point they've been very comfortable to do so. It can be hosting interviews. Now that is neurodivergence in that that heightened anxiety means they can't do the tasks that either they could do before or that they now need further support for.

0:13:02.5 Emily Wearmouth: Right.

0:13:02.8 Holly Foxcroft: That is acquired. Also let's...

0:13:03.5 Emily Wearmouth: That's fascinating.

0:13:05.5 Holly Foxcroft: A stroke victim, the way that they can communicate and process information. So that processing of information, let's say temperature or processing conversation, it then takes longer for them to answer back. That neurodivergence is the processing and then that conversational social side. Sorry.

0:13:27.8 Emily Wearmouth: Well, when we're talking about neurodiversity, then we are not just talking about things that people are born with. If they're lucky, they early on in life get a diagnosis and they can immediately start to learn. We might be talking about someone who's been in our team for five years and suddenly have different needs that they might be trying to work out at the same time that you are trying to work out. So that's a whole different challenge in a lot of ways.

0:13:49.6 Holly Foxcroft: It is a different challenge. And this is the importance of neuro-inclusion that doesn't just focus on your neurodivergent team members. A true act of neuro-inclusion is accessible to every person. Because, I'm gonna also say that actually if we look at women, we may be neurodivergent every two weeks of the month. [laughter] And that can mean that heightened anxiety, the stress hormone cortisol is often raised, meaning that they may act differently. And I don't think I've ever spoken to a woman that has not been shamed for how they act when they are at certain points in their cycle.

0:14:27.0 Emily Wearmouth: Yeah.

0:14:27.6 Holly Foxcroft: Now, I'm not saying that this is neurodivergence. What I'm saying is true act of neuro-inclusion, respecting neuro-inclusion, is having support for individuals to lean into as and when they need it, and not just having that people have to ask for these accommodations. What could that look like for a person who is going through really heightened anxiety, meeting structure, having information given to them in advance, the length of meetings, working from home. Having heightened anxiety about traveling into an office is, it can be really difficult. Particularly if we go back to our menopausal senior woman that can actually be quite an anxious thought for her is suddenly then traveling. It's a really common one. But it's then widening the conversation to then help us understand, we all have a relationship with what neurodivergence can look like. It's how we accept it. How do we accept what neurodivergence actually is beyond only appreciating those superpower statuses. We need to understand more about what support mechanisms we need to be able to give to people.

0:15:37.6 Emily Wearmouth: So on that, I would love for us to spend a minute talking really practically. Imagine I'm security leader. I run a team. Within that team, I naturally, whether I'm aware of it or not, have a range of neurodiversity members with different needs. What are some of the things that I could practically be doing without knowing the ins and outs of their diagnoses to help them to open up the conversations and to practically put in place some mechanisms that might support them?

0:16:07.1 Holly Foxcroft: So that's a really loaded question because you may have two autistic individuals within your team. And you may then start trying to learn and understand autism more, and then approach your team members with support, with your understanding of what an autistic individual needs. That's not what that person needs. You meet one person with autism, and you've met one person. So the first rule is one, make it about everyone, not just your neurodivergent team members, because then you are not singling them out and making them feel like they're the ones that have to ask for special accommodations. Two, is training. Train yourself to understand, what is neurodiversity? How do I support neurodivergence as a manager and a leader? I'm gonna say elephant in the room here, and I say this as a neurodivergent individual, I can be very difficult to manage. I know I can be. My manager...

0:17:05.8 Emily Wearmouth: Profession time.

0:17:07.3 Holly Foxcroft: If he is listening to this and he's heard me say this before, he's usually laughing and nodding. And he has had to learn specifically about conflict resolution when working with neurodivergence. So training is then your next part. And then the third part that what you can actively do is engage with your HR in rolling out Neurodiversity Passports. Now, I have developed Neurodiversity Passport that I can share. And it doesn't specifically look at neurodivergence. It just looks at preferences and accommodations of what you may need to help get the best out of you that aren't all singing and dancing and suddenly we have to buy thousands of pounds worth of software. It's by identifying, Okay, well this may be an area where actually I can or may need some extra support. And things that you could put more autonomy of the individual to have ability to make those changes rather than always relying on the manager.

0:18:06.2 Emily Wearmouth: You know those profiling things that workplaces love to do, and they put you in a, whatever Myers-Briggs or whatever psychological box you get put into, and then they give your colleagues a list of better ways to work with you. It sounds like that, but without it being imposed on you. It sounds like you actually get to opt into your own requests for how people might more successfully work with you.

0:18:25.0 Holly Foxcroft: So I have taken many psychometric tests and if I'm completely honest, they seem like horoscopes to me.

