“A quarter of cybersecurity leaders want to quit,” hollered the headline of a study sponsored by global cybersecurity company Black Fog. While that is suggestive of stress or morale problems at the higher levels of security teams, the more alarming numbers came later in the press release, below the graphic: 45% of security leaders have used drugs or alcohol to relieve work pressure in the past year, and 69% have “withdrawn from social activities.”
That’s starting to sound more like burnout than stress.
The reason it’s important to distinguish the cause of self-destructive behavior at work is that short-term stress and burnout have different treatments and timelines. According to a journal article by Arno van Dam, 80% of people suffering short-term stress are back at work in six to 12 weeks. Burnout patients, however, take more than a year to recover; one quarter to one half of patients still haven’t recovered after two to four years.
What Is Cybersecurity Burnout?
To discern burnout, it’s helpful to have a standard definition. While the US list of maladies, Diagnostic and Statistical Manual of Mental Disorders (aka the DSM), still doesn’t include work-related burnout as a diagnosis as of version 5, the World Health Organization (WHO) sees it differently. The WHO’s alternative resource, International Statistical Classification of Diseases and Related Health Problems (aka the ICD), has a code for burnout — QD85 — and defined it in the context of work/unemployment problems:
“Burnout is a syndrome conceptualized as resulting from chronic workplace stress that has not been successfully managed. It is characterized by three dimensions: 1) feelings of energy depletion or exhaustion; 2) increased mental distance from one’s job, or feelings of negativism or cynicism related to one’s job; and 3) a sense of ineffectiveness and lack of accomplishment.”
According to the van Dam article, burnout happens when an employee buries their experience of chronic stress for years. The people who burn out are often formerly great performers, perfectionists who exhibit perseverance. But if the person perseveres in a situation where they don’t have control, they can experience the kind of morale-killing stress that, left unaddressed for months and years, leads to burnout. In such cases, “perseverance is not adaptive anymore and individuals should shift to other coping strategies like asking for social support and reflecting on one’s situation and feelings,” the article read.
“I wrestle with burnout pretty regularly, escalated thanks to neurodivergence,” says Ian Campbell, senior security operations engineer at DomainTools. Burnout is also a condition familiar to the neurodivergent, especially autistic people. Autistic burnout, a term used mostly by that community, entails chronic exhaustion, losing the use of skills, and a lowered tolerance for stimuli. The role it might play in the better-known work burnout is unknown, but the similarity of symptoms is interesting.
Campbell sees the interplay from the inside. “Autism, depression, and anxiety are a wickedly effective combination in encouraging burnout. Hyperfocus can lead to working far too much and ignoring work/life balance,” he says. “Depression and anxiety are self-perpetuating, exquisitely engineered to set up feedback cycles hard to break away from, and that can be doubly toxic around work — the depression saying things won’t get better, the anxiety pressing you to work longer, harder, be more useful and less expendable.”
Bryan Kissinger, chief information security officer (CISO) and senior VP at Trace3, adds, “People also need to have the courage to say to their managers or coworkers, ‘Hey, I need a break.'”
Handling Staff Burnout on Security Teams
“Sometimes it’s very challenging” to tell when someone’s burning out, Kissinger says. He tells the story of one employee who kept their stress to themselves until it was almost too late: “They were ready to leave because they were burning out, and I said, ‘This is the first I’ve heard about it. Can we bring on some contractors to help us moderate the workload?'”
When asked how he helps his staff fend off burnout, Kissinger describes a hands-on approach. “I audit their day. A lot of people either tend to get roped into things … or volunteer for things,” he says. “What are the one or two things that need to be done today, and what can be done Monday or later next week?”
Jill Knesek, CISO at BlackLine, has a team of about 30 people, and has a quarterly one-on-one with each of them. “I offer more if they want more, and if you want to do monthly or every six weeks, then please do,” she says. “I just try to take the time with each person on the team to make them feel important and empowered. And I know that there’s opportunities for them, even if it’s not maybe what they’re doing today.”
If a person’s team is not supportive of work/life balance, that can exacerbate the issue.
Knesek says, “I want to make sure they know that I know what they’re doing and I care about what they’re doing and I can help guide them. So they feel important, and they feel like the really important things get noticed by leadership.”
How Cyber Staff Handles Work Pressure
“Taking all my holiday was a big help,” says Terence Eden, who moved from civil service to start his own consultancy, Open Ideas, which affords him much more control over his schedule and work/life balance. “And doing it in big chunks, not just a day or two, allowed me to reset.”
Resetting from the buildup of stress is an important part of disrupting the path to burnout, as Knesek knows well. She says, “I encourage my team all the time to make sure their work-life balance is always good. Recharging your batteries is really important, and I am an important representative of that, right? So if I don’t do it and everybody says, ‘Well, Jill never takes [paid time off] but she tells us to do it. But does she really mean that? Because she’s not taking it.'”
Employees sometimes scoff at the wellness programs companies put out as an attempt to keep people healthy. “Most ‘corporate’ solutions — use this app! attend this webinar! — felt juvenile and unhelpful,” Eden says. And it does seem like many solutions fall into the same quick-fix category as home improvement hacks or dump dinner recipes.
Christina Maslach’s scholarly work attributed work stress to six main sources: workload, values, reward, control, fairness, and community. “If any are lacking or out of sync, you may be headed toward exhaustion, cynicism, and the feeling of being ineffective,” said this article presenting a two-minute burnout assessment tool.
An even quicker assessment is promised by the Matches Measure from Cindy Muir Zapata. “The graphic she offered in her paper is a six-point and eight-point spectrum of matches, from unlit, to singed, to burned, to disintegrated,” read an article on HR Dive. A worker looks at the layout of matches and picks the one that shows how burned out they feel.
But Campbell has an idea for how to handle wellness better: “So my first and strongest recommendation to everyone is this: psychotherapy.”
“Professionals will help a lot more than any quick hack to keep you running for another few weeks — therapy allows you to vent out what’s building up, gain insight on your own status and choices, and plan for future burnout occurrences,” he adds. “It doesn’t make everything magically better, but you learn the tools to keep treading water, then tools to swim against counterproductive currents, and more.”
“The time to start learning and building the tool sets is before the burnout hits, or at least before it becomes a true crisis,” he adds.
Hope in a Hopeless Place
If worse comes to worst, and burnout hits, the van Dam article found hope in the study of disaster survivors. No matter how awful the disastrous events they went through, people tend to perceive some good coming from their trauma. This post-traumatic growth falls into three categories of benefits: changes in self-perception, in relationships, and in life philosophy.
The article built on that to posit post-burnout growth as well. “Many former burnout patients report that they have learned from their burnout and that their life is better now than before their burnout,” Campbell explains. “They know better who they are and what is important to them in life; they spend more time with their friends and families; and they changed their priorities. Many former burnout patients allow themselves to enjoy life more and to be happy.”
And again, he has some advice, particularly for the neurodivergent people: hack your needs to make yourself comfortable. “There are a thousand ways to optimize your own senses, and it’s something we as a culture often fail at. Whether you’re neurodivergent, neurotypical, or something else entirely — find the best sensory augments that allow you to work, and the better we’ll all be protecting, hacking, investigating, hunting, and more.”
