Burnout – The Threat to Security Teams

Chloé Messdaghi, co-founder of We Open Tech and Hacking Is Not a Crime, argues that burnout is a security risk, not a wellness footnote, and that it is produced by how the industry is organised rather than by individuals who fail at self-care. An exhausted analyst clicks the spoofed email from 'the manager' the way a tipsy one would. She walks through the progression from slower replies and lost creativity to insomnia, resentment and physical illness, then the pre-pandemic CISO figures: about a fifth had taken stress leave, nearly half reported damage to mental health, most work well beyond contracted hours and executives openly expect security teams to. She ties this to Ponemon data showing most incident response plans are ad hoc or never reviewed, and to the habit of buying tools instead of planning. Her four investments for managers: listen and act with the team, plan and revisit response plans together, encourage real time off (a recovery week, a monthly day, a no-meeting day) and be kind while respecting boundaries, backed by a 15-minute weekly one-on-one.