Cybersecurity Burnout: Not a Character Flaw, a System Problem

You're reading a breach report. Third one this month. Last year a story like this would have lit something in you. Today you scroll past it. That's not you. That's the bill.

Episode 26 of Plaintext with Rich is the fourth installment of the Month of Mindfulness, a five-week series on self-care for people working in security and tech. This week we're talking about burnout, what it actually is and why the cybersecurity industry produces it reliably. We use the World Health Organization's classification of burnout as an occupational phenomenon and Christina Maslach's three dimensions (exhaustion, cynicism, reduced efficacy) to name what most of us feel but can't label. We get into the systemic causes specific to our field: always-on culture, headcount lag, and job designs that treat recovery as a perk instead of infrastructure. The episode lands with a Plaintext Starter Kit split between what the individual can do and what only leadership can fix.

If you've ever caught yourself scrolling past a breach report that used to light a fire and realized you don't feel anything, this one is for you. Whether you're the one carrying the load or the one supposed to be protecting the people who are.

Ten minutes or less. One topic. No panic.

Christina Maslach -> https://www.linkedin.com/in/christinamaslach/

World Health Organization -> https://www.linkedin.com/company/world-health-organization/

YouTube more your speed? → https://links.sith2.com/YouTube  
Apple Podcasts your usual stop? → https://links.sith2.com/Apple  
Neither of those? Spotify’s over here → https://links.sith2.com/Spotify  
Prefer reading quietly at your own pace? → https://links.sith2.com/Blog  
Join us in The Cyber Sanctuary (no robes required) → https://links.sith2.com/Discord  
Follow the human behind the microphone → https://links.sith2.com/linkedin  
Need another way to reach me? That’s here → https://linktr.ee/rich.greene

Transcript

The Numbness After Another Breach

SPEAKER_00 0:00

You know the moment. You're reading a breach report, third one this month. Same industry, same preventable failure. A few years ago, a story like this would have lit something in you. Frustration, resolve, the urge to fix the thing. Today, you just feel you feel nothing. You scroll past it, you open a ticket and another tab, and somewhere in the back of your head, quietly, something notices that you used to care about this and now you don't. That's not you. That's the problem. Welcome to Plain Text with Rich. We are four weeks into the month of mindfulness. We've covered mental health, spiritual health, physical health, and this week is the thing that collapses when those legs get ignored long enough.

What Burnout Really Means

SPEAKER_00 0:53

Burnout. Burnout is not being a little stressed about work. Burnout is not personal failure. In plain text, burnout is what happens when chronic workplace stress piles up without adequate recovery and it starts to change how you function. Now, the World Health Organization classifies burnout as an occupational phenomenon, not a medical diagnosis, not a mood, an occupational phenomenon, meaning it comes from the job. That distinction matters because the minute you understand burnout as something the work produces rather than something wrong with you, the whole conversation changes.

The Three Dimensions Of Burnout

SPEAKER_00 1:40

Now, the most widely cited framework for burnout comes from a researcher named Christina Mosley. She spent decades studying this and she identified three dimensions. Dimension number one, exhaustion, physical, emotional, cognitive, the obvious one. Number two was cynicism, mental distance from the work. The feeling that it doesn't matter, that people are a problem, that the game is rigged. This is the dangerous one because it doesn't always feel like burnout. It feels like realism. It feels like professionalism. Seen it all, can't be surprised. What's the point? And third is reduced efficacy, right? The sense that nothing you do is working, that the attack surface grows faster than you can shrink it, that your effort doesn't connect to outcomes anymore. If you recognize one of these, pay attention. If you recognize all three, you're not coasting through a rough quarter. You're in it. Now, here's a part I want to be honest about, right? Cybersecurity

