Cybersecurity Leader Burnout: Survey Finds Long Hours and Rising Turnover Risk

Cybersecurity teams are being asked to defend against increasingly capable attacks while many leaders say they lack the time, staffing and budget to do the job sustainably. A BlackFog survey of 500 security leaders in the United States and the United Kingdom found that 24% plan to leave their roles, 98% work an average of nine extra hours each week, and 45% have used drugs or alcohol to manage stress.

Those figures point to an operational concern as much as a workplace one. Departures can interrupt daily security work and slow longer-term changes, while exhausted teams may have less capacity to respond to new threats. The survey, conducted between July and August 2024, also found that 54% of respondents were open to new opportunities and 69% had withdrawn from social activities in the preceding 12 months.

The findings come as security leaders contend with ransomware, data theft, and attacks that use artificial intelligence. Their challenge is not simply to adopt more tools. Interviews with security executives suggest that staffing, organizational backing and clear communication all shape whether teams can manage the workload.

Workload and stress are pushing leaders toward the exit

Among respondents planning to leave their roles, 93% cited stress or job demands as a reason. The survey also found that 42% worried about AI-powered attacks and 37% identified malware and ransomware as their leading source of stress. Meanwhile, 41% wanted larger budgets for security tools.

BlackFog founder and CEO Dr. Darren Williams said the scale and sophistication of threats have added pressure to already demanding roles. He pointed to attackers’ use of AI and to ransomware operations that include stealing data as well as disrupting access to it. In his account, data exfiltration has become a routine feature of ransomware attacks, complicating the work of teams trying to contain an incident and protect sensitive information.

The workload data gives that pressure a practical dimension. Nearly every respondent reported working beyond contracted hours, and the reported average was nine additional hours a week. Extra time may help teams deal with immediate demands, but it can also leave less room for recovery and make an already open-ended job harder to sustain.

That strain appears to extend beyond working hours. The 69% who said they had stepped back from social activities describe a pattern of isolation alongside the long hours. The survey also found that 45% had turned to drugs or alcohol to cope. These are self-reported figures from the surveyed group; they indicate the seriousness of the responses, though they don’t establish why each person used those coping strategies.

Support inside the organization matters

Williams argued that security teams need enough people and resources to meet their responsibilities, along with support from senior management. The report’s findings suggest a gap between what security leaders say they need and what their organizations provide. Respondents called for larger budgets, more security tools and enough time to focus on the issues that demand their attention.

That gap can also involve influence. Nearly half of the leaders actively seeking a new role said they disagreed with senior leadership on major issues. The report found that security leaders who felt their professional judgment was disregarded were more likely to work at mid-sized organizations with between 1,000 and 4,999 employees.

Ani Banerjee, chief human resources officer at KnowBe4, said cybersecurity leaders can draw on peers in the industry for advice and support. He also emphasized collaboration with other senior executives, including human resources and legal leaders. These relationships can help security teams explain their needs and make decisions with input from colleagues who handle related organizational responsibilities.

Williams pointed to flexible and hybrid work as ways to support work-life balance, alongside practical resources and emotional support. He described cybersecurity work as demanding but potentially rewarding, and said workplace practices can make a meaningful difference to how people manage the pressure. The survey also reported that some leaders were taking steps to care for their health, though the article provides no further detail on those measures.

Seth Geftic, vice president of product marketing at Huntress, described the job as having no clear stopping point: vulnerabilities appear, technologies change and new developments require attention. He said budget limits, layoffs and scarce staffing can add to the burden, particularly when an organization leaves too much responsibility with one person. Mental health support and realistic expectations, he argued, can reduce some of that pressure.

Burnout can weaken security operations

Turnover carries consequences beyond replacing an individual. Williams said departures can disrupt everyday work and make it harder to carry out strategic changes. A team losing experienced people may have to divide remaining staff between urgent operational tasks and the effort to rebuild knowledge and capacity.

Matt Muller, field CISO at Tines, described communication as another source of friction. Security teams and business colleagues can use different language, leaving each side with an incomplete understanding of the other’s priorities. Security practitioners must translate complex technical issues for colleagues while also handling large volumes of information from multiple tools, Muller said. That combination can consume time and contribute to silos and isolation.

The organizational risk, in his view, is that leaders who feel unheard may struggle to get the support required to manage security effectively. Muller said that failure to support security leaders and gather their feedback can affect an organization’s reputation and finances. The broader implication is straightforward: a team’s ability to protect the business depends partly on whether its expertise reaches the people who allocate resources and set priorities.

High turnover can also create a cycle. When experienced staff leave, the remaining team may face more work, increasing the strain that contributed to departures in the first place. Williams called burnout and churn a recurring problem across professions, and stressed that commitment to security work shouldn’t come at the expense of well-being.

Automation can help when it frees up time

Automation and AI tools are often presented as ways to address staff and resource shortages, but adding software alone does not resolve the underlying constraints. Muller’s advice was to optimize existing resources and reduce silos. He said orchestration and automation can help by taking routine work off practitioners’ plates, giving them more time for tasks that need their expertise.

That distinction matters for organizations considering new systems. Automation can improve how work moves between tools and teams, but its value depends on how it fits into existing processes. If implementation adds complexity or leaves staffing and communication problems untouched, it may not ease the pressure. The source does not provide comparative performance data for specific tools, so the case for automation here rests on the experts’ descriptions of its potential role.

The practical takeaway

BlackFog’s survey records a workforce under considerable strain: 24% plan to leave, 54% are open to other opportunities, and nearly all respondents report working extra hours. The figures don’t show that every organization faces the same conditions, but they make the potential cost of neglecting security team capacity difficult to ignore.

Organizations can respond by giving security leaders time, staffing and budget that match their responsibilities; involving them in decisions; and making peer and mental health support accessible. Automation may help teams spend more time on high-value work, but it works best as part of a wider effort to improve processes and cooperation. The measure of progress will be whether teams can protect the organization without making sustained exhaustion part of the job.