The risk of a thousand paper cuts – the human-centred problem seen with stress and burnout in cyber security
Using the analogy of what starts as a little inconvenience (a single papercut) then transforms into a significant wound (the cut never healed and more were added over time), MultiTeam Solutions and QA Consulting have published a report about an additional threat to organisations’ cyber resilience – the stress and burnout of their cyber security teams.
The ‘papercuts’ in this regard include things like trying to maintain constant alertness; handling false positives; repetitive tasks, keeping pace with the ever-evolving threat landscape; being regularly on call; no recognition for hard work and effort; the need to keep on top of and comply with new policies and regulations; and, of course, there are the breaches and attacks themselves.
Upon surveying 173 cyber security professionals at Black Hat Europe in December 2023, Stress & Burnout in Cybersecurity – The Risk of a Thousand Papercuts documents that although 52% of respondents to the survey saw themselves as being ‘quite resilient to stress’, this appeared to be resilience to ‘single papercuts’ because more than 50% of those same respondents expected to reach a point of burnout within the next year or sooner.
That expectation is often paired with a plan to leave their organisation; and this then has a knock-on effect on the stress levels of those they leave behind; plus, they carry their wounds to a new organisation. Consequently, stress and burnout are endemic across the cyber industry and the report states that this won’t change unless we better support cyber security professionals.
The good news is that 79% of the survey respondents said that they are at least somewhat comfortable sharing their burnout with their supervisors, and 81% said that their Senior Level Managers at least somewhat understand their stress. But they are often unequipped to support the social-emotional needs of their people and they’re likely under stress themselves.
So, what are the recommendations?
The report suggests that the response to address staff burnout must be incremental rather than radical and focus on 5 Impact Areas, prioritising the Area that’s already the strongest:
- Strengthening interpersonal connections built on authenticity.
- Replacing judgement with curiosity.
- Providing feedback with a supportive, growth mindset.
- Listening actively.
- Promoting supportive strategies in the workplace.
What can organisations do right now to heal and prevent stress and burnout?
techUK is proud to be a signatory of the Mental Health in Cyber Security (MHiCS) Charter; and we would encourage other organisations to sign up, too.
The MHiCS Charter was launched in response to rising stress levels in cyber security leaders due to the complex nature of their roles and the ever-evolving cyber threat landscape.
As a signatory, techUK has committed to raise awareness that the mental health and wellbeing of an organisation’s cyber security team is essential to maintaining that organisation’s overall cyber resilience.
To create a MHiCS Charter for your organisation and find out more, email [email protected]
You can also become part of the MHiCS community by joining the LinkedIn group here.
Download Stress & Burnout in Cybersecurity – The Risk of a Thousand Papercuts by here:
Report on Stress & Burnout in Cybersecurity
Come along to techUK’s FREE, open-to-all webinar on 20th June where our fantastic panelists will be exploring the impact of stressful work situations and environments on the mental health of cyber security professionals, and more broadly what this means for their employers’/organisations’ cyber resilience. Register to attend here.
Dan Patefield
Dan Patefield
Dan leads the techUK Cyber Security programme, having originally joined techUK in August 2017 as a Programme Manager working across the Cyber and Defence programmes. He is responsible for managing techUK's work across the cyber security eco-system, bringing industry together with key stakeholders across the public and private sectors. Dan also provides the industry secretariat for the Cyber Growth Partnership, the industry and Governmnet conduit for supporting growth across the sector. A key focus of his work is to strengthen the public-private partnership across cyber security to support further development of UK cyber security policy.
Before joining techUK he worked as Forum Lead for the Westminster eForum. In this role he had a focus on the technology and telecoms space, on issues ranging from Broadband and Mobile Infrastructure, the Internet of Things, Cyber Security, Data and diversity in tech. Dan has a BA in History from the University of Liverpool.
- Email:
- [email protected]
- Phone:
- 020 7331 2165
Jill Broom
Jill Broom
Jill is techUK’s Programme Manager for Cyber Security, working across the cyber eco-system to bring industry together with key stakeholders across the public and private sectors.
Prior to focusing in on techUK's cyber security work, Jill was also part of techUK's Central Government programme team, representing the supplier community of technology products and services to Whitehall departments.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
- Email:
- [email protected]
- Twitter:
- @honeybroom
- Website:
- www.techuk.org
- LinkedIn:
- https://www.linkedin.com/in/jill-broom-19aa824
Annie Collings
Annie Collings
Annie joined techUK as the Programme Manager for Cyber Security and Central Government in September 2023.
Prior to joining techUK, Annie worked as an Account Manager at PLMR Healthcomms, a specialist healthcare agency providing public affairs support to a wide range of medical technology clients. Annie also spent time as an Intern in an MPs constituency office and as an Intern at the Association of Independent Professionals and the Self-Employed.
Annie graduated from Nottingham Trent University, where she was an active member of the lacrosse society.
- Email:
- [email protected]
- Twitter:
- anniecollings24
- LinkedIn:
- https://www.linkedin.com/in/annie-collings-270150158/