La cyber-résilience commence par ceux qui nous protègent

A few months ago, I sat in on a debrief after a middle-of-the-night incident. The team had been up since 2 a.m. By 9, they were in a standup, talking through the postmortem like it was any other Tuesday. Nobody complained. Nobody asked for the morning off. That’s the moment that’s stayed with me, not the incident itself, but how normal it seemed to everyone in the room that this is just what the job costs. 

Cybersecurity professionals carry a responsibility most people never see. They watch the threats moving quietly across networks. They respond at 2 a.m. because someone has to. The safety and continuity of entire organizations can depend on what they do in the next ten minutes. That work protects all of us. The industry hasn’talways matched that responsibility with the support it requires, and that gap is what I want to talk about as Cybersecurity Awareness Month begins. 

The pressure behind the profession 

Cybersecurity has always demanded vigilance. What’s changed is that the vigilance no longer has an off switch. Environments are more complex; threats move faster, and most teams are doing this short-staffed while being expected to answer at any hour. 

The numbers back up what I hear anecdotally in conversations with our own teams and with peers across the industry. A Sapio Research survey of 300 U.S. cybersecurity and IT leaders found professionals are working an average of 10.8 hours beyond their contracted schedules each week, effectively a sixth working day. Nearly half work at least 11 additional hours a week, and one in five works more than 16. 

Almost half say their jobs feel emotionally exhausting more often than rewarding, and many feel unable to take real time off because they know they’ll come back to a backlog waiting for them. About a third say they feel anxious about the week ahead before it’s even started. The 2025 ISC2 Cybersecurity Workforce Study tells a similar story: nearly half feel exhausted just trying to keep pace with emerging threats, and 47% often feel overwhelmed by workload. 

Behind every one of those numbers is somebody skipping sleep, missing a kid’s game, pushing back a vacation for the third time, quietly wondering how much longer they can keep this pace up. 

Resilience isn’t the same as an unlimited capacity to absorb stress 

Cybersecurity people are, by nature, the ones who step forward when something breaks. I’ve never once seen this team hesitate when it mattered. But the industry has, I think, let “resilient” drift into meaning “can take anything,” and that’s a dangerous drift. Real resilience isn’t something a person has on their own; it’s something a workplace either makes possible or makes it harder. 

That means looking honestly at whether workloads are realistic. It means staffing to the actual threat landscape. It means treating time off as something people can actually use without paying for it later in a backlog. And it means training managers to notice when someone’s “fine” doesn’t sound fine anymore. 

Sometimes the most useful thing a leader can do is ask, and actually mean it: How are you, really? Not as a prompt for the expected answer, but with enough silence afterward that someone has room to tell you the truth. 

What we’re doing this month 

This Cybersecurity Awareness Month, Keyfactor is donating $5,000 to Cybermindz.org, a global nonprofit that works directly with cybersecurity professionals on burnout, stress, and trauma.  

If our LinkedIn post on this reaches you and it resonates, we’d love for you to help it reach someone else who needs it.  Someone in your network might be having the week I described above and might need to see that other people see it, too. 

We’re in this together 

There’s a statistic in the research that I keep coming back to despite everything above: 94% of professionals surveyed said they’d still choose a career in cybersecurity. That’s not a small thing. It tells me the purpose people find in this work is real, and so is the community around it. 

To everyone doing this work behind the scenes: we see the cost, not just the contribution. You don’t have to carry it alone. 

En savoir plus

Cybermindz.org est une association internationale à but non lucratif qui se consacre au renforcement de la dimension humaine de la cybersécurité.

Les professionnels de la cybersécurité évoluent dans l’un des environnements les plus exigeants au monde : ils sont confrontés à des menaces incessantes, doivent prendre des décisions aux conséquences lourdes, souffrent de troubles du sommeil et subissent une pression croissante due à l’évolution rapide des attaques basées sur l’intelligence artificielle.

Cybermindz s'attaque aux risques qui en découlent pour la santé psychologique, les performances cognitives et la résilience organisationnelle.

Nos programmes, fondés sur des données scientifiques, associent les neurosciences, la performance humaine, la sécurité psychologique et le protocole iRest® afin d'aider les équipes de cybersécurité à gérer le stress aigu, à améliorer leur capacité de récupération et à conserver une prise de décision lucide en situation de pression.

En collaboration avec des experts en cybersécurité, des organisations, des chercheurs et des partenaires industriels du monde entier, nous contribuons à faire évoluer le débat : le « burn-out » n'est plus considéré uniquement comme un problème de bien-être individuel, maiscomme un enjeu de résilience humaine qui constitue une priorité en matière de risques opérationnels et organisationnels.

Grâce à la recherche, à l'éducation, à la formation et à des actions concrètes, Cybermindz œuvre à la construction d'un avenir où les personnes qui protègent notre monde numérique bénéficieront elles-mêmes d'une meilleure protection, d'un meilleur accompagnement et de meilleurs moyens pour s'épanouir.

For more visit > cybermindz.org