Why Cybersecurity Creates Burnout

SPEAKER_00 2:42

produces burnout reliably, not by accident, by design. And not because anyone wants to hurt you, but because the incentive structures of this industry are pointed exactly the wrong way. Let me just name a few for you. That always on culture, right? The threat landscape runs 24-7. So we built teams that do too alerts at 3 a.m., emails, phone calls that never really end, weekends that aren't weekends. The job has no off switch, and we've normalized that. We have a headcount lag. And I know this will cause some murmurs, right? Threats grow exponentially, team sizes grow by the quarter if you're lucky. The math never really maths, right? Every year, the same people just absorb more work. Recovery is seen as a perk, not infrastructure. Most orgs treat downtime as something employees earn if they're good and the business cooperates. And that's backwards, I feel. You know, in high load work, recovery is part of the system, not a reward for surviving it. We had that one more incident loop, okay? You contain a breach, you barely sleep for a week, you're told, well done, you're the hero, then the next one hits. The loop rewards the behavior that literally breaks you. And then understaffing a strategy, right? Lean teams look efficient on paperwork. They don't look efficient when half the team quits in the same quarter, right? But by the time that happens, the people who made the staffing decisions have also usually moved on. Like before, when we talked about the physical side of health, right? You stack any of those together and burnout stops being a personal risk and it becomes an industrial output.

You Cannot Self-Care Past Systems

SPEAKER_00 4:32

And again, this is the part most wellness content skips. You cannot yoga your way out of a job that was designed to burn you out, right? You cannot meditate your way past a team that's been down to headcount for 18 months. You cannot hydration break your way through a company that rewards the people who never take their vacation. Individual practices matter. We've spent three episodes on them, and I stand honestly by every single one of those. But if we only tell people to fix themselves, we're blaming the operator for a system failure. That doesn't mean you're powerless. It means you need to be honest about what's yours and what isn't.

Three Moves For The Individual

SPEAKER_00 5:09

So here's the plan: this is your plain tech starter kit for burnout. Split into three moves for the individual, two for leadership, right? We're going to focus on the individual side first. Step number one: name what you're feeling accurately, right? I'm burned out is too vague to act on. I'm exhausted is different from I'm cynical, is different from I don't feel effective anymore. Use Mozloc's three dimensions, right? Figure out which one you're in. The label is not the cure, but it is the map for you. Number two, audit what's in your control and what isn't. A lot of security people burn out because they keep trying to fix org problems with a personal effort. That's a losing trade. Make two columns. What's mine to change, what isn't? Spend your energy on column one. Stop sacrificing it to column two. And three, protect your recovery cycles fiercely. Again, you cannot out-hustle burnout. Recovery is the only thing that refills the tank, and it has to happen on a schedule that doesn't wait for the workload to allow it. Sleep, weekends that are actually off, vacation you actually take, non-negotiable. Now for leadership.

Two Nonnegotiables For Leaders

SPEAKER_00 6:28

If you're in a position to influence how security work is designed in your org, these two I don't think are optional. Right? Four, name the staffing reality out loud. We are understaffed is not a complaint, it's a data point. Leaders who normalize saying this workload is not sustainable at current headcount, that's to protect their people. Leaders who let the team quietly absorb the gap produce burnout on a predictable schedule. And number five, build recovery into the job, not around it. Mandatory time off after major incidents, rotations that include recovery weeks, not just on-call weeks, workloads that assume humans, not machines. If your org treats rest as an employee benefit instead of operational infrastructure, burnout is a feature. It's not a bug.

Recap And Ways To Reach Me

SPEAKER_00 7:23

So your plain text recap. Burnout is not being tired. It's an occupational phenomenon with three dimensions: exhaustion, cynicism, reduced efficacy. Our industry produces it reliably because of how the work is designed, not because of who does it. Individual practices help. What's yours is yours. What isn't, isn't. Truly strive to know the difference. Next week, we close the series with work-life balance, which is really just another way of saying this: the structural fix that protects all of it. Now, if you have a topic that you want broken down in plain text, or you just want to tell me you've been scrolling past breach reports too, hey, send it my way. You can email me, you can DM me, you can drop it in the comments. Out of office replies you've mentally drafted but never sent are also accepted. I read them all and I will get back to you. If

Subscribe And Share

SPEAKER_00 8:18

you're listening in a browser, hit subscribe in whatever app you'd use. It's the single best way to make sure you don't miss the next episode. And if this episode helped, please share it with someone who'd actually benefit. This has been Plain Text with Rich. 10 minutes or less, one topic, no panic. I'll see you next time.