[laughter]

0:18:32.5 Holly Foxcroft: Yes. We all share characteristics. I mean, let's think of someone's, some of them are color profiling. Oh, I'm yellow.

0:18:40.0 Emily Wearmouth: Yeah.

0:18:40.2 Holly Foxcroft: Oh, I'm red. We don't get on. We don't all fit in those four categories. We may have a little bit of this and a little bit of that. What a neurodiversity passport leans into is where is that specific support needed? Like, yes, I may be a yellow person. What does that mean to a manager? Absolutely nothing. I need clear structure in the form of diaries that I may need help putting together because I have executive dysfunction. That would actually help you manage me. But it's, it very much again, then takes away the focus of just supporting neurodivergence. It makes it about everyone that everyone can lean into, and it's just a more open culture. It's a more inclusive culture on the organization that that's just what you do, because also it's the right thing to do. It is the right thing to do to give that support and understanding to people who I can almost guarantee up until this point in their lives, they probably wouldn't had that much support and understanding, and always feels a little bit ostracized. Always made to feel a little bit different because the way that they work, the way that they think, the way that they socialize isn't always accepted.

0:19:50.0 Holly Foxcroft: So I've never come across an active neuro inclusion that has disadvantaged anyone. Neuro inclusion benefits everyone in the team because we all have characteristics. It's just that some of those characteristics, preferences, triggers and needs may be higher needs than others.

0:20:10.5 Emily Wearmouth: That's an interesting point because I think sometimes people worry that you perhaps might overly pander to certain team members to the disadvantage of others but you're absolutely right that what you're suggesting is actually empowering your team to open up to conversations about what they need to be more effective at their job. And whether those needs are driven by neurodiversity or by something else perhaps being a parent or what else might be going on in their lives, it advantages everybody.

0:20:37.3 Holly Foxcroft: And then it also supports the organization because there's a lot of misunderstanding around reasonable adjustments. So the reasonable adjustment for many, they think it's just to support the individual, but it's also to support the organization and the manager and the role of what that individual is doing as well. Training and having a clear understanding about what reasonable adjustments actually look like is widening the conversation beyond just that neurodivergent individual. It's actually business continuity then. How do you actually support the business? But also this is really pertinent because so many people are understanding their neuro status, they're receiving that diagnosis and they're expecting these accommodations. So you need to know where your limitations are and understand what you can feasibly give.

0:21:25.9 Emily Wearmouth: And should security leaders be going to their HR teams? Would you expect HR teams in sort of mid to large organizations to have some sort of resources that they can point leaders to?

0:21:36.3 Holly Foxcroft: I'd hope they'd be running towards each other, that HR teams are running towards their leaders and the leaders are running towards them and they've both recognized that this is an area that needs support. Now it is most likely recognized by security leaders because they're the ones at the front line. They are the ones who are leading very neurodiverse teams. We have higher statistics in cybersecurity of neurodivergence. HR may not know that because they don't work directly with them. But the security managers, leaders, they're the ones that go, Well, okay, I have teams here and they are struggling. Neurodiversity is a topic widely discussed within the cybersecurity community. And it's widely recognized. It's not something we shy away from. So I would like to say it's a conversation where both HR and your security leaders are both trying to get to the top of this.

0:22:38.4 Emily Wearmouth: We talk about how important it is that we don't overly focus on these superhero qualities of neurodivergence and understand that neurodivergent people are a package, they're a nuanced individual flavour of their own thing, but how do we make sure that we don't move too far down the other way and talk about just the weaknesses or the challenges or the special allowances that they require. How do we keep a balance in this conversation?

0:23:02.2 Holly Foxcroft: It's believing lived experience and listening to lived experience. So listening to how does it affect people and believing them, meeting it with empathy and understanding. It's understanding where does neurodivergence actually affect the individual that you can help them with. Recognizing that strength-based model just within them, not overarching, not that, oh you're all a mathematical genius, but what is your specific strength and helping actually bring that out and celebrate that and not making people feel like they just can't be accepted or validated if they don't just share those unique qualities of what we've all come to accept as an autistic individual.

0:23:52.3 Emily Wearmouth: Right, so less stereotyping and more really looking at the individual, just as you would any member of your team.

0:23:57.7 Holly Foxcroft: Yeah.

0:23:58.4 Emily Wearmouth: So I've seen some of your LinkedIn posts, one in particular, I loved you. It was a very specific tip that helps you stop procrastinating over admin tasks that you identified as a problem area for you. And you go to a cafe, you put two hours in the parking meter and you're on the clock and actually, I think it's genius. So, and that obviously all helps raise awareness. What are some of these ways that you're helping contribute to the conversation? What are you doing to raise awareness?

