76% of technology teams experience burnout due to cybersecurity risk management, according to research from Expel, the managed detection and response (MDR) vendor.

Burnout is a growing concern amongst all workers in the UK – though remote working often offers more flexible lifestyles, finding the work-life-balance can be difficult as tech workers struggle for the right to switch off.

For cybersecurity experts, the burnout is intense, as cybersecurity concerns increase in sophistication and complexity, and new threats rise.

The UK had the highest number of cyber-crime victims per million internet users in 2022, according to AAG research, which was a 40% increase from 2020.

Research also found in the CyberEdge 2022 Cyberthreat Defense Report found that 81.4% of UK organisations experienced at least one attack in the year before the study.

Expel surveyed 500 IT decision makers (ITDMs) across the UK to analyse the current cybersecurity climate in the UK cybersecurity landscape: challenges and opportunities report. 

50% of ITDMs rated cyberattack as the third most serious challenge facing their organisations, behind energy prices (61%) and the current economy climate (54%).

The most concerning cyber-threats to decision makers are malware threats, followed by ransomware, and phishing scams.

Business email compromise (BEC) came in fourth, at 25% – the report also notes that these cases are on the rise, and BEC accounted for more than half of all incidents Expel say in their 2022 customer base.

While decision makers understand that cybersecurity is a major concern, the allocation of their resources may not be effective.

Expel found that the median annual security budget among surveyed companies was £200,000. Despite strain on teams, an average of about 26.7% of allocated security budget went unspent.

The expenditure of research may not be effective, as cybersecurity teams feel the pressure of emerging threats.

52% of those surveyed said their groups spend too much time dealing with unnecessary notifications, with those with IT or security titles said the problem is even worse.

An oversaturation of alters can fatigue respondents – a 2021 data report found that companies with 500-1499 employees leave 27% of all alters without investigation.

It’s not just fatigue – 61% of ITDMs said they and their teams suffer from burnout due to cybersecurity risk management.

Further, 70% of IT and security staffers report burnout, with over a third of them saying burnout happens regularly.

The issue has gotten to the degree that 52% of ITDMs say they are likely or very likely to leave to cybersecurity industry in the next 12 months due to burnout.

Ultimately concerning in this is that the question specifically asked about leaving the industry, not just a singular company.

Cybersecurity is already facing one of the worst skills gap in the tech sector, and is one of the most important aspects of digital skills.

There’s already a global shortage of 3.4 million security professions, as per a 2022 Cybersecurity Workforce Study by (ISC)².

So while UK businesses struggle to find talent, they have another major issue in retention.

Recommended

• Scotland’s Investing Women Angels Commit £195k to terrible*
• DIGIT Leader Summit 2023 | Just Two Days to Go!
• Report: Majority of Workers Not Taking Cybercrime Seriously

Yvonne Eskenzi, Co-Founder of wellbeing and productivity app The Zensory, and Founder of global Cybersecurity PR agency, Eskenzi PR, which has been running for nearly 30 years, provided some insight to the study: “The results of this survey are worrying, but not necessarily surprising.

“We know that security teams are overstretched, understaffed, and lack sufficient budgets. What’s needed is open-minded businesses who are willing to lead the change towards healthier work practises and a more mindful work environment.

“Having been in the industry for nearly 30 years, this is not a new issue. In fact, it’s pretty evident that this is a huge problem that isn’t getting better.

“We need leaders who see the reality of stressed staff – and its catastrophic impacts – and vow to make a difference. But this won’t be a quick change. Workplaces must adopt a ‘cyber mindful’ mindset. This includes arming employees with a mindfulness toolkit that helps them feel empowered to prioritise themselves and their wellbeing.

“This could include making meetings 10 minutes shorter, so staff have time to decompress before moving onto their next task, or simply teaching employees how to use their senses optimally for relax and focus (sensehacking). There really is no step too small.”