Podcast Transcript

Welcome to the RSAC Cyber at the Top podcast where security leaders across industries share the strategies, hard lessons, and real experiences shaping modern cybersecurity and AI. Insights are grounded in community and built for every level of profession.

Hello, listeners, and welcome to this edition of the RSAC Cyber at the Top podcast series. Thank you for tuning in. I'm your host, Kacy Zurkus, and I'm excited to be joined by Jen Easterly and Peter Kouronius for today's episode where we're talking about something every security leader knows is real, but very few can actually quantify.

It's burnout in cyber teams.

We know that cybersecurity professionals are some of the most pressured workers on the planet, And burnout in this space isn't just a personal problem. It's an operational one.

So before we get started, Jen and Peter, I'd love to ask you both to talk to our listeners about why this discussion is so important to you. Jen, let's start with you.

Awesome. Thanks so much, Kacy. And, Peter, I'm so excited to be here with you. It's great to see you again.

So you and I, I think, first, got acquainted almost four years ago when you launched CyberMinds.

And just my kind of journey on this, when I first got to CISA, it was the summer of 2021. It was after a series of high profile breaches and hacks. Folks will remember SolarWinds and hafnium and Colonial Pipeline and JBS Foods and Kaseya. And I remember coming in in July and started a series of sensing sessions.

And I used to do these office hours. And one of my teammates who was a threat hunter came in and sat down in my office. It was just the two of us. And we started talking about what he was working on and some of the challenges over the past few months.

And, you know, he he almost started tearing up because he was clearly under this enormous stress and enormous pressure from all of the things that he was doing to try and make sure that we were protecting and defending critical infrastructure, obviously, the mission of of CISA. So we had a great discussion about, you know, what are the resources available to incident responders and threat hunters and cyber defenders more broadly. We talked about, I think, Christina Moslock, at that point in time, and and you can talk a little bit more about how that intersects with your work. But, know, what are the tools, frankly, that cyber defenders can use to help deal with the incredible stresses and and pressures and to help deal with burnout?

And off the back of that, we actually made 2022, it's just the year of what we called mental health and well-being, and looked at all the things that we could do, the resources, that we could help provide our teams to help them deal with all the stress and all the burnout. And so when I discovered the work that you were doing and had been doing with other cyber defenders, I think it was in Australia is where you you kicked off, I was just really excited about the ability to provide more tools in the toolbox for our cyber defenders, at CISA and then more broadly around the country. So, you know, that's where this whole motion picture started.

But that's why, you know, I'm I'm equally passionate about it. And frankly, the stress and the burnout has only gotten more intense, frankly, now with all of these new AI powered tools. And so I think it's a really, really timely topic just for us to, chat on this podcast, but also to talk about the study that you just did. So over to you, Peter.

Thank you very much, Jen. And can I just say what a delight it is to be talking to you again and how grateful we are for the leadership that you've shown in this space, you know, even before we came on the scene? I know that it's a personally important issue for you as well. And and I also acknowledge the generosity that you'd showed to us early when we launched in The US, actually, in 2023, encouraging people to come in and check out what we were all about. So we've now established in The US, Australia where we began and and The UK as a nonprofit.

My own journey, I had prior to that about twenty five years in cyber leadership. I used to run the Australian National Association for the Internet, and we started focusing on cyber back in '97.

So we've done some really interesting work around resilience building, awareness raising, industry codes of practice, even the I code, which ultimately found its way into a US variant through five eyes in the White House. And I guess that's one of my proudest achievements that we were able to build something that was best practiced in Australia, but also then became something that could support our broadband Internet users in The States and elsewhere.

But it really showed me that if you came up with an idea that was very timely and it was solving a real problem, that you could actually make an impact.

Yeah.

And so back before COVID, I was already back in the leadership role within the Cybersecurity Advisors Network, which is a global nonprofit. I originally started in Paris by a friend of mine, Jean Christophe Lautercan. He's a great leader in his own right.

But we were seeing burnout in our colleagues within this organization. I started doing stress management, just very ad hoc sessions with people that I'd been working with and saw that there was a real appetite for this. And then, of course, we got hit by the pandemic, and we saw burnout rates basically, you know, escalating. I won't say going through the roof, but they definitely... We saw an uptick.

