With the rapid adoption of remote work, cyber security is a top priority for organizations today in operating their businesses, protecting their assets, and reducing liability. The analysts and engineers working in your Security Operations Centre are the frontline. They play a crucial and demanding role in preventing the company from cyber threats and vulnerabilities. The need for Information Security Analyst roles are increasing at four times the average job growth rate within a rapidly evolving threat environment. Consequently, this puts your cybersecurity team at risk of fatigue caused by stress and eventual burnout.
Burnouts are a prevalent issue for SOC managers due to the negative impact on individuals and the workplace. Especially with reduced in-person socialization, increased workloads, uncertainty and pressure, the stress and exhaustion can adversely affect an employee’s output, mental health and motivation, and eventually lead to absenteeism and turnover. With the worry that malicious actors are always active and avoiding detection, security teams may feel the need to work overtime to beat them. Beyond technology and business models, successful organizations are run by happy and high-performing teams.
Burnout can also adversely impact their personal lives. A Korn Ferry study found that 76% of workers say that stress negatively affected their relationships; 16% of workers had to quit their jobs due to stress. One key consideration in winning the war for cyber talent is retaining the staff you already have. There is a dire need for employees to invest in their workers now so that they don’t lose out on quality talent to chronic stress.
The importance of addressing employee wellbeing
Stress, fatigue and mental health challenges are one of the major challenges that businesses, large or small, face today. In order to ensure business continuity, it’s vital for SOC managers to address not only the physical, but also mental health needs of their teams. A recent report from Indeed found that 52% of workers are feeling burned out – a significant rise from pre-pandemic levels. Burnout is on the rise among employees, and may be a relevant factor driving The Great Resignation. Read our last post for more on that subject.
These numbers are concerning, if you consider that 1 in 2 workers are at risk of burnout at any point in time. What would the worst case scenario mean to your capability? It gets worse for cyber — the 2020 Devo SOC Performance Report reported that 60% of survey respondents said the stresses of working in a SOC were causing them to consider resigning or changing careers entirely. The onus is on SOC managers and leadership to improve at identifying burnout, and reducing factors that contribute to needless stress in your SOC (such as minimizing false positive alerting).
A 2020 Business Group on Health survey found that only about half of large employers train management to be proficient at identifying burnout. Thankfully, an additional 18% of them plan to do so this year. Now, more than ever, it’s time for employees to be more proactive in identifying, addressing and supporting the mental health of their organizations in order to ensure productivity and positive business outcomes.
Signs of burnout
Simply put, burnout is “a form of exhaustion caused by constantly feeling swamped. It’s a result of excessive and prolonged emotional, physical and mental stress.” Because it’s such a personal topic, the symptoms of burnout will vary from employee to employee.
While some may be more open about their feelings, other individuals may choose to power through their exhaustion, which is why they display less indicators. Still, this doesn’t mean they’re better equipped at handling such stress. It’s vital for managers and leaders to pay attention to their teams and realize any hidden symptoms.
Typically, some signs of burnout include:
Constant exhaustion that repeats every day
The constant lack of rest, paired with an overwhelming workload, could be daunting for anyone. The rapport and quality of your relationship as SOC manager with your analysts and engineers is critical for recognizing burnout in individuals. For instance, if a certain analyst is constantly talking about how exhausted they are, it could be a sign that they’re feeling burnt out, or coming to it. Furthermore, burnout is not something that can be solved with one night of good sleep. So if your employees are repeatedly mentioning sleep deprivation, or you are noticing marked changes in their energy, it may be time to step in.
Falling sick suddenly
When unaddressed, long-term fatigue can have a negative impact on physical health and make it easier to succumb to common illnesses. Furthermore, employees that are feeling burnt out may not have the time to take care of their physical wellbeing. That being said, if a particular employee is facing a higher than normal rate of illnesses like cold or flu, it could be a result of prolonged exhaustion.
Tension and irritability
Burnout can turn even the most well-liked and easygoing employees into easily irritable individuals. This goes beyond the impacts of nightshift work on irritability. This could be a result of a loss of passion and interest for their job, decreased motivation for socializing with teams and general tiredness. Burnout, especially in collaborative teams, can have a domino effect. That means that when one worker starts the tension rolling, others can get affected and lose interest in their work. Identifying this symptom and getting in in the early stage can help prevent it quickly.
How to prevent burnout
Raise mental health awareness
When the topic of mental health is avoided in the workplace, it can come off as a taboo to be feeling things like a disconnection to work. This is more prevalent in male-dominated industries, including cybersecurity. It’s almost too easy for analysts to mistake their lack of motivation for laziness since everyone around them is always on the ball. Focusing the conversation around the importance of mental health can help to raise awareness on the subject. This enables analysts to better identify the root cause if they feel their performance slipping. Mental Health First Aid courses also exist and can help empower your teams to look out for one another.
Hold regular sessions to de-stress employees
When stress levels are particularly high, organizations can play a part in lowering them before it gets to the tipping point. For cyber teams, it is fun and work-related to host a Capture The Flag Competition — you can read about FifthDomain’s CTF offerings here. You might also recognize and instate ‘Mental Health Days’, which is a day off to rest and recuperate.
Use tools to support your operations
Your cyber analysts and engineers only have so much free time to dedicate to training and skills development. Using tools and platforms strategically can help your employees feel they are making good use of their time, progressing their careers, and increase their confidence in dealing with incidents. In short, it can reduce stress. FifthDomain’s Assessor platform is one such platform for your analysts to tackle realistic scenarios, benchmark their skills, and get unique insights into their strengths and gaps. Developing your employees and investing in their careers is the key to retaining them and our solution can help.
Tips to recover from burnout
Even with prevention initiatives and an eye for burnout signs, there may be exhausted employees that slip through the cracks. When that happens, the employer plays a significant part in supporting the recovery process, which can take weeks, months, or even years. Professional counselling or therapy may be required.
Some tips to help colleagues recover from burnout include:
- Be sensitive when talking to employees. Depending on the individual, some employees may not feel comfortable opening up to their boss about their private issues. Pressuring them to share confidential information may lead to further stress and disengagement.
- Offer rewards like extra paid vacation days, gift cards for relaxation days (e.g. spa day, hotel stays). Be careful not to put emphasis on performance-based rewards schemes, as this may encourage them to work even more.
- Encourage workers to take their allocated days off. Some employees may feel guilty for using up their off days if they feel that it’s discouraged in the workplace. When you notice an employee getting too stressed, speak to them and suggest some possible opportunities where they can enjoy themselves and recuperate.
Being an information security analyst or cybersecurity engineer is a stressful job. The current environment is increasing turnover at a time when retention is critical. It is crucial for organizations to recognize the prevalence of burnout, how it contributes to staff turnover, impacts cyber workforce retention, and ultimately harms your SOCs sustainment and capability.