Burnout Isn't the Only Word for What Cybersecurity Work Does to You

Cybersecurity professionals often describe workplace stress with a single catch-all word: burnout. According to a new Cisco Talos newsletter piece, that word is frequently the wrong one. The author, reflecting on their own experience managing a team during the VPNFilter incident, notes that at the time nobody, including leadership and peers, had the right language to describe what was happening.

After reviewing decades of trauma research from fields like first responders, doctors, and the military, the author outlines distinct concepts that better describe what security workers experience. Burnout is exhaustion from chronic workload that eases when the load eases. Secondary traumatic stress comes from absorbing someone else's trauma, such as a threat intelligence analyst regularly exposed to disturbing dark web content. Vicarious trauma is the gradual reshaping of someone's worldview after years of seeing other people's worst days. Moral injury results from being forced to act against one's values or being prevented from doing what one believes is right, something common for people who own outcomes but not the decisions behind them.

The piece argues that having accurate language for these experiences matters because different problems require different solutions: reducing workload helps with burnout, but it does nothing for moral injury or vicarious trauma.