"You Don't Have ADHD, Do You?"
What hiding my diagnosis at work looked like
I was sitting across from the man I'd grow to respect, but I didn't know that at the time. I was interviewing for a job in InfoSec, nervous as hell—my annoying tics on full display, metaphorical sweat dousing me in salty water. As a recent Masters graduate I’d of course forgotten everything I'd learned—in fact the moment I stepped foot outside the exam room my mind had been wiped clean as if Will Smith from Men in Black was standing in front of me holding up that mind-erasing dongle. Naturally, when my future boss asked, “What does ‘AES’ stand for?”—an easy lay-up question—I froze like a deer in abyssal headlights. I managed to stumble my way through the rest of the interview and landed the job, but the one question near the end forever stuck with me:
You don't have ADHD or something, do you?
Shit.
I'd been diagnosed a year or two prior.
I did what any self-respecting ADHDer would do, “Nah, haha”—the “haha” emphasised by how awkward the situation was.
From that moment on I never mentioned ADHD, not even in passing. I pretended I didn't have it. I didn't DM those I was certain had it, I didn't peruse Slack for groups to join, nothing. I unADHD'd myself.
Every day was a struggle.
Losing track of a thousand different threads—dopamine deprived days where I couldn't will motivation into existence. Days where I'd be nodding off during meetings, lost with no concrete direction in others.
There was one time during a work retreat when I suspected a workmate. It was just a single cue that gave it away. His watch chimed every hour on the hour. For the uninitiated, people with ADHD can suffer from time blindness—sometimes it literally feels like you materialise into the future. Its intensity can range from, whoa, that was pretty trippy to, oh my god my life is flashing before my eyes. Ever since I discovered my workmate did this with his watch I did the same (vibration only).
The Stakes Had Never Been Hire
There's a duality fighting against each other in InfoSec, specifically in compliance. Whereby on one hand it’s torture for someone with ADHD—sustained attention to procedural details, consistent documentation, meeting-heavy coordination. On the other hand they also select for traits ADHD provides, that is, we’re great with pattern recognition, lateral thinking, hyperfocusing on novel threats, comfort with ambiguity (though not always).
It’s funny because the job description wants one thing yet the actual job demands another. I’ve lived and seen both sides. Our ADHD world is full of these weird dichotomies that never get resolved. There were countless times I recognised vulnerabilities that fell on deaf ears, as if to say, “We'll pay for it in an incident later.”—which oftentimes it did. Whether it was because I was too ahead of the curve, didn’t go through the “proper” channels (bureaucracy, amirite?), or I wasn’t loud enough often enough I'll never know. Each one of these occurrences pings our brain like Pavlov’s bell, telling us we’re doing it the “wrong” way. Which way is “right”? Hell if I know, but in general it means toeing the line, following chain of command—no tall poppies allowed.
One time my boss asked me to organise a phishing campaign. And well ho boy. If you’ve ever gone “all in” on an idea before asking any follow-up questions, this one’s for you.
So I start getting to work on this project—snooping through GitHub for any open source projects, searching online for suitable hosting services to plop the mail server on, doing some whois lookups for potential domains—you know, the usual. To say I
was deep in it was an understatement. I was balls, nay, neck deep. I was engrossed, enthralled, ecstatically exhuberated.
I was in the zone.
My hyperfocus was hyper focused.
The idea of the perfect phishing campaign as my muse was enough motivation for a lifetime. This was it. This was what being in security was all about.
I won't bore you with all the boring details (that and I'm not gonna expose internal system info—even though it was an ephemeral project) but suffice to say it was good. Too good in fact. I perfectly mimicked a realistic email that people might expect. So I had to dumb it down. I introduced intentional errors, think: spelling mistakes, assets that loaded inconsistently—so it ended up closer to a real phishing email you'd see in the wild. It was ready for prime time. After some testing I coordinated with IT to have my phishy domain whitelisted. There were some hiccups, of course, but once they were ironed out it was time to press the big GO button.
Once I clicked it hundreds of laptops, phones started pinging to life and vibrating their hearts out.
Then came the lookie-loos, the sticky beaks, the “I know what I'm doing”ers.
So. Many. Clicked.
I watched as the dashboard lit up, the open rates went through the roof. It was like an email campaign on steroids.
Got ‘em.
Shortly after the dust had settled (I was the only one buzzing, mind you) I had a one-on-one with my boss.
I only wanted you to send a PDF or something.
They still use my metrics years later.
Rules To Live By, Except They’re Invisible
Most people are born with some instinctual playbook, a lobster-guided path to social success. A gentle hand that helps lead the way through hordes of social interactions, this thing means that, that other thing means this. Us with ADHD are not blessed with this. Sure, we’ll recognise that look on someone’s face, but what caused it? Did I say something wrong; insensitive? Did one of my tics discharge right as they were at the most crucial point in their riveting story about how their friend Carol said something slightly bereft of social etiquette, framed as world-ending? Maybe they misconstrued my mind-wandering as lack of interest.
The funny thing about all these social faux pas is there’s never any tangible feedback, and for masters in pattern recognition, this seems like a massive blind spot, an oversight on god’s part—curse you (don’t smite me, twas but a mock curse)! Nobody tells you. Nobody pulls you aside and says, “that was too much,” or, “you’re being weird”—even your good friends don’t a lot of the time, whether through sheer acceptance of your weirdness or they don’t want to make things worse. After the fact, you still feel it, you know something happened yet it’s not until hours, sometimes days or even months later when the penny drops, oh my god, that’s what happened. By then it’s too late, the damage was done, been and gone.
I’m 42 and I don’t have the answers, the invisible rules are still 100% opaque, I have no idea what I’m doing wrong half the time.
Sometimes bandaids and Spakfilla are the only tools we have.
That's it for now.
As always,
Good luck,
Stay safe and,
Be well.
See ya!