Autism, Cybercrime, and Securitys Skill Struggle

People on the autism spectrum often possess traits that could help them succeed in cybersecurity – providing they dont fall into cybercrime first.

Many cybercriminals arent diagnosed with autism until they enter the criminal justice system – and the same traits that lead them toward digital crime could potentially help them fight it.
Rebecca Ledingham, vice president of cybersecurity at Mastercard, spotted the trend earlier in her career as a cyber agent for the UKs National Crime Agency. They werent the kinds of offenders I was used to dealing with in drugs and sex crimes, she said in an interview with Dark Reading. Their social behavior, she said, was different from what shed seen in other areas of crime.
Often, she continued, cybercriminals are first diagnosed as being on the autism spectrum during the criminal justice process. Later in her career, as a cyber agent for INTERPOLs Global Complex for Innovation (IGCI), she realized the issue was broader. Ledinghams work with global agencies revealed outside of cybercrime, no other offense came with a foundational condition. Theres no other organic set of offenders that may be predisposed to cybercrime due to the nuances of their disorder, she said.
Autism presents itself at the age of two or three, and more than 17 million people worldwide are diagnosed, said Ledingham in an RSA Conference talk. Their curiosity and eagerness to solve problems, among other traits, can lead them into dangerous areas, especially online.
Traits on the autism spectrum that lead folks into cybercrime could work just as well in a security operations center – but its essential to understand the nuances of these behaviors because no two people with autism have the same set of characteristics. As Lysa Myers, ESET security researcher, put it: If youve met one autistic person, youve met one autistic person.
So which traits lend themselves to careers in tech and, specifically, cybersecurity?
Oftentimes people with autism are very good with math and science, said Ledingham in her talk. IT is logical and syntax-guided; there is usually one way of doing things. Many people with autism are pattern-thinkers, she added. If you look at a piece of code and its missing a semicolon, you would notice because the pattern doesnt fit, she said.
Many people with autism are hyperlexic, an autism-related term for those who are intensely interested in letters and numbers and who possess an advanced reading ability. For them, it would be simple to switch between English and coding, as they could easily understand both.
A photographic memory is another trait seen in people with autism, Myers said. Its another quality that could, for example, help them think of a network architecture and visualize security holes.
People with autism are very focused on problem solving, Ledingham said. You have a real difficult problem … they will focus on it until its solved. Theyre detail-oriented, rule-oriented, and they have the tenacity to stick with complex issues other people may abandon.
So Why Turn to Cybercrime?
Our scientific and digital world has been built on the output of the autistic mind, Ledingham said. Still, there are a number of complicating factors that make it more likely that people with autism will fall into cybercrime rather than start a security career.
For starters, many struggle with social anxiety. They avoid eye contact and/or suffer from depression, social isolation, and a high need for control. Most people Ledingham worked with tried to get the academic credentials to legitimize themselves but failed to succeed in college – an atmosphere characterized by social interactions and a lack of routine or control.
For some people, college can be really overwhelming, Myers said. They can have poor grades and not make it through. As a result, they lack the degree needed for most security jobs.
But on the Internet, they could be who they want to be. People who are bullied in real life can have a plethora of friends online, Ledingham added in her talk. When she talks to cybercriminals who have later been diagnosed, she has found gaming is the common thread that lures them into crime. These days, the gateway is Fortnite: Kids as young as 14 are part of a hacking program built around the game.
The police are not interested when your Fortnite account or World of Warcraft account gets hacked, she said. But if kids are cutting their teeth on it, theres no legal consequences.
We have to think of crime profiling differently in cybersecurity, Ledingham emphasized. People with autism often understand right and wrong, but they often dont understand actions and consequences.
Myers is cautious to create a broad link between cybercrime and autism, which covers a broad spectrum of people and capabilities. While I dont doubt some autists have engaged in cybercrime, I am not sure how large the problem is compared with the neurotypical population, she explained. What I do know is that we desperately need people with a variety of different abilities and thought processes to close the cybersecurity skills gap.
What Businesses Should Know
Organizations could benefit by welcoming employees with autism, but many dont know how. People with autism often dont reflect personality in interviews and struggle with behavioral-based questions. You cant ask them to imagine how they might act in a certain scenario, for example. Questions should be specific, literal, and direct. Deadlines should be made clear.
The more you spell things out, the easier it is, Myers said. During the
hiring process
, be specific about each step and expected date of each one. When onboarding new employees, outline what is expected within the first three months and continue to work with them to set goals, schedule deliverable dates, and notify them of any changes. Be clear about what steps youre going to have, whats expected of them, and whats expected of you, she explained.
It helps to approach the hiring process in a project-oriented way, Ledingham said. Give them a project and evaluate their performance, then hire them based on the output of that project. She pointed to Microsoft as an example of a company
with a program
designed for workers with autism.
They now have one of the most comprehensive hiring programs where autism is concerned, she noted.
Related Content:
Web Apps Are Becoming Less Secure
How the Best DevSecOps Teams Make Risk Visible to Developers
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
3 Places Security Teams Are Wasting Time

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Autism, Cybercrime, and Securitys Skill Struggle