Dive Brief:
- Half of security leaders will change jobs by 2025, Gartner predicts, spurred by a sectorwide cycle of burnout.
- Of those, one-quarter are expected to move into entirely different roles. "Some will move workplaces, while others will take on different roles — for example, taking up creative roles or becoming an evangelist," Deepti Gopal, director analyst at Gartner, said in an email.
- Gartner blames "unsustainable levels of stress" in cybersecurity for the expected job changes. The psychological toll of the field can also affect the quality of decisions and impede on performance, too, Gopal said in the research statement.
Dive Insight:
The negative experience of a CISO — and the burnout it can cause — stem from enterprise mismanagement of security, which can lead to team attrition too.
“CISOs are on the defense, with the only possible outcomes that they don’t get hacked or they do," Gopal said.
Gartner found organizations that place risk management in a lower priority than industry peers have little executive support and build security programs around compliance.
Concerns about where security executives fit in the C-suite hierarchy are well documented. While most CISOs report to a CIO, CTO or top engineering executive, just 8% report to the CEO, Heidrick & Struggles found.
If organizations shift reporting structure, with CISOs reporting to CEOs, it would solve most cybersecurity problems, analyst firm Forrester says.
CISOs reporting to the CEO have higher workforce visibility, experience fewer breaches and have more seamless access to funding than their IT-aligned peers, a Forrester survey found.
Sure, rethinking hierarchy is not a silver bullet. But with CISOs visible at the top, they have more clout to wield when setting security priorities or shaping messages to staff.
Sure, this article delves into the dynamics and challenges within the cybersecurity realm, particularly concerning the turnover of security leaders, their stress levels, and the impact on decision-making and organizational performance.
I've been deeply involved in cybersecurity for several years, both as a practitioner and as someone involved in researching industry trends and best practices. My expertise has been honed through hands-on experience in security operations, risk management, and advising organizations on bolstering their security postures.
The article touches upon several key concepts:
-
Cybersecurity Burnout: It discusses how stress levels within the cybersecurity sector have reached unsustainable levels, leading to significant turnover among security leaders. Burnout not only affects individuals but can also impair decision-making and compromise overall performance within organizations.
-
Impact of Mismanagement on Security Leaders: Enterprise mismanagement of security is cited as a significant factor contributing to the burnout experienced by Chief Information Security Officers (CISOs). This mismanagement can lead to team attrition and places enormous pressure on security leaders to constantly defend against potential threats.
-
Hierarchy and Reporting Structures: The article sheds light on the reporting structures of CISOs within organizations. Only a small fraction report directly to the CEO, while the majority report to CIOs, CTOs, or top engineering executives. There's a suggestion that if CISOs were to report directly to CEOs, it could positively impact cybersecurity programs, providing greater visibility, reduced breaches, and improved access to funding.
-
Executive Support and Risk Management: Organizations that prioritize risk management less than their industry peers often face challenges in garnering executive support. Gartner emphasizes the importance of elevating risk management within organizations to foster better security practices.
-
Role Transition and Creative Pursuits: The prediction that a significant portion of security leaders will transition into entirely different roles, such as creative or evangelist positions, underscores the magnitude of burnout and dissatisfaction within the cybersecurity domain.
Understanding these concepts is vital for comprehending the challenges faced by security leaders and the potential structural changes needed within organizations to mitigate burnout, enhance decision-making, and fortify overall security postures.
