The Psychological Struggles of Cybersecurity Professionals: Stress, Burnout, and Self-Redemption

As the adrenaline from a cyberattack fades, an indescribable feeling washes over cybersecurity professionals—much like the one depicted in Jackson Browne's 1977 song "The Load Out."

After this 32-second piano intro, Browne sings soulfully: "Now the seats are all empty / Let the roadies take the stage / Pack it up and tear it down."

For Allan Liska, a threat intelligence analyst at Recorded Future, this song perfectly describes the aftermath of a security incident.

"Suddenly, the incident response team is gone, the lawyers are gone, the insurance company is gone, and you have to piece your network back together and rebuild your security posture on your own," Liska said.

The ups and downs of incident response and recovery leave many cybersecurity professionals in a gloomy state of mind. Finding an outlet and making room and time to decompress is crucial.

"You have to maintain that sense of detachment, otherwise this job will kill you, it really will kill you," Liska said.

To release pressure and escape the chaos common in cybersecurity work, defenders must get creative and stay disciplined and focused. One of Liska's hobbies is creating comic books—which allows him to invent characters who punish ransomware criminals.

Cybersecurity work is incredibly stressful, an extremely grueling way to make a living. Alerts constantly flag potential malicious activity and must be taken seriously because every defender knows deep down: attacks will happen; it's only a matter of time.

On top of that, consider the insider perspective—they know the personal threats criminals will make to extort ransom payments. Honor among thieves? It doesn't exist.

Cybersecurity Dive interviewed more than a dozen security experts about the personal toll of their work and asked them directly: Are you okay? Some laughed nervously, some froze for a moment, and others hinted at burnout, but everyone's first reaction was unequivocal: Yes, I'm fine.

"My therapy session starts now," joked Stephanie Carruthers, chief people hacker and global cyber range lead at IBM Security X-Force.

Defenders who perform well both at work and in their personal lives must recognize the behaviors, words, and situations that could knock them off track. Working endlessly without rest, or lacking meaningful diversions from the flood of malicious activity, is a surefire path to burnout, or at least a diminished ability to perform at a high level.

"If it's always on my mind, I'll never have fresh ideas," said John Dwyer, director of security research at Binary Defense.

"Cybersecurity is both a science and an art, and usually your best ideas come when you're thinking about something else," Dwyer said. "To be at my best, I also have to take care of myself."

Coping mechanisms

Damage control cuts both ways—at work and outside of it. Many people are drawn to cybersecurity by a sense of mission, but the job can be stressful and all-consuming.

Kyle Hanslovan, CEO of Huntress, said he was nearly burned out after co-founding the company in 2015 and running it for seven years. Early signs of fatigue threatened the changes he hoped to make, prompting him to turn things around.

"I don't know much about psychology, but as someone who regularly attends personal therapy, it turns out there are just as many opportunities for dopamine hits when you're doing well as there are negative things you can focus on," Hanslovan said.

"Look at me now," he said during an interview at Yerba Buena Gardens in San Francisco in May during the RSA conference. "I'm not wearing a jacket, I'm wearing Chuck Taylors, I'm having a great time here, and I'm going to walk the show floor with my friends."

Some people derive meaning and strength from cyber-induced tragedies in a deeply personal way.

"I'd rather see the darkness so my daughter doesn't have to," said CJ Moses, CISO at Amazon.

"It's a mindset: remove as much darkness from the world as possible for the people you care about most," Moses said.

The cost of a career

While many in the security industry acknowledge the pressures of cyber defense, impaired well-being continues to wreak havoc on mental and physical health, Forrester analysts said in an April report.

The report found that burnout is preventing people from entering the industry and driving critical talent to other professions.

Many CISOs told Forrester that everything feels like a battle, and the human cost is so great that they decided to leave not just their positions but the field entirely to regain balance in their lives.

"It's a very tough role, and things like meditation apps don't really help," said Jess Burn, principal analyst at Forrester.

For frontline workers, fatigue and stress are pervasive. In a June report, penetration testing platform provider Hack the Box found that more than four out of five cybersecurity professionals are experiencing burnout.

"Many cyber professionals are considering leaving their jobs or the industry entirely if their roles impact their personal lives too much," said Haris Pylarinos, CEO of Hack The Box.

Pylarinos said that with cybercrime surging, business leaders need to address burnout now before it snowballs into a bigger problem.

For those who put out five-alarm fires every day, the job is especially tough. For incident responders, calls for help come frequently and at inconvenient times.

"We always joke that you'll get the call on a Friday. And it's true," said Sam Rubin, global head of operations at Unit 42, Palo Alto Networks' incident response company.

Rubin said he worries more about his team's burnout than his own. He tries to structure work, expectations, and resources in a way that provides essential downtime. "But it's still hard," Rubin said.

Michael Sikorski, CTO and VP at Unit 42, finds solace in those around him who are also striving.

"The reason we got into this line of work is to eliminate all the evil that's out there," Sikorski said. "People who gravitate toward this line of work, they want to be in the trenches."

Difficulty is relative

The psychological impact of cyberattacks is profound. In a 2022 report, IBM Security found that more than two-thirds of incident responders experienced stress or anxiety in their daily lives due to responding to cybersecurity incidents and sought mental health help as a result.

Some executives maintain balance through a reflective perspective.

"I have a little superpower: I'm an immigrant," said Karim Toubba, CEO of LastPass, who came to the United States from Aleppo, Syria, at age nine.

"I often say that my worst day here is better than what my brothers and sisters back home experience," Toubba said.

Toubba said his ability to handle difficulty with composure helped him last year through LastPass's recovery from a cyberattack that exposed cloud backups of the password manager's entire customer vault database.

"Balance has been elusive for years," Toubba said. "I think I'm much better now."

Like many cybersecurity professionals, John Hultquist, chief analyst at Mandiant Intelligence, has a military background that serves him well.

"I remember sitting in a truck full of cavalry scouts driving around Baghdad. We expected to be hit by an IED at any moment, and the only way to get through it was to laugh about it," Hultquist said.

"You have to try not to take yourself too seriously."