So Your Kid Asks What You Do All Day

If you work in cybersecurity, there's a reasonable chance you've spent years learning how to explain complicated technical problems to people who don't particularly want to hear about them. You've presented security risks to company directors, persuaded colleagues to update their passwords and explained to customers why something that appears to be working perfectly well might actually be vulnerable.

But explaining what you do for a living to your ten-year-old (and yes, in this case, your potentially fictional child) might be a completely different challenge.

You could tell them that you work in threat intelligence, network security, penetration testing or incident response, but there's a fairly good chance you'll receive a blank stare before they return to whatever they were doing.

And while cybersecurity is increasingly finding its way into schools, particularly through lessons on online safety, privacy and responsible technology use, understanding how to stay safe online isn't quite the same as understanding what the cybersecurity industry actually does.

So, for those of you working in cybersecurity who have ever been asked what you do all day, here are a few ways to explain your profession to your children. You might even find yourself borrowing some of these explanations for your next meeting with senior management.

Start with something they actually care about

The biggest mistake might be starting with cybersecurity itself.

Most ten-year-olds probably aren't especially interested in network architecture, vulnerability management or the differences between endpoint detection and antivirus software. But they may be very interested in what happens to their favourite video game if someone steals their account.

For many children, gaming is an excellent introduction to understanding digital security because they already understand the value of the things they're protecting.

An account might contain characters they've spent months developing, items they've worked hard to unlock or virtual currency purchased with birthday money. Losing access to it would be genuinely upsetting, even if an adult sees it as nothing more than a computer game.

This is a useful starting point.

You could explain that your job involves helping people and businesses protect things they value online. For children, that might mean their game accounts, photographs or messages. For a company, it could mean customer information, business systems or the ability to continue operating.

The underlying idea is similar, even though the technology involved can be much more complicated.

You can also turn the conversation into a small exercise. Ask your child what they would do if someone sent them a message offering free gaming currency in exchange for their password.

They might immediately recognise the problem. Alternatively, they might explain why the offer sounds convincing.

Either response gives you an opportunity to talk about how attackers use people's interests to trick them, without needing to introduce the terminology of social engineering straight away.

And if your child already knows all of this, you can move on to explaining why adults continue falling for remarkably similar tricks.

Explain what your company actually sells

This is where things can become surprisingly difficult, even for people working in the industry.

Children generally understand businesses in fairly straightforward terms. A bakery makes cakes, a shop sells things and a mechanic fixes cars. But what does a cybersecurity company sell?

For some companies, the answer is software. They develop products that help organisations protect computers, detect suspicious activity or control who has access to information.

Other companies sell expertise. They employ people who investigate cyber incidents, test security systems, advise businesses on managing risks or help organisations recover when something goes wrong.

Some do both.

A simple explanation might be that businesses pay cybersecurity companies to help stop criminals getting into their computer systems, protect important information and fix problems when attacks happen.

You could then explain what your own organisation does within that much larger industry.

If you work for a company developing security software, explain that you help create tools other businesses use to protect themselves. If you work in consultancy, you help organisations understand where they might be vulnerable. If you work in incident response, you're one of the people they call when something has already gone wrong.

For children who are curious about how businesses work, there's another question worth discussing: why would a company pay someone else to do cybersecurity instead of doing everything itself?

The answer is fairly straightforward. Most organisations want to concentrate on whatever they're good at, whether that's making cars, running hospitals or selling groceries. They may not have the people, knowledge or resources to manage every aspect of cybersecurity themselves.

That's why specialist businesses exist.

It's also a useful way to introduce the commercial side of the industry. Cybersecurity isn't simply a collection of people stopping hackers. It's a global business in which companies develop products, compete for customers and provide specialist services.

Give them permission to be the hacker

This one might initially sound like an unusual parenting suggestion, but it can be a good way to explain one of the more interesting parts of cybersecurity.

Children may already have encountered the word hacker through films, television or video games, where hackers are often portrayed as mysterious figures doing something illegal.

The reality is rather more interesting.

Some cybersecurity professionals are employed specifically to find weaknesses in computer systems. With permission, they attempt to identify vulnerabilities before criminals can exploit them.

You can demonstrate the principle without going anywhere near a real computer system.

Create a simple challenge at home. Put a small prize inside a box and ask your child to work out whether it can be opened without using the intended method. Alternatively, create a puzzle with a rule that appears secure but contains a deliberate weakness.

The aim isn't to teach them how to break into things. It's to demonstrate why testing something from a different perspective can reveal problems that the person who designed it didn't notice.

Once they've found the weakness, ask them how they would fix it.

That's the more important part of the exercise.

A penetration tester doesn't simply identify ways a system might be compromised. The findings are used to help the organisation understand and address its vulnerabilities.

You can also explain why permission matters. Finding a weakness in something you've been invited to test is different from attempting to access someone else's accounts or systems without authorisation.

It introduces the idea that technical ability comes with responsibility, while giving your child something more engaging than a lecture about network security.

Show them that cyberattacks aren't always about technology

One of the most useful lessons you can share is that successful cyberattacks often involve convincing people to do something they wouldn't normally do.

You don't need to explain the mechanics of a phishing campaign to demonstrate how it works.

