Cyber security is an art, not a science

23 April 2018

I’m James Hampshire, a Senior Manager in PwC’s cyber security team, and I work with clients across the UK to help them address their big cyber security challenges.  As a cyber security professional with a non-technical degree (actually, two if you ask: undergraduate history and postgrad war studies!) I’m always really interested in my colleagues’ backgrounds.  We have a really diverse bunch at PwC, ranging from new politics grads to a crypto PhD. Most interestingly our head of research (who presented at the last DEF CON conference) got his degree in English Language and Literature!

Although arts degrees often come in for a lot of criticism for not teaching practical work-based “hard” skills, I am a strong believer that a good arts degree coupled with a willingness to learn forms the basis of many a successful professional.

Interestingly my old university, the University of Nottingham, lists the skills it believes undergraduates get from a history degree.  In my opinion these skills have a massive application for cyber security.

Objective thinking plus the ability to consider a range of viewpoints

Increasingly there is a realisation that there is no “right answer” to many of the big cyber security challenges we face (just look at the debate over passwords).  Equally, I have previously written about how empathy is a really powerful tool in cyber security.  So the ability to appreciate a range of viewpoints before forming your own is really valuable.

Critical reasoning and analysis; gaining evidence and communicating findings in a clear structured manner; problem-solving and creative thinking; Communication both orally and written

Some cyber security challenges are scientific, mathematical, or data-driven, but many are much more subjective. The ability to collect, collate, assess, and analyse large volumes of qualitative data is hugely important, as is the ability to present it concisely on paper and verbally.  A CEO does not want to be told what his or her risks are in minute technical detail; they want a to the point briefing on how it affects the bottom line. This is also increasingly important in a world where compliance- or controls-based approaches do not equate to security.

Planning and researching written work

The cliche that history students only have a few hours of lectures a week is certainly true in the final year of an undergraduate degree, but throughout the years history students are generally required to self-direct their own workload much more than many other subjects. From personal experience, the ability to self-task, plan and organise your time is an absolutely crucial skillset in cyber security consulting (which is the reason I am writing this blog on a train!).

So what?  I think there are some key takeaways from this blog.

  1. Cyber security is not (just) a game of tech vs tech.
  2. No matter what your background, you could have skills which the industry needs.
  3. Given the shockingly low numbers of girls studying STEM subjects, tapping into the arts is one of the ways in which we can increase gender diversity in the cyber security industry.
  4. Don’t let preconceptions on what you think a cyber security professional looks like stop you from exploring careers in the industry. Check out our careers website for information on cyber security opportunities at PwC, whether you are looking for a first job or are an experienced professional looking for a change.


Great article. I would also do a call out for philosophy too. Being able to identify 'truth' is important ('If you are looking for truth, Dr.Tyree's philosophy class is down the hall'). If anything I see technology as pretty transient. There is always the 'next new thing', whereas some of the big themes from classical history, philosophy and art ring true down the ages.

Verify your Comment

Previewing your Comment

This is only a preview. Your comment has not yet been posted.

Your comment could not be posted. Error type:
Your comment has been saved. Comments are moderated and will not appear until approved by the author. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.


Post a comment

Comments are moderated and will not appear until the author has approved them.