5 Tricks to Reduce Burnout at Work

Burnout among cybersecurity professionals is nothing new. And the topic has been covered a million times, by a million different cybersecurity practitioners, media outlets, and conference speakers. What, then, is there to say? Will yet another burnout post change the industry, or even one person’s life?

In this article, we’ll look at a few statistics and explore a few ideas that might be useful in managing the stress that leads to burnout. Maybe you’ll read something new. Maybe you won’t. But maybe just one person will read this and make a small change that can save their life.

Cybersecurity professionals are prone to high levels of stress. Between the continuously growing and always-on cyber attack surface and the deficit of skilled workers, practitioners tend to work long hours, deal with business-impacting problems, and often feel they don’t get the recognition or support they need. What’s more, many industry professionals count security as both their work and their passion, meaning, time away from “work” revolves around work. Case in point, it’s not uncommon to hear security colleagues talking about the security research they’ve done after traditional work hours, the new tools/technologies they’re building in their “off” time, or the industry meetups/conferences/gatherings they attend at night or on the weekends. They never seem to find time away from security.

Now, this isn’t necessarily bad. Some wise person once said, “Do what you love and you’ll never work a day in your life.”¹ However, an always-on status can take its toll on a person’s mental and physical health, even if the subject of attention holds a positive position in a person’s life.

Stress is an inevitable part of life. There is “good” stress and “bad” stress. “Good” stress can push a person to perform better, ignite a desire for change, and motivate. It activates the “fight or flight” response that can be useful when facing a life threatening situation. When experienced acutely and sporadically, “good” stress helps improve people’s lives. 

The problems arise when there is “bad” stress, or chronic stress. “Bad” stress is the stress that causes high blood pressure, sleepless nights, headaches, hypertension, heightened agitation, anxiety, decreased performance, poor concentration, chronic pain, depression, and many more unhealthy and unwanted symptoms. Unfortunately, “bad” stress is very common. And when people don’t have or can’t take advantage of outlets that relieve “bad” stress, it builds up, causing devastating effects.

Stress by the numbers

When it comes to cybersecurity, the signs of bad stress are everywhere. According to a State of Mental Health in Cybersecurity report, 66% of survey respondents revealed that they feel significant amounts of stress at work, and 63% said their stress level had risen over the last year. Does this automatically mean those surveyed were referring specifically to “bad” stress? No, of course not. However, in the same report, nearly a third of respondents considered the state of their mental health to be only “fair” or “poor” due to extreme stress at work. Further, two-thirds of these respondents said they felt burned out at work. Science tells us that unrelenting or extreme stress leads to burnout, which is classified as a state in which people feel debilitating effects such as the ones listed above.

Other reports are even more concerning. CyberArk conducted a study that found 59% of cybersecurity professionals to be suffering from burnout. Eighty-five percent of respondents to a Devo Technology study said they anticipate they will leave their role due to burnout and 24% say they will quit security entirely. 

The numbers aren’t good. 

High stress rates and burnout are talked about frequently in cybersecurity, and it’s easy to get caught up in our own bubbles; security is, in many ways, just as much a community as it is an industry. This predicament leads to a bit of an echo chamber, making the problem feel even more immense than it is (and it is, per the statistics, not good). But we also have to look more broadly at the world we live in and our role and responsibility in it. 

Cybersecurity: Not a unicorn

In preparation for writing this article, I read ten different publications that detailed the “most stressful jobs.” Not one mentioned cybersecurity or even IT. This does not minimize the experience of working in cyber — it is a stressful job and burnout is a real and persistent problem. However, the available data can help us understand that the scope of the problem is bigger than ourselves, and use lessons learned in other industries and job categories to improve our own lives, ameliorate stress, and reduce the likelihood of burnout. 

As individuals, companies, healthcare providers, and other entities have acknowledged that “bad” stress and burnout cannot be ignored or written off as individuals’ personal problems, more resources have become abundantly available over the years. Many companies now support employees by providing wellness tools, educational materials, flexible schedules, mental health days, paid time off for volunteerism, onsite gyms or credits to outside exercise facilities, and — most importantly — greater openness and communication about mental health, company expectations, and personal growth.

Employers bear a big responsibility when it comes to supporting employees and helping them alleviate unnecessary stress and burnout. It hurts the bottom line if they don’t (plus it makes you a $h!t+y person if you don’t care about others’ well being). All that said, our own health, be it physical or mental, is ultimately our own responsibility. Employers, family, friends, doctors, therapists, coaches — they can all act as a support system. But the true responsibility lies within. 

As such, taking care of our own mental health, finding ways to reduce the bad stress that leads to burnout and its various unpleasant symptoms, needs to be a priority. Fortunately, recent history and the prevalence of stress and burnout at work (across industries) can provide guidance. 

Set expectations: There will be things over which you will have little control, be it attacker tactics and techniques or how your boss acts. Find ways to accept lack of control in certain areas — Repeat a mantra. Practice breathing exercises. Find a non-work friend to vent to — so you can focus on that which you can control. 

Manage your time: There is a belief among certain people that the more hours you work, the more valuable you are as a human being. Nothing could be farther from the truth. What’s more, excessive work hours without physical and mental breaks will lead to mistakes, poor concentration, and health issues. While it's inevitable that you may be required to work longer hours at times, be deliberate about your time. Keep a journal and track what you’re actually doing during the day. Map it to your work responsibilities. Doing so will help you understand where and when you’re actually wasting time, being inefficient, and causing yourself more stress. 

Prioritize self-care: This means something different to every different person, but self-care includes ways to replenish your mental and physical energy. For some people, it might be as simple as getting more sleep on a regular basis, exercising more, or eating more nutritious foods. For others, it could be taking a walk in the woods, reading a book, learning a new hobby, practicing mindfulness, turning off social media, playing with your kids, dancing with your friends…or anything else that makes you truly happy. It isn’t what you do; it’s about how you feel. If you’re content, if you’re smiling, if you feel relaxed — then you’re practicing self-care and removing some nasty stress from your life.

Learn to say “no”: This one is tricky, because there are many things each day to which we, as adults and employees, can’t say “no.” “Katie, please write a new datasheet on the new feature the product team just released.” “No, boss.” That is a sure way to get yourself fired, thereby increasing your stress a zillion fold. So don’t do that. But do find areas in both your personal and professional life where you can say “no”; request help from friends, coworkers, or family; or even push back a deadline to make a job-related task more manageable. 

Seek help: If you’re beyond stress and into the danger zone — burnout — seek professional help. Use your personal network too; sometimes there’s nothing like a family member or good friend to help you turn things around. But if you’re seriously burned out, talk to a mental health counselor, see a doctor for physical health concerns, speak candidly to your HR department, or hire a career consultant. Overcoming burnout is a serious condition that requires dedicated effort and assistance. It will also lead to big changes in your life. Be open to those changes, and let experienced professionals assist you. We’re fortunate that we live in a time where burnout isn’t considered a personality flaw, so use available resources to build a plan that will take you from burned out to thriving. 

Whatever you do, recognize that you’re almost never stuck; burnout and/or extreme stress are not inevitable. The tips listed above are tried and true; many other industry professionals face (at least) similar stress to that which is felt in cybersecurity. Draw on the experience and expertise of others to improve your life, start feeling happier, and become a healthier person.

1.  This quote has been attributed to Confucius, Mark Antony, and Mark Twain, and probably many others.