Thousands of college students had their final exams rescheduled and their grades delayed when the Canvas platform was hacked earlier this month. The group ShinyHunters claimed responsibility for breaching Instructure, the company behind the learning management system used by about 40% of universities. The attack exposed student names, email addresses, ID numbers, and communications from some institutions. Google’s Threat Intelligence Group has disclosed that criminal hackers had used an A.I. model to discover and weaponize a previously unknown software flaw that could have caused “a mass vulnerability exploitation operation.” Together, these incidents signal the increasing frequency of cyberattacks. The tools behind them are getting faster, cheaper, and more autonomous. The deeper question is who is defending against them.
According to an the ISC2 Cybersecurity Workforce Study, there is a global shortage of 4.7 million cybersecurity professionals. Closing that gap requires looking much earlier in the pipeline, before students have already decided their path. Interest in computer science peaks in middle school and then drops sharply. Research from Girls Who Code found that 70% of teen girls express interest in cybersecurity, with interest peaking around age 16, but most never pursue it. Many are discouraged by a lack of confidence in their abilities, limited exposure to what the field actually involves, and little awareness of the range of careers cybersecurity offers. Today, women make up less than a quarter of the cybersecurity workforce.
As A.I. changes the speed and scale of cyberattacks, the workforce shortage becomes even more urgent. The tools are growing more powerful, but even some of the people building them believe A.I. cannot be the sole defense. Dr. Zico Kolter, an OpenAI board member and Carnegie Mellon computer scientist, recently told The New York Times: “You still need a software architect in the loop.” People who can spot patterns, think like an adversary, weigh competing risks, and make high-stakes decisions are needed in this process.
In According to Fortinet’s latest report, professionals cited the lack of IT skills and training as one of the top three causes of breaches. The rise of A.I. has raised the stakes for what people must be trained to do. Defending against cyber threats requires more than technical skill. It requires understanding how digital abuse targets real people and how vulnerabilities can be exploited. If the people building and protecting our systems do not reflect the people who rely on them, those systems will be weaker for it.
This is why who we recruit into cybersecurity matters as much as how many people we recruit. When women enter cybersecurity, the field benefits. Research by Women in Cybersecurity shows that women in the field outperform their male peers in communication, coordination, and risk evaluation. These are core capabilities in a profession that depends on technical knowledge, judgment, collaboration, and the ability to respond under pressure. However, representation drops sharply over time and falls even further at senior leadership levels. This reflects workplace structures that have consistently failed to support women’s advancement.
We know how to prevent women from leaving the field. Women in Cybersecurity has identified concrete interventions that work: panel-based promotion decisions, internal skills profiles that support career growth, and structured mentoring programs. Companies that adopt these practices have meaningfully increased the number of women in management by as much as 20%. The same principle holds earlier in the pipeline. A recent Girls Who Code study shows teens are 16 times more likely to learn about cybersecurity careers through out-of-school programs than through traditional classrooms. If we are serious about securing our digital future, we need to invest in the next generation of defenders well before graduation.
Those entering the industry often do not follow a direct path. In 2020, when attackers compromised the Twitter accounts of high-profile figures, Rachel Tobac, an ethical hacker who studied neuroscience and behavioral psychology before entering cybersecurity, was among the first to correctly diagnose the attack as a social engineering breach. She published guidance helping other organizations protect themselves. When WannaCry struck NHS hospitals in 2017, Amanda Rousseau, a malware researcher who started as a graphic design major, reverse-engineered the ransomware to understand how it worked and how to stop the next one. Neither took a traditional path in. Both became the kind of defender the field needs.
Our strongest defense will require both A.I. tools and human judgment. That means building an inclusive, better-prepared, and more representative workforce — on hiring and promotion practices that do not filter women out, on pathways that open well before college, and on educators who show students the full breadth of this field.
Canvas came back online within hours, and Google prevented a major attack before it began. As attacks become more frequent and sophisticated, defending our systems will demand a deeper bench of people ready to defend the systems on which our lives depend. Seventy percent of teen girls already say they are interested. Our job is to make sure the door is open by the time they get there.
The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.