Because we weren't able to travel, I decided we'd go back and do some more development study on the back of a long history of my own, the way in which I took care of myself and studied the IRIST protocol, integrative restoration under doctor Richard Miller in California. So this is a really powerful methodology that they've used in many domains, but principally in the military. And I I think I understood at that point that we had had something that we could bring into cybersecurity for the first time, and that's effectively we built CyberMinds, the organization around this principle methodology that we're now bringing to teams around the world.

That's awesome.

So you've published a new study, I think, recently, and it really focuses on specifically resilience training. And then what I think is one of the most valuable things is, like, how do you actually measure the real world impact? Right? And so seeing some of the specifics, statistics on things like sleep and, you know, how you manage stress and burnout risk.

And so I think, you know, as I mentioned earlier, I've been around a lot of talented defenders, particularly in in the last role that I had at CISA that were under enormous, stress. And as part of that study, I think you cite some stats. Right? About seventy four percent of CISA's reporting team attrition driven by stress.

Roughly two thirds of its sort of responders have sought mental health assistance after major incidents.

I do wanna pause on that for a second, though, because I actually take that as a very positive thing. I mean, you mentioned the military. I grew up in the military. I spent more time in the military than I have done every... Anything else. It was twenty one years after, you know, four years at West Point.

And, you know, particularly the post nine eleven generation of folks dealt with massive amounts of stress and post traumatic stress syndrome and all of that. And it was really difficult to get folks to seek out mental health assistance. So, you know, some of the stats around two thirds of I...

IR incident responders seeking out mental health assistance after major incidents, I actually take that as kind of a positive thing that people are actually doing that. But, you know, I think as we both know, this type of burnout, this type of stress has massive impacts on your ability to be operationally effective and productive. So it's not just a human resources issue. Frankly, it's a...

It's truly a leadership issue, a leadership issue that, you know, CEOs, boards, and then, of course, CISOs and their teams, you know, treating burnout as an operational risk, not an HR issue. So I love that your work broadly and then this study specifically really illuminates, all of that. But, you know, I'll let you respond to that.

Yeah. But agree. And definitely on that last point, we had to start changing our messaging away from wellness, although that's important. But we were finding we weren't getting enough traction with the senior leadership in the c suite when we were talking about these things in terms of wellness. So we decided we kind of pivoted about a year and a half ago and started framing it in terms of operational risk because, of course, it is... It does carry those consequences.

And I think that we're trying to give CSOs the language and the way back into the board discussion around why this is important because it goes to resourcing. You know, for as long as it's sitting in the wellness bucket, the training budgets are gonna be discretionary, and they're gonna be quite limited.

The more we can move it into risk and particularly mitigation and managing it as any other risk Right.

Really for the organization. If your defenders are not optimized or performing optimally, then that has a negative impact on your organizational risk posture. The contrary, the more that we can bring in interventions to actually improve their sleep, improve their stress scores, improve and reduce their burnout symptoms and pre burnout indicators, that is all gonna translate into better decision making, less errors, higher confidence in the decisions they're making, whether to escalate, to triage, or whatever. And so I think it is really... I mean, we still wanna ensure that the wellness and the well-being is taken care of, But I just think as you you indicate, the implications are far more broad ranging than that. And I think that's really where we're now focusing our discussions.

That's so interesting. So so a lot more traction. Think as operational risk.

Yeah. Because you go to these big conferences, and I think these days, the discussion's more around, you know, when a CISO goes into the the board to seek further funding support, not just to hit on the statistics and technical stuff, but more about the narrative of what this means for us.

And so more and more, the leaders are being equipped with the language to go and have that sort of almost business level discussion.

And I guess we're just tagging on to the back of that to say, don't forget the psychological piece should be part of that discussion.

Yeah. A 100%. Well well, the study itself paints a pretty stark picture, frankly, of where participants were before the training started. And I also want you to talk a little bit about, you know, what the training is.