0:24:25.1 Holly Foxcroft: So I like to share my own lived experience, but also by giving explanation as to why I do these things. So from when I shared about working in the cafe and putting that 2 hour parking limit on, so this is actually talking about honoring my ADHD neuro type. The reason working from a cafe and the two hour parking limit is because I have an ADHD brain, which means I am dopamine deficit. For me, working in a cafe is that new environment. It's exciting. I also made like, let's have a cake and really cool coffee.

0:25:01.8 Emily Wearmouth: It's a winner.

0:25:02.9 Holly Foxcroft: It is a winner. But actually working from a new environment is stimulation for me and my break. Two hour parking limit then puts a sense of urgency on me to be able to do what I need to be able to do. Because that is actually what's called executive dysfunction, which means, which part of it can mean I have trouble initiating tasks. That has, probably like saying that stopwatch, it's like saying, you've got to do this now, you've got two hours. And it sets me in motion. It means that I then suddenly work at my best within that two hour limit that I can then concentrate and get lots done. It's often said with people with ADHD we can get things done within one to two hours that some people can take seven to eight hours but then we can spend seven to eight hours doing absolutely nothing because we lack in that dopamine and executive dysfunction.

0:26:03.6 Emily Wearmouth: I'm laughing 'cause it sounds familiar. [laughter]

0:26:08.6 Holly Foxcroft: I am honoring my needs as an ADHD. I have spent time with myself and learning what works for me. I am not saying that this works for every ADHD out there, but also I need nudges. So I rely on software to help me do that because otherwise if I can't see it, it doesn't exist. And when I write something down that I need to do and then I close that book, it's gone forever. It's gone into the abyss. So I've learned how to recognise, actually how does my ADHD show up? And I will tell you now the amount of private messages I receive from my LinkedIn posts. When I post about recognizing how neurodivergent shows up with people saying, can I have a talk? I wanna talk to you about myself. But having these honest conversations and showing outside, because if we think of ADHD, most of us will think young boy, disruptive in a classroom with behavioral problems. It doesn't look at trouble with understanding time differences, executive dysfunction.

0:27:13.1 Holly Foxcroft: And in a woman, we have mainly what's called inattentive ADHD, where it doesn't present on the outside, so that hyperactive side, but we are hyperactive. It's just all in our minds. It's like we've got 27,000 tabs open, one's playing music and we don't know which one to open first. So that hyperactive is actually all internal, which again then feeds into more co-occurring poor mental health, such as heightened anxiety, poor self-imagery as well, and self-loathing. You know that you just don't understand why you can't do these things.

0:27:49.4 Emily Wearmouth: Yeah, yeah. I'm not surprised that people message you, that you're getting messages, 'cause when I've seen your posts, they are definitely, and I would recommend people find you on LinkedIn and have a look at your post. I find them very tangible, pragmatic, honest. They're not hypothetical and overly grandiose posts about neurodiversity. And I think that's the value in them. They're very much lived experience and little snippets that you can take away and think about how you behave, how your mind might benefit from different behaviors, but also those that you work with as well. I think more of it, Holly, it's great.

0:28:21.0 Holly Foxcroft: Thank you. And I think that's what I bring when I support employers. It is about making sure that the organization understands to make sure they can feasibly support that. So supporting the employers and the business to understand neurodiversity is very much now about business continuity because the rates that there have been tribunals and court cases of organizations being sued because they haven't supported their neurodivergent workforce is skyrocketing. It's one of the leading court cases, workplace court cases.

0:28:55.0 Emily Wearmouth: Wow, so it's not a nice to have, it's an imperative.

0:29:00.5 Holly Foxcroft: A must-have. It's healthcare. This is what I will leave our audience with. Supporting neurodiversity is actually supporting healthcare. It's supporting mental health and it's supporting overarching DE&I initiatives because they are all intersectional.

0:29:13.0 Emily Wearmouth: Brilliant. Well, that is a brilliant place to end it, Holly. Thank you ever so much for taking the time to speak to me. As I think I said as we chatted, I find this whole thing fascinating. I'm aware there's so much I need to learn. And so I've just been absorbing as you've spoken, like a sponge. Thank you.

0:29:28.5 Holly Foxcroft: Like a sponge. [laughter]

0:29:31.1 Emily Wearmouth: Like a sponge.

[laughter]

0:29:33.9 Holly Foxcroft: It's been such a pleasure. I really appreciate it. And continuing this conversation is so important.

0:29:39.7 Emily Wearmouth: You have been listening to the Security Visionaries Podcast, and I've been your host, Emily Wearmouth. Please do subscribe to the podcast if you haven't already. Between myself and my co-host, the marvellous Max Havey, we air fresh episodes every few weeks and we cover loads of interesting topics. For newer listeners, there's plenty already in our back catalogue for you to enjoy. Thank you very much for joining us, Holly, and we'll catch you next time.