Cognitive Risk, Neurodivergence, and the Unspoken Realities of Security Leadership

The Expanding Definition of “Security”

Traditional models of cybersecurity prioritize perimeter defense, compliance, and technical readiness.

However, my growing body of qualitative insight - echoed in conversations with professionals like Val Popke, a former Air Force Inspector General and assurance leader - suggests that the primary risk vector today may be internal: emotional exhaustion, communicative breakdown, and the slow erosion of psychological safety within teams.

The future of cybersecurity leadership must encompass not only digital resilience, but also cognitive and organizational resilience. Security strategy that ignores psychological safety is incomplete - and ultimately, unsustainable.

Hiring and Talent Systems Are Failing Security

Val highlights a growing dysfunction in hiring systems across the industry: technical professionals are increasingly evaluated through superficial proxies - keyword filtering, personal branding, and performative communication styles - that do not correlate with true competence.

These patterns disqualify deeply qualified professionals and perpetuate what she terms “veneer security”: surface-level assurance without meaningful depth.

This disconnect is especially acute in Governance, Risk, and Compliance (GRC) roles, where methodical reasoning and cognitive nuance are critical.

By optimizing for vanity over depth, organizations are undercutting their ability to recruit the very expertise needed to manage complex, evolving risk environments.

Neurodivergence Is a Structural Reality in Cybersecurity

A consistent but under-acknowledged theme across the security workforce is the high representation of neurodivergent individuals - those with cognitive conditions such as ADHD, PTSD, and autism spectrum traits.

Many professionals enter the field not just for technical interest, but because cybersecurity offers a space where structured thinking, deep focus, and values-driven work align with their strengths.

Yet despite this, corporate environments - especially at scale - remain calibrated for neurotypical norms.

Communication expectations often rely on indirect language, social nuance, or implicit hierarchy, which create friction for individuals who prefer direct, high-context interaction.

This misalignment leads to disengagement, misinterpretation, and exclusion of critical perspectives.

We must recognize that neurodivergent inclusion is not an edge case.

It is a structural condition of the security workforce - and it must inform how we design teams, communication systems, and leadership training.

The Cost of Psychological Insecurity

Val outlines a growing concern:

Many security leaders are protecting their organizations from both external actors and internal culture simultaneously.

When corporate environments are punitive, opaque, or misaligned in values, they produce conditions of chronic stress - where professionals are incentivized to hide risk, downplay concerns, and defer truth to protect themselves.

In these environments, psychological insecurity becomes a form of systemic risk.

Leaders are forced to choose between transparency and self-preservation.

This is especially dangerous in assurance and audit contexts, where organizational blind spots can proliferate under the guise of compliance.

Reframing “Diversity”: From Compliance to Cognitive Cohesion

One of Val’s more provocative contributions is a linguistic and philosophical reframing of “diversity.”

Drawing on etymology and cognitive science, she proposes the term “coversity” - a deliberate shift from the etymological roots of “diversity” (which historically carry associations with division and othering) toward a framework based on mutual understanding, shared narratives, and collaborative cognition.

“Coversity,” as she defines it, refers to the act of turning toward one another - confronting not in opposition, but in mutual recognition.

Within this model, inclusion is not performative or hierarchical - it is co-creative.

For security leaders, this reframing invites a deeper level of reflection:

Are we merely representing difference or are we operationalizing it?

Veterans, Camaraderie, and Mission-Driven Identity

Val, a veteran herself, also observes a strong correlation between military backgrounds and cybersecurity roles.

The reason is cultural:

Both domains demand trust, mission orientation, and operational rigor.

Many veterans find purpose in cybersecurity because it mirrors the disciplined, values-driven work they experienced in service.

However, this mission-driven identity can be at odds with contemporary corporate cultures that prioritize optics, shareholder primacy, or abstract performance metrics.

When there is a mismatch between organizational values and the intrinsic motivators of security professionals, disillusionment and attrition follow.

Recommendations for Security Executives

To address these challenges, security leaders must move beyond technical acumen and adopt a more integrative leadership model.

The following are proposed as foundational shifts:

• Adopt trauma-informed and neuro-inclusive leadership principles: Understand the cognitive diversity of your team not as an HR initiative, but as a strategic asset that requires adaptive communication and structural support.

• Redesign hiring and promotion criteria: Optimize for lived experience, reasoning ability, and mission alignment - especially in assurance, risk, and compliance roles.

• Promote epistemic humility in executive decision-making: Foster a culture where truth is valued over appearance, and where dissent and discomfort are not punished but used to strengthen organizational intelligence.

• Embed psychological safety into security frameworks: Integrate cognitive risk into threat models. Treat organizational fear, silence, and burnout as vulnerabilities - not cultural inevitabilities.

Final Thoughts

Cybersecurity leadership is undergoing a necessary transformation.

It is no longer enough to protect digital infrastructure; we must protect the conditions under which people can think clearly, speak candidly, and act ethically.

That requires not just new tools - but new language, new systems, and a fundamentally more human form of leadership.

Until next time,
Dani