But Study cites things like excessive workloads, you know, shocker. Right? Excessive workloads for cyber defenders. But, you know, how some are relying on alcohol.

Some, you know, already, out sick. So can you talk just a little bit about what that baseline told you about the scale of the problem?

In fact, we've done a couple of studies now. The first one, which is ongoing, we started in 2022, is where we are measuring the industry as a whole across US, UK, Australia principally. And we're tracking sleep. We're tracking the stress indicators, and we're tracking the burnout indicators. And what we're finding as we aggregate and update those findings is we've got about half the cyber population is reporting bad or very bad quality sleep. And we use a special metric called the Pittsburgh Sleep Quality Index, which is the gold standard for measuring sleep, PQSI,.

When you look at the other studies outside of cybersecurity, particularly around aviation is a really good example, and you look at where pilots are deemed fit to fly, the short point is that based on our... What we're finding, half the population, if we were pilots, would have to self disclose unfit to fly.

And yet here we are trying to defend critical infrastructure. Right. But I mean, that just puts it in a bit of perspective.

Crewrest. Crewrest for cyber defenders.

Yeah. Right.

But it's not there, Jen. It's not legislated. It's not regulated in any way. And yet so much of our critical functions are all hanging off the back of cyber defenders, you know, being able to perform.

When we look at other metrics like carrying two or more concurrent burnout indicators...

So you mentioned Christina Maslak who developed the core standard for burnout. She identified three main dimensions of burnout, and we track all three. One is exhaustion, emotional depletion, we call it. The second is cynicism or sometimes called depersonalization, and I can explain each of these a bit more.

And the other one is professional efficacy, how well you regard yourself as doing well in your job, on those numbers, we're doing quite badly. In fact, in our original study, we released a finding that showed that on the professional efficacy metric, we were performing worse than frontline health care workers, and that was on the tail end of the pandemic.

Right.

So doubting our ability to do well in our children, partly, that's because of the lack of visibility of success inside them. We know maybe when we're winning to the extent we're preventing breaches, but we can't really demonstrate that in any tangible way. And so you don't get the kind of validation that, let's say, a frontline health care worker will get if you save a patient's life.

Right.

You know? Even if you lose a patient, they're not gonna blame you personally because in cyber, we're working in a different mindset.

In terms of the exhaustion, we're tracking levels of around sixty six percent reporting high or moderate levels of emotional exhaustion, just completely rung out to the point where you're starting the working day and you're already tired. And then the cynicism is really a a quite a concerning one because that is the predictor resignation intent when your levels of cynicism go up.

Right.

Basically, you're not feeling connected with the mission like you were when you first came in. So a lot of what we do when we do our training with organizations is to really help people track back into the why they came in and really connect back in with purpose because that actually turns out to be a bit of a buffer. That if you've got a strong why and you're part of the team and you're all hitting on the same, you know, on the same trajectory and you know why you're doing what you're doing, that can actually be very supporting. But alone, it's not enough, but it's definitely one of the strategies that we think we can implement. On the sleep, did I mention about half of sleeping poorly?

Yeah. What I wanna know is is I wanna know how do you improve sleep. Right.

Well, that's I'm ask...

I'm asking for myself.

Yeah. Indeed. Well, so this is really interesting. And we could do a whole, you know, podcast just on sleep.

Yeah. The short point is that if you are in a high stress job and you are not allowing for sufficient time for recovery, you get to the point where not even sleep is restorative for you. So we need something deeper than sleep actually to reset because all our ancient physiology is getting triggered, the flight and fight mechanism, which is all predicated on a physical threat actor. Remember when we were back in caves supposedly, the proverbial saber tooth tiger and everything's designed to escalate in the face of the threat?

And on your limbic system switches on and cortisol goes up and adrenaline starts to pump.

And then, of course, what's meant to happen is you're meant to deescalate after the threat has passed.

But if the adversary is virtual, you can't see them and it's constant, then there's nothing actually to signify to the nervous system that you're ever actually safe. And that's the reason why often sleep is disrupted because part of you is still running cycles and the subconscious mind is still turning over. And we see that with incident responders. Say in a mid bridge, their sleep is terrible because they're waking up in the middle of the night thinking, what did I miss? And if you're a SOC analyst, we see that they have very high levels of what we call sleep latency where it's harder for them to get to sleep.

