The Prevalence of Burnout in Infosec

SecFlux

A series of different types of computers on fire.

Image courtesy: https://swimlane.com/blog/analyst-burnout-signs/

Burnout: What is it and why are so many in tech and infosec feeling the heat? Can it be prevented? What is required for recovery? And why can’t we seem to stay away from the fire?

Understanding the Atmosphere

If you spend any amount of time ingesting articles or opinion pieces within the realm of information security, you’ll quickly notice two seemingly ubiquitous things:

  1. The prevalence of organizations claiming there is a “shortage” of workers
  2. A high volume of people citing they’re experiencing significant “burnout”

It’s no secret that these two things are related, or, at the very least, have a significant overlap. Occam’s Razor would dictate the simplest answer would be one of congruence. Though, the problem is much deeper than the surface assumption of cause and effect. What’s happening goes beyond the notion of “Workers are getting burnt out, therefore they are leaving the industry and those positions are left to be filled.”

You see, most workers claiming to be burnt out don’t typically up and leave the industry. Sometimes, that is an outcome, but it’s not the norm. More often than not, they’ll either continue to soldier through and do their best to maintain where they’re at, or they’ll recognize the fire for what it is. As a result, they may break glass and jump ship to another organization where they feel they’ll have a chance to minimize responsibilities and work toward recovery.

Which begs the question: If both of these things are supposedly well known, why does there continue to be a problem?

The So-Called Worker Shortage

An old internet ad containing a black lab standing in a field next to a superimposed yellow button that reads "Go Get It!"

Image courtesy: http://www.uexperience.com/portfolio_lycos.html

Go ahead, give it your best “Lycos, go get it!” and search for the term “Cybersecurity talent shortage.” You’ll be met with pages upon pages of articles covering this phenomenon. Even NIST, the National Institute of Standards and Technology, has information on this topic.

An image of an iceberg where both the surface and what is beneath the water is visible. The accompanying text reads: "The Tip of the Iceberg"

Image courtesy: http://preparedtoanswer.org

Granted, there is a need for additional workers, but when you look beneath the surface and recognize the iceberg for what it is, you see a much more complex and nuanced version of the story. 

Since the start of the pandemic, two things have been happening simultaneously, more people have been laid off than ever before, and the amount of cybersecurity jobs have grown far beyond what was previously available. (This, of course, is beside the other more obvious problems surrounding the pandemic.)

The strange thing is, even though droves of people are competing and trying to fill these roles, seasoned or otherwise, many of them remain to be seen. But, how could that be? If there is an abundance of job seekers and available jobs, why aren’t these positions getting filled? It could be a combination of any of the following:

  • Insufficient salaries
  • Unrealistic expectations
  • Inflexible working conditions
  • Lack of benefits and accommodations
  • Poor perceptions about the company
  • More automation in sourcing and hiring
  • Excruciatingly long interview processes
  • Prevalence of “ghost job listings” throughout the market

If you’ve ever looked for a cybersecurity job, you know first hand how utterly ridiculous some of the listings can be. Several organizations will require a Master’s Degree, a slew of certifications, more experience in a technology than the technology has actually existed, your first born child; All for the remarkable deal of getting a salary that is insultingly low and hardly any paid time off, to boot. 

Many workers have greatly benefited from the prevalence of remote work, whether fully remote or a combined hybrid model. These kinds of opportunities allow those who are immunocompromised or disabled to have a wider variety of employment options. In many cases, parents are saving significant amounts of money on daycare services, which allows them to spend more time with their families. Broadly speaking, working from home awards a new kind of flexibility, a considerable amount of productivity offices fail to provide, and effectively eliminates the time and money lost to daily commutes.  

Handfuls of organizations have shifted away from seeking remote workers and are now favoring hybrid or in-person working models. Not only that, a smattering of companies that were once seen as universally acclaimed “great places to work” are now at the forefront of being perceived as some of the more cold, calculated institutions that lay people off, slash benefits, or blatantly overwork their staff without a second thought. A newer influx of “hustle culture” influence has been more pervasive throughout the past few years, which has resulted in high expectations of workers, especially throughout tech spaces. 

