No one starts a career in cybersecurity expecting an easy road. It is widely accepted that protecting critical digital infrastructure high pressure, high stakes work.
For many of us, it's part of the noise. Every day we solve complex problems, solve important problems and (hopefully) achieve real change – but who will protect cyber professionals from the risk of burnout?
It seems to me that this industry continues to reward heroic and even superhuman efforts, but often fails to take into account the limits of human resilience. Consider, for example, the brutal night shifts of incident response teams, often for several nights in a row.
The profession is facing a burnout crisis, and the warning signs have been loud and clear for some time.
Back in 2023, analyst firm Gartner predicted that by 2025, nearly half of cybersecurity leaders will change jobs, with 25% of them moving into other roles solely due to work-related stress. In 2024 survey According to a survey conducted by the Chartered Institute of Information Security (CIISec), more than half (55%) of respondents reported that stress at work interferes with their sleep and keeps them up at night. AND 2024 Labor Force Survey Industry member body ISC2 found job satisfaction fell by four percentage points compared to the previous year's study, to 66%.
How can we do better?
We must do better. In my opinion, a good first step would be to more generally acknowledge that a combination of factors has created the perfect recipe for mental and emotional exhaustion among cybersecurity professionals.
First, there is constant pressure from an increasingly dangerous threat landscape. There is also the tension of persevering in the face of skills shortages and budget constraints. And that's not to mention the challenge of managing the expectations of colleagues from other parts of the organization, who struggle to understand that the success of an IT security team is determined not by the complete absence of cyber attacks (unlikely) but by the team's response to attacks (inevitable).
In short, burnout is not a weakness, but a consequence of precarious work conditions. Recognizing this fact is a vital first step towards meaningful change.
From here we must take action. It's no secret that we live in an environment that is increasingly noisy in terms of the frequency and sophistication of attacks. But this is just a symptom of a deeper reason: the way CISOs and their teams operate is no longer effective. We are taking the old approach to the new world and it is not sustainable. We need to completely rethink how we protect our IT infrastructure.
As a CISO, I think about this topic a lot. A responsible CISO is one who protects his team members from the risk of burnout and I previously covered this topic in Computer Weekly. As I wrote back in 2023, a big part of my role is to ensure our incident response plans include adequate provisions for people working on the front line, ensuring they are resilient and able to “bounce back” after a challenging situation is resolved.
Part of the answer is to use the latest technology to keep team members in the loop. It's a culture that values flexibility and creative problem solving, but doesn't always provide employees with the tools that give them the insight and context they need to test those skills and flex their decision-making muscles.
In this noisy environment, we must use smarter technologies to filter out the noise, amplify the most serious warnings and mute the unimportant ones. Once these strong signals are heard, we can prioritize our response accordingly. Behavioral analysis and AI-based insights play a big role here, helping to identify anomalies and trends that require investigation.
Security teams may encounter thousands of alerts every day but can only investigate a fraction of them, resulting in critical signals being missed and energy wasted on false positives. The right tools direct human efforts where they have the greatest impact.
Stay sharp and resilient
Organizations urgently need adaptive security strategies that evolve as quickly as attacks. This allows IT security teams to stay ahead of the curve, maintain control, and remain sharp, responsive, and burnout-resistant.
This is especially important at a time when the barrier to entry for cybercrime is rapidly falling, allowing many more attackers to become involved, regardless of their level of technical skill. Elastic's 2025 Global Threat Reportwe saw a 15.5% increase in common threats. This trend is likely driven by attackers using large language models (LLMs) to quickly create simple but effective malicious downloaders and tools.
This means that the volume and variety of malware that organizations encounter is increasing dramatically. For this reason, they should rely less on static signatures to guide their responses and more on behavioral analysis and AI-based detection to automatically identify and stop the flow of new threats at scale.
The cybersecurity profession attracts some of the smartest, toughest, and most driven people in today's workforce—and companies routinely send these people into battle with legacy weapons. Instead, they should be equipped with new tools that will not only take some of the pressure off of the job, but also help them fine-tune their responses.
Protecting cybersecurity professionals from burnout will make a significant contribution to the overall security health of any organization. In today's cybersecurity environment, resilience must mean not only protecting networks, but also protecting the defenders themselves.
