Burnout in cybersecurity is a systemic design flaw, leading to problems like "signal suppression" and an unsustainable "hero culture" that degrades team resilience.
Cybersecurity leaders Jothi Dugar and Ty Hughes advocate for a cyber wellness movement that treats employee well-being as an organizational design challenge, not a personal responsibility.
They propose concrete solutions, like embedding mandatory breaks in incident response plans, redefining leadership to build redundant teams, and leveraging diverse talent to proactively manage morale and retention.
Burnout in high-stress fields like cybersecurity is a stubborn problem. Despite a corporate focus on employee wellness, many professionals are still running on empty. A different approach, however, treats wellness as a matter of organizational design rather than a personal responsibility, starting with a diagnosis of the systemic flaws that fuel it.
Championing the cyber wellness movement are security leaders Jothi Dugar, otherwise known as Jojo D., "The Chaos Guru", and Ty Hughes, "The AI Alchemist." Dugar is a globally recognized executive strategist with more than 25 years of experience advising leaders where technology, cybersecurity, and human-centered transformation meet. An international bestselling author, she focuses on helping leaders and teams build resilience and performance through strategic clarity, emotional intelligence, and sustainable leadership practices.
Hughes is a transformational technologist and storyteller with nearly two decades of experience guiding organizations through complexity and disruption using human-centered approaches to technology leadership. His work sits at the intersection of advanced technology, emotional intelligence, and resilience, helping teams navigate uncertainty with focus and purpose. Together, they are reframing security culture by treating the people behind the systems as a foundational element of resilience.
"Many of us got into cybersecurity when it was still just 'other duties as assigned,'" Dugar says. "The field is so new that it's not set in stone. That newness gives us the power to change the entire system and create a movement in a way that professionals in fields that have been around for hundreds of years can't."
A patch for people: A common mistake leaders make is miscategorizing a quiet team for a healthy one. But that silence can be a sign that the team has stopped escalating issues or debating ideas. "Burnout isn't mysterious. It's what happens when we ignore the design principles that keep our technology resilient," Hughes explains. "It's predictable. It starts with 'signal suppression,' which is the moment when your team stops escalating issues, debating ideas, or imagining better outcomes."
The hero trap: Signal suppression can foster an environment where a few dedicated individuals end up carrying a disproportionate burden, which is an unsustainable model that increases the risk of burnout for top performers. "Leaders must be on the lookout for hero culture," Hughes warns. "When you find that your success is consistently tied to the efforts of one or two key people, you must expect them to burn out. If a server room overheats, we don't ask why it overheats; we ask who didn't put the coolant in there. When your staff gets burnt out, it needs to be that same logic. Urgency without recovery isn't mission ready; it's recklessness."
The pressure on these teams can be amplified by changes within the industry. As the CISO role morphs into a "catch-all" requiring skills in everything from technical protocols to business negotiation, it can create a growing disconnect with available training programs that remain heavily tech-focused. That ambiguity can foster a constant state of overwhelming pressure where everything is treated as the highest priority. "I actively discourage the 'hero' mentality," Dugar says. "If someone on my team is on vacation and tells me to call them if needed, my answer is a firm no. I make it clear that I will not call them, and if I see an email from them while they're away, we're going to have a conversation. They need to be protected from that impulse to overwork."
Designed for downtime: Rather than relying on vague wellness platitudes, their cyber wellness method embeds structural change directly into an organization’s formal processes. "We embed cyber wellness directly into our formal processes," Dugar says. "Our cybersecurity incident response plan, for example, now includes a mandatory wellness step: after an incident has gone on for a set period, you are required to take an official break. Some of these incidents take days to remediate, and people aren't sleeping."
Not that PBS: "In that moment, when there's an incident and all this chaos, your teams are feeding off your energy," Hughes says, offering a tactic he calls PBS. "If I'm able to Pause, Breathe, and Summarize what our next step should be based on the facts, it can be really calming and help us get to better outcomes in a quicker fashion."
The ROI of rest: It's all about creating systems that protect employees by default and justifying it all with a pragmatic business case that speaks the language of the C-suite. "You have to speak to senior executives in the language they understand: return on investment," Hughes says. "When you lose staff to burnout, you don't just lose their salary; you lose institutional knowledge and have to pay to replace and retrain them. It is so much more efficient to manage your human capital than to suffer the constant cost of turnover."
Solving these human-centric problems often requires creative thinking and a different perspective from outside the traditional cybersecurity pipeline. By bringing in talent from communications or even art and design, leaders can find new ways to manage morale and reshape their team's narrative from a reactive cost center to a proactive, celebrated value-driver. "I've gotten people for my team from areas you would think have nothing to do with cybersecurity, like communications or even art and design," Dugar says. "Why? Because don't you want to find creative ways of doing things instead of just following the standard?" Hughes agrees, noting he has "engaged marketing staff to help highlight the good work that happens and not just wait for a situation where the team is only seen on their worst day."
For proponents of cyber wellness, an effective fix is to redesign the leadership model itself. Commonly, the leader becomes a single point of failure or a bottleneck that can make the entire system brittle. For them, an effective way to change the culture of burnout is to redefine the leader’s role from being the hero to building a team of them. "The greatest design flaw I see is when the leader becomes the bottleneck, where the entire system is centered on one person," Hughes concludes. "I look to develop leaders on the team so that Jothi can go on vacation and things keep moving."