Hustle and Grind Makes for a Dull Mind

A cartoon person looking very tired, overworked, and probably experiencing burnout as they desperately try to do a ton of things at once, resulting in the growth of additional arms.

Image courtesy: #Hustle by Cristina Del Coro Trio

“Hustle culture” mentality is fairly pervasive throughout the field and serves as a toxic manifestation of productivity gone too far. Anyone who promotes the “all work and no play, grind the day away” mantra is just a workaholic in disguise trying to convince you that more hours mean more pay. (Which is patently false.) In fact, “hustle culture” is often touted as “burnout culture” and has been heavily debunked as any sort of credible strategy or outlook toward working.

Studies have proven time and time again that increasing the amount of time you work doesn’t necessarily lend to better productivity or outcomes, it just means you’re working more hours, likely to your own detriment usually for the benefit of someone else. The consensus among health professionals and workplace analysts is that most people will only have 3-6 hours of good, productive work out of an 8 hour day; Only 2-4 hours if the job is particularly taxing. 

If that wasn’t already enough, more people have been reporting they’ve encountered a significant amount of “ghost job listings.” This describes a type of job listing a company puts on the market, but has no intention of filling. Hiring managers and human resources departments do this for a number of reasons. Sometimes, they’re trying to fish and see if there is a market for that type of role, other times, they might be quietly trying to gauge if they can replace an existing employee or even may have promised they would find additional headcount to calm the existing already overworked staff.

Burnout: Beyond the Buzzword

The professional use of the term “burnout” was coined in the 1970s by psychologist Herbert Freudenberger, according to the American National Institute of Health. It comes from the verb phrase to burn out, which means “to burn until fuel is exhausted.” Like most things, experts tend to disagree on qualifies as burnout, however, the dictionary definition describes it as:

“Extreme fatigue, frustration, or apathy resulting from prolonged stress, overwork, or intense activity.”

So, how does burnout feel? What happens? What’s the lead up?

Like pogs and Pokémon, truly epic collecting gimmicks of the 90s, burnout can be characterized by a collection… of sorts. The variable in this hardly-earned analogy? — Instead of milk caps and Marikarps, there is a collection of mental, emotional, and physical symptoms.

Unlike simply being stressed or generally feeling tired, burnout drains you of your energy, ability to focus, and cannot be cured by rest or engaging in your favorite hobbies. In most cases, it happens overtime and progresses through a series of stages.

Stage 1: The Honeymoon Phase – Harmony in Stereo

A screenshot of the game Final Fantasy IX where two characters, Quina and Vivi, pretend to get married to progress past a part of the game. Quina says, "I... so happy..."

Image courtesy: A screenshot from the game Final Fantasy IX, developed by Squaresoft

Much like starting a relationship, the beginning of a new job, project, role, or activity can be immensely exciting and equally motivating. You’re surrounded by good vibes, able to exercise your creativity, and everything feels like it’s turned up to 11. (In a good way… or so it seems.)

Stage 2: Problems Arise – Information “Insecurities”

A photograph of rose-colored glasses with a crack in the lens.

Suddenly, not everything is so rosy. The once productive ambition starts to wear off due to an emergence of stress. Maybe the stress isn’t there all the time, but it’s frequent enough to cause a lot of friction. The façade of security has diminished. You start feeling the heat and… wait, what’s that smell…?  

Stage 3: Problems Persist – “I’m a Firestarter, Twisted Firestarter”

A photograph of Keith Flint from the Firestarter music video.

Where there’s smoke, there’s fire. The friction is burning bright. Problems are persistent, you begin noticing how many proverbial fire drills you’re dealing with on a regular basis. At this point, you might be feeling apathetic, you’re likely feeling chronically stressed and tired, as a result both your productivity at work and ability to relax at home become heavily impacted.

Stage 4: Burnout Occurs – Not So Spontaneous Combustion

An image taken from Regular Show where Mordecai and Rigby are reacting to a lawnmower bursting into flames.

BOOM! The flames of despair have reached the weapons reserves and the powder keg has exploded. You’ve hit your limit and you are no longer able to function normally. Your behaviors are noticeably different and you are greatly struggling with your mental health, your emotional wellbeing feels almost crushed beyond repair, and your body might be experiencing significant issues, such as serious fatigue, difficulty sleeping, frequent headaches or migraines, abdominal issues, nausea, and even more extreme circumstances like chronic illness, moderate to severe pain, autoimmune issues, or even other physical manifestations of stress, like shingles.

