Cybersecurity burnout symptoms vary and signal leaving intentions differently
Cyber Exodus: Burnout Symptoms, Exit Intention, and Peer Response in Online Cybersecurity Communities
Human-Computer InteractionCryptography and Security
Summary
People working in cybersecurity get burned out in different ways, and this affects whether they want to quit their jobs. The authors studied online posts from security workers to understand different burnout symptoms and how often workers say they want to leave. Some symptoms relate to workload problems, while feeling disconnected from the work is linked to quitting but gets less support from peers. This means not all burnout is the same, and some signs are better predictors of leaving than others.
What this means in practice
- •For security team managers: Detect different burnout symptoms in team discussions to better identify staff at risk of leaving.
- •For human resources teams: Tailor retention strategies based on specific burnout symptoms rather than a single general burnout score.
Authors
Nadia Mehjabin, Ji Hyun Kim, Laura Barnes, Koustuv Saha, Henry Kautz, Subigya Nepal
Abstract
Security practitioners burn out at high rates, and the resulting attrition is itself a security problem. This workforce is hard to study: security operations centers are closed to outside researchers, studies that reach practitioners recruit through employers, and those who have disengaged most may have the least reason to answer an employer's survey. The same practitioners discuss their working conditions openly in online communities. We adapt the Burnout Assessment Tool, a validated clinical instrument, into a text annotation scheme and apply it to 354,861 posts and 296,442 replies from five online communities of cybersecurity practitioners. Checked against two trained coders on 100 posts, the annotation reaches a macro F1 of 0.75 across the four symptoms and 0.98 for detecting any burnout signal. We find that the four symptoms point to different problems at work, not to the same problem at different levels of severity. Exhaustion appears in almost any complaint about staffing or workload. Mental distance, a loss of belief that the work is worthwhile, is the only symptom unrelated to operational problems, and among posts with a single symptom it is accompanied by a stated intention to leave roughly twice as often as any other. Peer responses show the opposite pattern. When a poster says they are considering leaving, the mix of replies shifts toward career advice, but this shift is smallest for mental distance. The symptom most strongly associated with leaving is thus the one peers adjust to least, and a single burnout score obscures both patterns.