Protecting the defenders: Addressing cyber's burnout crisis

How can we do better?

We have to do better. To my mind, a good first step would be a more general acknowledgement that various factors have combined to create the perfect recipe for mental and emotional exhaustion in cyber security professionals. 

For a start, there’s the constant pressure exerted by an increasingly perilous threat landscape. Then there’s the strain of persevering in the face of skills gaps and budgetary constraints. And that’s not to mention the challenge of managing the expectations of colleagues from elsewhere in the organisation, who struggle to understand that the success of an IT security team is defined not by a total absence of cyber attacks (improbable), but by that team’s response to attacks (inevitable).

In short, burnout is not a weakness, but a consequence of unsustainable work conditions. Recognising that fact is a vital first step towards meaningful change. 

From there, we must take action. It’s no secret that we are navigating an environment that’s only getting noisier in terms of the frequency and increasing sophistication of attacks. But that’s just a symptom of a deeper root cause – the way CISOs and their teams work is no longer effective. We’ve been taking an old approach to a new world and it’s unsustainable. We need to entirely rethink how we secure our IT infrastructure.

As a CISO, this is a topic I think about a great deal. A responsible CISO is someone who protects their team members from the risk of burnout and this is a topic I have previously covered for Computer Weekly. As I wrote back in 2023, a big part of my role is ensuring that our incident response plans include adequate provisions for the humans working on the frontline, safeguarding their resilience and their ability to ‘bounce back’ once a high-pressure situation has been resolved. 

The answer, in part, lies in using the latest technologies to keep team members in the loop. This is a culture that values agility and creative problem-solving, but doesn’t always provide employees with tools that give them the insight and context they need to put those skills to the test and flex their decision-making muscles. 

In this noisy environment, we must use smarter technologies to filter the noise, amplifying the most serious alerts and muffling unimportant ones. When those serious alerts can be heard, we can prioritise our responses accordingly. Behavioral analytics and AI-driven insights play a big role here, helping surface anomalies and trends that warrant investigation. 

Security teams may face thousands of alerts each day but can investigate only a fraction, leaving critical ones missed and energy wasted on false positives. The right tools focus human effort where it has the greatest impact.

Staying sharp and resilient

Organisations urgently need adaptive security strategies that evolve as fast as attacks do. This enables IT security teams to keep one step ahead, stay in control and remain sharp, responsive, and resilient against burnout.

This is particularly important at a time when the barrier to entry for cyber crime is dropping fast, allowing far more malicious actors to get involved, regardless of their levels of technical skill. In Elastic’s 2025 Global Threat Report, we saw a 15.5% increase in generic threats, a trend likely fueled by adversaries using large language models (LLMs) to quickly generate simple but effective malicious loaders and tools. 

That means that the volume and variety of malware that organisations face is increasing dramatically. For that reason, they must rely less on static signatures to guide their responses and more on behavioural analytics and AI-driven detection to automatically identify and stop the flood of novel threats at scale. 

The cyber security profession attracts some of the smartest, most tenacious, and most results-driven individuals in today’s workforce – and companies regularly send these people into battle with outdated weapons. Instead, they should equip them with newer tools that not only take some of the strain involved in the work, but also help them to finetune their responses. 

Protecting cyber security professionals from burnout will make a significant contribution to any organisation’s overall security posture. In today’s cyber security environment, resilience should not only mean defending networks, but also protecting the defenders themselves.