Instead, write two short messages. One might be a genuine-looking notification from a gaming platform, while the other could contain a suspicious link, an unexpected request or a promise that sounds too good to be true.

Ask your child which message they would trust, and why.

What matters is the conversation that follows. You can talk about how someone might pretend to be a familiar company, create a sense of urgency or make a message appear more convincing by including details that seem personal.

It is worth avoiding the suggestion that suspicious messages are always full of spelling mistakes or obvious errors. Some are carefully written and can be difficult to distinguish from legitimate communications.

You can also explain that cybersecurity professionals encounter similar problems in large organisations.

A criminal might send a convincing message pretending to be a senior manager, a supplier or a trusted service provider. If someone follows the instructions without verifying them, the consequences can be considerable.

This is why cybersecurity involves psychology, communication and understanding human behaviour, as well as technology.

For a child, the practical lesson is not that everyone online should be treated with suspicion. It's that unexpected requests deserve a little thought, particularly when they involve passwords, money or personal information.

Let them see what happens when things go wrong

Children are often familiar with the idea that computers can stop working, particularly when it happens just as they're about to play a game or watch something.

That frustration can help explain another important part of cybersecurity.

Imagine a shop suddenly loses access to its payment systems. Customers are waiting, employees can't process purchases and nobody knows how long the problem will last.

The business needs people who can investigate the cause, restore services and work out how to prevent similar incidents in the future.

Now imagine the same problem affecting a hospital, airport or factory.

The consequences could be considerably more serious.

This is where incident response, digital forensics, business continuity and recovery become easier to explain. Your job might involve finding out what happened, determining which systems were affected and helping an organisation return to normal operations.

Not every technology failure is a cyberattack, which is another useful distinction to make. Sometimes systems fail because of faulty software, equipment problems or mistakes.

But cybersecurity professionals often need to understand whether an incident was accidental or malicious and what needs to happen next.

You could even ask your child to imagine running a small business for a day. What would they need to keep working? What information would they want to protect? What would they do if their computers suddenly stopped working?

Their answers may be wonderfully impractical, but the exercise introduces the idea that cybersecurity is connected to the real world and the services people depend on.

Don't forget the people who make the rules

If your work involves cybersecurity policy, regulation or governance, explaining your job may require a slightly different approach.

Not everyone in cybersecurity builds software, investigates attacks or tests computer systems. Some people work on the rules, responsibilities and decisions that shape how technology is used.

You could start with something children are already familiar with, such as the rules governing a school.

Schools have rules about who can enter particular areas, how personal information is handled and what happens when someone behaves in a way that puts others at risk.

Digital systems need rules too.

Governments establish laws about cybercrime and data protection. Organisations develop policies determining who can access information and how incidents should be reported. International institutions work on agreements and cooperation between countries.

These are different responsibilities, but they all influence how cybersecurity operates.

There are also questions that don't have straightforward answers.

For example, should a company be allowed to collect large amounts of personal information if it believes doing so will help prevent cyberattacks? How should governments protect people online without unnecessarily interfering with their privacy?

Children may have their own opinions on these questions, particularly if they understand what it means to have personal information shared without permission.

These conversations can help explain why cybersecurity is connected to law, politics and society, rather than existing only inside computer systems.

You don't need to explain everything in one conversation

There's a temptation, particularly when explaining something you know well, to include far more information than the other person actually needs.

You start with a simple explanation of passwords and, before you know it, you're discussing encryption standards and identity management.

For children, it is usually more effective to follow their curiosity.

If they ask how hackers get into accounts, talk about passwords, scams and security weaknesses. If they're interested in how your company makes money, explain the products and services it sells. If they want to know what happens when a major business is attacked, explain how people investigate and recover from incidents.

There is no need to turn a conversation at the dinner table into a cybersecurity training course.

It can also be useful to let children challenge your explanations. Their questions may reveal assumptions that adults working in the industry take for granted.

Why do people keep using passwords if passwords can be stolen? Why are companies allowed to collect information they might lose? Why do some organisations spend so much money on cybersecurity and still suffer attacks?

These are entirely reasonable questions, and not all of them have simple answers.

In fact, some are the same questions cybersecurity professionals, researchers and policymakers continue to debate.

You might learn something too

Explaining cybersecurity to a child requires you to think about what your work actually achieves, rather than the terminology your industry uses to describe it.

It can be surprisingly easy to get caught up in technical products, acronyms and specialised roles, particularly when you've worked in the sector for years.

But outside the industry, people are generally less interested in the individual technologies than in what those technologies allow them to do.

They want their information protected, their accounts accessible and the services they depend on to work reliably. Businesses want to serve customers, protect their operations and avoid disruptions that could cost them money.

Cybersecurity makes an important contribution to all of those things.

And while explaining your job to a ten-year-old isn't likely to replace a professional security qualification, it might offer a useful reminder of why the work matters.

The next time your child asks what you do, you don't need to give them your job title followed by a lengthy explanation of the technology involved.

Start with something they're interested in, explain the problem your work helps solve and see where the conversation goes.

They might surprise you with how much they already understand. They might even ask a question you haven't considered before.

Or they might listen politely for thirty seconds before asking whether you've finished and if they can go back to their game.

Either way, you've probably made cybersecurity a little more understandable.