So there's the idea of getting to sleep, and then there's the idea of how do you stay asleep. Yep. And the dynamics basically translate back into what can you do to deescalate the system before you go to bed.

Right? Because if you can actually install what we effectively do with the training is we're actually installing a manual override that evolution didn't have time to develop for us yet, where we can actually go and deescalate in a more conscious way. And then we... So we're finally finally with sleep, we're giving him an extra twenty six minutes a night. It's about three hours a week, which is pretty significant. And the number of good sleep has doubled from twenty seven percent up to forty seven percent after the eight week.

So it's fascinating to me because I've been... You know, I'm a big sleep tracker. I have all these, like, whatever it is, these devices, things on my phone, because I found... When I was growing up, I slept, like, 3.5, four and a half hours, you know, growing up, meaning when I was a young soldier in the army. And so I am now obsessed with getting, like, seven hours of sleep a night, which I rarely do.

To me, it's like a lot of routine. You know, go to bed at a certain time and then be very disciplined about when I get up and work out and all of that. But talk to us a little bit. Like, give us a sense of this training, and then I wanna hear the results.

Yeah. It's really interesting. So Richard Miller is a clinical psychologist. He's been practicing about fifty years now.

He's actually on our board. So we're just so privileged to have the actual developer of the protocol directly involved in the work of CyberMinds, and he's actually shepherding the way in which we customize his protocol, which has had that widespread application in military and emergency responders and other domains. But Richard's actually helping us to optimize it for cybersecurity, which is amazing in itself.

But the protocol is a 10 step sequence.

It's a guided technique where you have a facilitator or a recording of a a facilitator once you've done the training, and you're walking through different levels of your own being. So you're working with the physical body. So we're working with breath sensing. Actually, I should backtrack.

The first thing we do before we start the training is we show people where they have within themselves already a center of psychological safety. We call it the inner resource for lack of a better word. So we say that we each have this internal resource that is always resilient, always okay, and we're showing them how to ground back into that so that even during the process as we train them, if anything comes up, like a past memory or trauma or something, you've already got somewhere to go that is safe. And that's how he got such great success in the military working with veterans from Iraq and Afghanistan.

He was able to bring their PTSD down from the highest clinical levels down to subclinical levels in about 12 or 18 sessions. Wow. So we do the same thing. So basically, you're actually giving them a grounding in a safe psychological space where they can sit and do the practice.

And then progressively working through body sensing and then breath sensing is starting to move into slower brainwave activity. So you're taking them down to the edge of sleep, and you're getting into that little drifty state, you know, how you are just before you fall asleep. And it's it's very powerful state because there you tend to get direct access to things that may not be necessarily aware of.

Right.

That may be the things that are keeping you awake or keeping you anxious.

And so you get to bring them in, and then progressively, you start to work with beliefs, underlying beliefs, or unprocessed emotions, or unprocessed anything really that's there that's gonna get triggered. And so this is why it's very different from, like, your classic talk therapy where you just sit down and talk about it.

Not to say that doesn't have a role, but we're going much deeper back into the... Essentially, you think about root cause analysis.

Right.

We're coming down into the operating system of the mind where the really big, powerful tectonic plates that move around that govern how you respond to life, that's where it's all stored. And we're going in there and we're starting to diffuse the embedded stressors that have been sitting there maybe for ten, twenty, thirty years in some cases or trauma, even from childhood.

And and we're working with that and so progressively. It's also very pleasurable. It's not... Sounds a bit scary, but really what you're doing is you're feeling very relaxed, very in control, And then you gently start to work over the weeks of training with some of the things that are more challenging for you. Right. And you you actually start to reach a level of reconciliation internally, a sense of peace that you're essentially sometimes these stressors, all they wanna have is to be acknowledged.

You know? And then often they'll just release.

Yeah.

But it's the more that we repress and deny and just don't pay attention to it, they tend to hang around.

Yes.