Stage 5: Habitual Burnout – Burning Your Cake and Eating It, Too

A screenshot from the game Portal showing a ton of wall scribbles. "The cake is a lie" is repeated over and over again.

The cake is a lie. There are only charred remains of a once desired confectionary. Your fuel levels are empty, your oxygen is running out, and you’re aimlessly drifting in space finding it more and more difficult to remember what being grounded feels like. Work is a never-ending struggle and you don’t have the energy to do what needs to be done let alone any extracurricular activities. Depression and anxiety are either settling in, or becoming more intense. Habitual burnout is consistent with the inability to heal once burnout occurs. If someone cannot take the time to recover, there can be catastrophic consequences.

Causes of Burnout and Additional Risk Factors

There are some who are more susceptible to burnout than others. At face value, you might think, “High stress jobs are the leading cause for burnout.” And, that’s partially true, they’re a large contributing factor, but let’s ask ourselves: What constitutes a “high stress” job? A number of jobs or industries can be more intrinsically stressful, such as healthcare, but when it comes to the field of technology and information security– What gives?

In general, burnout is frequently attributed to things like job scope creep, a lack of engagement, little to no support, working too many hours, limited upward mobility, bad management, and a lack of trust and transparency in the company or pertaining to those who work there. 

Similarly, infosec and many of the roles that exist within it regularly carry heavy workloads, tight deadlines, unclear direction, moving targets, strict Service Level Agreements (SLAs), and a plethora of other qualities that act as inherent stressors.

At a decent number of organizations, there seems to be a looming demand expecting workers to be consistently productive in a way that’s counterintuitive to their health at large. Alongside that expectation of productivity, there is an unrelenting need for workers to continuously learn about emerging threats, new technologies, and other significant details regarding the frameworks, tools, policies, procedures, and outcomes of certain circumstances. 

A photo of 6 matches on a red background. Each match is more burnt as the line progresses, depicting a visual representation of burnout.

Image courtesy: Image owned by Getty Images

In this day and age, the technology that supports businesses is expected to be running 24/7, with little to no complications, no questions asked. Under most circumstances, companies will try to accomplish this with using the least amount of resources and headcount as possible. It’s not unusual for security to be seen as a cost center, thereby entangling its viability and usefulness with a lack of revenue. 

The crux of the problem here lies in the fact that, much like electricity, many don’t know or acknowledge security until it is either visibly cumbersome for users, or has been circumvented in some way. “Nobody cares about security until a breach happens.” is a phrase that echoes the halls of many-a-places and serves as a mantra for disgruntled professionals. Despite having more than enough money, publicly traded enterprises have a high proclivity to operate under these conditions since they have a legal obligation to prioritize shareholder profits.

As a whole, working in infosec does lend an informed perspective to how fragile things are, what’s out there, and how difficult it can be to prioritize something as basic as a sense of privacy and security. For certain areas of infosec, there are also concerns of sensitive subject matters. In more investigative roles or roles that require the person to be subjected to harmful content, imagery, settings, and surroundings, a heightened amount of stress and anxiety can start bubbling to the surface. 

With all of those ingredients at play, the proverbial cherry on top is the instability people feel regarding the aforementioned mass layoffs. This creates a compound effect of survivor’s guilt, a feeling of unworthiness or guilt, for seeing their fellow colleagues becoming unemployed before their eyes. They tend to wonder, “Am I next?” Most of the time, when layoffs happen, the responsibilities of those who have been let go shift to other existing workers without any extra compensation or acknowledgment of the additional burden. 

Acknowledging Autistic Burnout

What makes it even harder is if there are factors of intersectionality at play. Those who exist under the umbrella of marginalization, whether it’s age, race, ethnicity, gender, sexuality, ability, or neurotype– are at a higher risk of experiencing burnout. For instance, those with autism and ADHD have a more difficult time adjusting to these intense demands. A decent amount of (but not all) neurodivergent people struggle with executive dysfunction, emotional regulation, sensory differences, and other common symptoms that create invisible barriers in combination with these workplace complications. 

