COMMENTARY: The security industry has two instruments for measuring burnout in its leaders.
The first is attrition. A CISO leaves, and the departure gets read backward as a burnout story.
The second is the survey, where people self-report stress in a form with no consequences attached to the answer.
Both are lagging. By the time either one registers, the thing you cared about has already happened.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
What degrades first is not attendance or output. It is decision quality. In security, that degradation has a specific and recognizable shape.
Risk decisions get deferred. Not refused, deferred. The exception sits in the queue. The architecture review gets rescheduled twice. Deferral feels like diligence and is not, because the risk is running the whole time.
Exceptions get approved faster. The rationale field that used to hold a paragraph now holds a sentence. Compensating controls get named but not specified. Nobody notices, because an approval still looks exactly like an approval in the record.
The second opinion stops being sought. This is the quietest one. A leader who used to walk a hard call past two peers before signing starts signing alone, and signs defensibly, and the artifact is indistinguishable from one produced six months earlier.
Related reading:
- Beyond tools: Why burnout and missing fundamentals are undermining cyber defense
- Overcoming alert fatigue: An interview with Dr. Dustin Sachs
- How to use psychology to prevent employee mistakes that lead to breaches
- How weaponized AI drives CISO burnout – and what to do about it
- SOCs face alert fatigue, false positives, decreased visibility – and employee burnout
I am not a clinician, and nothing here is clinical advice. I am the co-founder and CTO of a private-pay telehealth practice, and I built and run its platform. Before that I spent about 20 years in healthcare IT, including a stretch as director of IT operations for a national mental health company. The unusual part of the seat is that I sit next to a clinical data set most technology leaders never see, and I read it the way an operator reads telemetry.
The variable that predicts the decline is not hours. Hours are visible, which is exactly why they are a poor predictor. People with brutal schedules and no secret about them tend to hold. The predictor is concealment.
In a clinical review of 261 high achievers seen between January 2025 and July 2026, CEREVITY found that 62% reported a noticeable drop in decision quality specifically during stretches when they were actively concealing internal strain from boards, co-founders, investors or teams. External results usually held. The judgment producing those results did not. Internally we call it the Cognitive Cost Index, and the core observation is simple: judgment degrades before results do.
That ordering is the operational problem. Every dashboard a board looks at is a results dashboard.
A security leader's incentive to conceal is unusually strong, and it is structural rather than personal. The role is defined, in most organizations, as the person who stays calm during an incident. Composure is not a trait the job prefers, it is a trait the job is understood to be. Everyone else on the bridge is permitted to escalate. The security leader is the one who does not. That expectation does not switch off when the incident closes.
Add to that the reporting relationship. This is the person who tells the board how much risk the company is carrying. Saying that their own judgment is compromised sounds, in a board's ear, structurally identical to reporting a control failure, except the control is them. There is no low-cost way to say the quiet thing.
So stop waiting for anyone to say it. Instrument the decision instead of the person, using records you already own. Time in queue for risk decisions. Approval latency on exceptions, and the character length of the written rationale. Whether the peer review step is real or is being completed ninety seconds after the request is filed. Count of decisions signed by one name that used to carry two.
None of that diagnoses anybody, and it should not be framed as though it does. It tells you where to look and when to ask a question in person.
Then change the price of disclosure, because you will not argue anyone out of the calculation they are making. Rotate decision authority on a fixed schedule so that handing off a call is a normal event rather than an admission. Make a second signature mandatory for a defined class of decisions so that asking for one carries no signal about the asker.
We do not lack instruments. We have pointed them at the exit interview. The decisions were getting worse for months before that, and every one of them was written down.