So this is what we're doing. And so over the number of weeks of training, we find that they report the people we work with, cyber defenders in all different roles, leaders all the way through to individual contributors. They start to say they're sleeping better.

They're maybe feeling a better sense of perspective over their work. They... They're making better decisions because they feel like they've got more clarity because there's less noise going on in their heads.

Yeah.

Right? And you get this recursive thinking loops that we all get stuck in when you're working on a problem and, you know, you're feeling frustrated or whatever. And we're teaching them how to actually move into other parts of the brain. So we're deactivating or de energizing unhelpful brain processes and networks, and we're reenergizing the parts of the brain that correspond to emotional regulation, sense of perspective, your ability to concentrate and focus on that. And overall, you just start to feel a lot better because finally, you know, you're cleaning out the attic effectively and coming back into a state of what we'd like to think is equilibrium. So that's in a very short way the methodology. We also take them back into a sense of joy and gratitude within themselves so that we start to ground within them, anchor them back into better places within themselves, show them how to find that.

And then ultimately, by reinforcing the why, the connection with mission as well, you end up with teams that have a lot in the morale improves. We love to do it within the whole group, even with the leader as well so that they're modeling the right kind of behavior. Empathy improves.

Your sense of concern for others because you're now not suffering as much yourself. So you've got more bandwidth to give to the people around you. So it has all these beautiful sort of flow on effects. And then I think that this is like what the short term intervention looks like. In the long term, we really think that we've gotta build this in as part of a sustainability plan because the the trap here is that an organization will come into a short term pilot, will get all these great results. But three months down the track, everything's back to where it was.

That that was gonna be my other question. I mean, we're gonna provide the study I think in the notes. And, you know, if you look at the stats, I think they're pretty impressive. Right?

The reduction in 26.5% lower cynicism, 10.3% higher professional efficacy, nineteen point three percent lower emotional exhaustion. Like, those are all fantastic.

What leader would not wanna have those results for a team? But then how do you sustain that, I think, is the question. Right?

I think that's where we wanna focus next because we've worked with a lot of organizations now, defense, national security, all through the private sector, defense contractors here in The US. You know, that's the thing. Want to give them the stats. We give them the metrics.

And then we say, now we have to help you go back in and advocate that we can make this a long term thing because, you know, side of the stressors are never gonna go. This is inherently stressful work. But the key is it's about baking in recovery periods. It's...

The key is how do we institutionalize recovery. Yep. That's the key. And if we can get that right, then I think, you know, we're bringing a message of hope to CYBA teams that you can be in this profession that you love, but you're not gonna lose your health.

You're not gonna lose your own internal sense of who you are and why you're doing this. Yeah. And I think that's that's really the vision here for SideMind is just as we optimize networks and, you know, all the physical infrastructure, we've gotta progressively now reoptimize the humans. And and you made the point at the beginning about AI.

I mean, if you wanna talk about that a bit, I can share some perspectives on what we see there.

So many different questions that I know we don't have that much longer, and I really want people to be able to read through this report. But, yeah, tell me a little bit about the AI aspect of it. And then I do wanna just close with, like, the one message that you want cyber defenders to take away from this research because I want folks to check out the study, to look at the protocol, and really just to have a sense of... You know, the big bumper sticker I'm taking away is, you know, reject cynicism, embrace joy.

That is key to human resilience, and, you know, it's part of my own personal ethos as I get get older and try and find those wellsprings that really help me manage stress and and issues and be the leader that, you know, folks depend upon to inspire and to, get hard things done. But but talk a little bit about the AI angle, and then give me your one big takeaway.

Yeah. I shall do that. So the AI thing is really interesting. I mean, you can't go to any conference these days and you go onto the exhibition floor and everyone's flogging an AI tool. And, I mean, it's great, and we need it. But if anyone believes that somehow AI is gonna solve the burnout problem, I think that's probably very premature.

If anything... And and, you know, Jen, from your work, the history of technology is that technology tends to favor the adversary.

There's an asymmetry there because they're not bound by laws or jurisdictions or ethics or morals, and they're often the only adopters as well. So I think in the short to medium term prognosis is that we're gonna see all these automated attacks increasing sophistication and tempo.

