Cybersecurity, as an industry, tends to focus just on that — protecting organizations from threat actors. But what about the humans behind those defenses, bearing the brunt of the endless barrage of attacks?

“We're seeing really high levels of stress, we're seeing social disconnection, we're seeing mental health issues and we're seeing some substance abuse,” said Jess Burn, Forrester principal analyst for security and risk at Forrester.

It is critical, then, that organizations across industries address the rampant issue of burnout in cybersecurity, a panel of experts agreed in a virtual roundtable hosted this week by cybersecurity performance center platform provider Hack the Box.

“Cybersecurity is one of the industry's most vulnerable to burnout, and with human error as the cause of most incidents and data breaches, mental health in the industry has to be addressed,” said security blogger Graham Cluley, who moderated the discussion.

Crisis: A day in the life of the CISO

One study by Gartner predicted that nearly half of cybersecurity leaders will change jobs by 2025, and 25% will pursue different careers and industries entirely due to workplace stress. Another revealed that at least one-third of CISOs are considering leaving their jobs (or are at least open to it).

“Stress goes hand in hand with cybersecurity, especially nowadays,” said Haris Pylarinos, CEO and founder of Hack the Box. “Cyber in general is a tough profession, it requires a lot of effort just to be up to date.”

Ultimately, he noted, “crisis is just another day at the office — that's the life of a CISO.”

A compendium of factors — from the pandemic to rapid digital transformation to evolutionary technologies like generative AI (genAI) — is leading to “death by 1,000 cuts,” said Sarb Sembhi, CTO of cybersecurity company Virtually Informed, and chair of the Mental Health in CyberSecurity Charter and Foundation. Those are not only happening more often, but faster.

It’s important to consider outlying factors, too, because just looking at the work environment is “too narrow,” he said. People are impacted by many more things going on outside of work.

Forrester recently published a Cybersecurity Firefighters Guide to Controlling Burnout. Burn described the series of interviews she and her colleagues conducted as “kind of heartbreaking.”

She noted that the industry is doing a fairly decent job when it comes to assisting early-career folks with stress and mental health issues. Where it’s failing is the mid-to-senior-level workers.

“They’re burning out, they’re leaving, going into areas that don't have such high pressure and stress,” she said. “There's an impact on individuals and there's an impact on organizations when burnout is kind of running rampant in an organization.”

Sembhi, agreed, saying that cybersecurity veterans often have to help others with pressure and neglect their own needs.

“They're helping everyone else, but there’s not much going on to help them,” he said.

Still, security leaders are expected to look a certain way — strong, in control, level-headed — noted Andrea Succi, CISO at shipping and logistics company Ferrari Group.

“Because in the company political environment, having some of your peers saying ‘the CISO is not able to manage stress,’ it doesn't look good,” he said. Also, going into panic mode sends everyone else into complete panic.

“We face pressure, high stakes,” said Succi. “We are constantly unsatisfied. We know we’ll never make a 100% secure company, because that is not possible.”

Will AI replace, or enhance, human security jobs (or both)?

AI is central to just about every discussion these days, and that’s no different in cybersecurity — particularly when it comes to taking or augmenting jobs and further weaponizing attackers.

For instance, said Pylarinos, instead of sending out the exact same phishing email to 10,000 recipients, threat actors can customize them based on public social media profiles — trying to earn trust with one who clearly loves her dog, then with another with a penchant for photography.

While there is the potential for “attackers to go wild with the possibilities of genAI,” it will bring great benefits to defenders, too, Burn pointed out. “It's going to change the way that they operate on a day-to-day basis.”

However, foundational knowledge and deep understanding of how networks work is critical, she said — and AI isn’t going to replace humans in that regard anytime soon.

Pylarinos agreed that the job is very creative and practical, with professionals relying on creative thinking. “Your daily job is to provide solutions to problems that appear unsolvable,” he said.

Cybersecurity professionals must be trained effectively, see career paths

Current certifications, while useful when it comes to technical skills, also don’t address issues around stress and burnout, Sembhi noted. To augment technology basics, certifications should incorporate people and soft skills.

“Otherwise, the certifications aren't fit for purpose either,” he said. “They're focusing entirely on the technology, which in some cases are yesterday’s technologies. It's not even today's technology.”

Burn agreed, saying the average certification exam right updates every two to three years.

“So it's absolutely no indication of what's happening right now,” she said.

Rather than certifications, security professionals should routinely take part in crisis simulations and group exercises. At the same time, this will help leaders see where processes are falling down or people are getting tripped up — and even where red tape hampers productivity.

“It’s going to help with burnout because people are prepared, they're resilient, they understand what's coming,” said Burn.

In addition, these exercises can help CISOs identify where they need to train up or backfill. Burn pointed out that if one person is in control of an entire incident response playbook and they’re out sick, on leave or recently left the company, “you’re toast.” It’s important to do succession planning for all critical roles within cybersecurity (not just the CISO).

Also, burnout can occur when people don’t see any benefits from their efforts, or feel like they’re at a career dead end. Succession planning can help them see where their development paths are and where they have opportunities to be promoted.

“Going through cybersecurity skills and training platforms and running people through drills, helping them move and learn about the next role that they're going to take — all of that helps with things like burnout,” said Burn.