The difference between autistic burnout and regular burnout is that: “Autistic burnout is triggered by the unique challenges faced by neurodivergent individuals as they navigate a world that is not designed to meet their needs, including social and sensory stressors. In contrast, regular burnout typically stems from the chronic stress of everyday life, such as work or personal obligations.” These conditions are significantly more impactful to people with autism. Of which, can go unseen or unnoticed by neurotypical people due to a lack of awareness or understanding.

The Road to Recovery

Infosec can sometimes feel like running the gauntlet; You’re getting attacked from all sides, only to be left feeling bruised. The thing is, burnout doesn’t go away on its own, it will only continue to worsen unless you address the underlying causes. Becoming burnt out is as easy as falling off a log, but recovering– That’s a whole ‘nother bag. 

An image of a spilled to-go cup of coffee.

“You can’t pour from an empty cup.”

-Unknown

A car with no gas cannot continue to drive much in the same way a hungry warrior with low health cannot continue to fight the good fight. Unlike a motor vehicle or a video game character with rippling muscles and a loincloth, we require much more than gasoline or a turkey leg to make us feel whole again. Recovery is a process, it requires strategy.  

Recovering requires time, effort, dedication, planning, reassessing, and, you guessed it: spending time to actually recover. Meaning, at the very least, you have to have reprieve. Aside from the most basic requirements, there’s no one path to recovery and no rush to the finish line. In this proverb, you must embody the tortoise because you were forced to run ragged as the hare. 

An illustration from The Tortoise and the Hare where Tortoise is quietly racing past the sleepy hare.

Image courtesy: https://commons.wikimedia.org/wiki/File:The_Tortoise_and_the_Hare_-_Project_Gutenberg_etext_19993.jpg

The tough part is, adopting a strategy for recovery is different for everyone, much like utilizing an information security framework. When it comes down to the details, there might be some differences and nuances, but at a high-level, you can try and follow steps or best practices to achieve results. 

  1. Be honest with yourself and admit there is a problem
  2. Rely on your support system (Friends, family, etc.)
  3. Talk to a healthcare professional or therapist, if possible
  4. Think about what led to you becoming burnt out
  5. Focus on the basics and figure out what your body needs
  6. Tell people what you need and advocate for yourself
  7. Set boundaries, learn to say no and avoid more commitments 
  8. Take time off, for real for real (Vacation or leave of absence)
  9. Find time to do things that make you happy
  10. Try to exercise or engage in stress-relieving physical activities
  11. Identify your values and what matters most
  12. Reassess your personal and professional goals
  13. Create a personal mission statement
  14. Analyze if your current job fits your personal mission
  15. Decide whether you should stay, try and negotiate different conditions or accommodations, or if leaving is the best for your recovery

Taking any of these steps can seem daunting, particularly if your workplace is incredibly demanding and not willing to listen to feedback or make the necessary accommodations. In fact, that fear many encounter is a large reason as to why people spin out of control. How can you take a vacation and enjoy it if what awaits you when you return is nothing but hundreds of emails, messages, and a backlog of work to do? There’s not a straightforward answer, especially when you suspect you could be fired for bringing it up at all. And, if that’s the case, it could be an indication to start the journey to look elsewhere. Yes, being able to leave is certainly a privilege, and a piece of the puzzle that makes it all the more difficult to combat.

On the other hand, if you suspect you have an opportunity to talk to your employer and work on fixing things, give it a try. Start by gathering an inventory of what you have to accomplish and partner with management to reduce your workload and adhere to your newly established needs. Honesty and transparency go a long way if the other party values and respects those qualities. 

One Final Thought

At the very least, if any of this article resonated with you, please take the time to have some introspection, catalog your feelings, talk to others, and try to recognize the “why.” If you’re thinking about burnout, it’s likely you’re thinking about how to recover or change your situation to better satisfy conditions for recovery. This phenomenon is happening to thousands upon thousands of workers worldwide.

You are not alone.

A wall mural by @signsofpower that says "You are not ALONE"

Image courtesy: https://www.youarenotalonemurals.com/

Your Home Page for Information Security News