For many organizations and the cybersecurity industry as a whole, improving retention and reducing the skills gap is a top priority. Mimecast’s The State of Ransomware Readiness 2022: Reducing the Personal and Business Cost points to another growing concern — burnout that leads to attrition.

Without skilled employees, organizations cannot protect their data and infrastructure from increasing cybersecurity attacks. According to Mimecast’s report, 77% of cybersecurity leaders say the number of cyberattacks against their company has increased or stayed the same since last year. Additionally, 36% of organizations report a loss in revenue due to ransomware attacks in the past 12 months.

Considering the growing need for skilled cybersecurity workers, what can organizations do to combat burnout and prevent attrition?

Attacks Negatively Affect Cybersecurity Professionals’ Mental Health

The increased and seemingly constant cybersecurity threats take a personal toll on cybersecurity professionals. The majority (57%) would feel very personally responsible in the event of a ransomware attack. While this statistic has fallen from 71% in 2021 due to the higher number of threats, cybersecurity professionals still take home significant stress from their jobs —  especially those who hold themselves responsible.

After a ransomware attack, organizations often see an immediate effect on their cybersecurity team. Leaders on one-third of teams report a higher number of absences due to burnout in the months after an attack. Unsurprisingly, the stress affects employees, with 54% reporting a negative impact on mental health. Additionally, 56% say that their role becomes more stressful each year.

Burnout Affects Recruiting and Retention

Because of the stress and burnout associated with working in cybersecurity, organizations are now struggling to retain the experienced professionals needed to protect them from future attacks. The report found that a third of cybersecurity decision-makers are thinking of leaving their roles in the next two years due to stress or burnout. Additionally, 34% of leaders reported struggling with recruiting essential IT staff after an attack.

However, organizations can help reduce burnout of their cybersecurity teams. Here are a few ways:

  • Offer flexible work arrangements to let employees find the best work/life balance for their situation. Include the option for remote and hybrid work when possible.
  • Provide training opportunities to help employees grow their careers and skill sets.
  • Create career paths to allow employees experiencing burnout to find another role in the company. Regularly discuss those opportunities to ensure employees are aware of all their options.
  • Offer employees extra time off following attacks that increase stress and overtime.

Cybersecurity is stressful. But organizations that do not work to reduce burnout among employees are likely to be less prepared for future attacks. By working proactively in partnership with employees, leaders can recognize signs of burnout and take action to reduce stress.

More from News

The White House on Quantum Encryption and IoT Labels

A recent White House Fact Sheet outlined the current and future U.S. cybersecurity priorities. While most of the topics covered were in line with expectations, others drew more attention. The emphasis on critical infrastructure protection is clearly a top national priority. However, the plan is to create a labeling system for IoT devices, identifying the ones with the highest cybersecurity standards. Few expected that news. The topic of quantum-resistant encryption reveals that such concerns may become a reality sooner than…

Malware-as-a-Service Flaunts Its Tally of Users and Victims

As time passes, the security landscape keeps getting stranger and scarier. How long did the “not if, but when” mentality towards cyberattacks last — a few years, maybe? Now, security pros think in terms of how often will their organization be attacked and at what cost. Or they consider how the difference between legitimate Software-as-a-Service (SaaS) brands and Malware-as-a-Service (MaaS) gangs keeps getting blurrier. MaaS operators provide web-based services, slick UX, tiered subscriptions, newsletters and Telegram channels that keep users…

Alleged FBI Database Breach Exposes Agents and InfraGard

Recently the feds suffered a big hack, not once, but twice. First, the FBI-run InfraGard program suffered a breach. InfraGard aims to strengthen partnerships with the private sector to share information about cyber and physical threats. That organization experienced a major breach in early December, according to a KrebsOnSecurity report. Allegedly, the InfraGard database — containing contact information of over 80,000 members — appeared up for sale on a cyber crime forum. Also, the hackers have reportedly been communicating with…

Google Ad Scam Makes Millions Using Fake Adult-Only Sites

An advertising fraud scheme that utilized Google Ads and “pop-unders” on adult websites generated estimated millions of ad impressions on stolen content. The campaign was reported by Malwarebytes on December 20, and the scam raked in an estimated $275,000 per month for the perpetrators. Alerted to the scam, Google shut down the fraudulent activity for violating the company’s policies prohibiting the use of Google Ads on adult sites. A pop-under is a type of advertisement that appears behind an open…