At the same time, organizations and leaders are under pressure to downsize, to save costs, so they're cutting headcount.

So you've got this jewel, almost perfect storm where you're gonna get attrition through organizations seeking to leverage AI to replace humans at the same time as the attackers implementing advanced AI to actually improve their success rate in breaching organizational security. So whoever's left behind in that new world is gonna be under increasing pressure. And I think if we can get ahead of the curve and really recognize that this is something that's likely to occur, the more that we can come in and do... We love the preventative work, Jen. We we come in and we can help major organizations during a breach or after a breach and try and get the trauma back under control. It's always better to have resilient teams before the incident.

Yep. 100%.

Because they're less likely to suffer the consequences of the fallout from whatever the psychological impacts will be. In Australia, we've got new workplace, psychosocial workplace regulation. The hazard reduction is now corporate compliance requirement.

I didn't know that. Interesting.

Yeah. Just every state's doing it now. And and we've worked with a law firm that's given advice around this is a foreseeable risk in a cyber team in a major incident that psychological harm is something that is predictable and needs to be managed. But... So the short point on the AI is I think probably things are gonna be more challenging before they start to resolve. Yep. And therefore, we really need to be going in and giving the teams the support and the encouragement and the tools and the systems and the embedded recovery processes so that they can be better there to withstand what's coming.

As to my message of hope, which is really... I love the bumper sticker analogy. I'd go a step further. You know? I put a a post on LinkedIn, I don't know, three or four months ago, which he liked about bringing love back into cybersecurity.

Right.

So if he will indulge me for a moment, I'm not talking about romantic love, although, you know, that can happen, but it's more about love of the brotherly and, you know, sisterly. We're we're part of a movement here. We're all at the cyber defenders. We we generally love the mission.

We love the work. And if you don't like love, then you can substitute kindness. But it's about how do we build an environment in which we all feel that we're supporting each other, that we have the empathy and the capacity to sit back and just check-in and see how people are faring on the team. And I think when you yourself are in burnout, particularly as a leader, you lose the capacity to actually have those conversations because you're struggling yourself.

So the more that we can start to equip people with the restoration and the recovery, and we rebuild their cognitive and emotional reserves so that they've got more to give themselves initially, but also then to give their families and everyone else in their lives, then I think that's a better world for cybersecurity. So I think, you know, if I wanna be...

Have anything carved on my epitaph when I go, it would be something like bringing love back into cyber defense, cyber security, I think.

Anything that we can do in a positive way that we can measure, that we know nervous systems can recover and heal. We can do all that. I think that's the contribution that we're here to make. And I think with, you know, your kind of leadership and advocacy and others, we're working a little bit with Tim Brown now.

He's he's loving what we're doing. Fantastic. Yep. So we're we're we're really trying to get all the leaders in the room and basically say, look.

This is a movement. This is not just a...

Some sort of small initiative. This is a big vision, but I think it's a necessary one. And I think the time really is now. Yeah.

We should be doing this.

Fantastic. So bring in the love. Bring in the love to cyber. Rock on. That that that is a great great place to leave it.

It is. My friend, it is great to see you again. Thanks for everything that you are doing for our community, and I hope to see you, sometime soon. Casey, back over to you.

Yeah. Thanks so much, Jen. And I agree that's such a powerful place to land. There are two lines that will stay with me. One from the study, which is the performance of security systems depends on the resilience of security teams.

And one from this conversation is that question that you asked Peter, how do we institutionalize recovery? And, you know, the conversation I go back to the sleep and developing a real very clear routine sleep pattern, and the breath work really does calm that parasympathetic nervous system and prepare us all for resilience. So really powerful, valuable conversation. We spend billions hardening our technology, and this research makes the case with data that we need to just be as rigorous about sustaining our people. So Jen and Peter, thank you so much for being here with us today, for joining us, and bringing real measurement to a problem the industry has felt for years, but rarely been able to quantify.

Listeners, thank you for tuning in. Please keep the conversation going in the RSAC community using our hashtag RSAC, and be sure to visit 1rsac.com for new content posted year round. Until next time.