Burnout in cybersecurity leadership: Strategies for staying sane

Editor’s note: The experiences shared in this blog come from a conversation with former Axonius Field CISO Liz Morton and are part of our two-part series on burnout in cybersecurity leadership.

This is the second post in the series. In part one, we examined the signs and impact of burnout in cybersecurity leadership. In this post, we turn to practical strategies leaders can use to beat burnout.

There’s no such thing as a true work-life balance, especially in cybersecurity.

You’ve chosen a career where defending a company (or city … or country) from all types of threat actors is part of the job description. Add the demands of leadership, and taking measures to protect your well-being becomes absolutely essential.

At the end of the day, burnout is contagious. If you're running on empty, your staff feels it. Your program suffers. And in a field where the margin for error is razor-thin, that’s not a risk you can afford to take.

So, what do we do to stay sane and show up as effective leaders? 

We focus on three key areas:

1. You and your well-being

2. Your staff and their well-being

3. Your program and its success

1. YOU (Because you are the tone at the top)

Practice self-governance. Exercise as much as you can. Maybe it’s not your cup of tea. Do it anyway. It’ll improve your stamina: physical, mental, and emotional. 

Hacking Your Health, for example, is a podcast that speaks directly to folks in security, offering advice on hacking your body, mind, and lifestyle. It’s a solid starting point if you need some inspiration.

Don’t neglect your personal relationships. Seriously. If you think being a CISO and a spouse isn’t compatible, I have data on what it’s like to be a CISO and an ex-spouse. The people in your life are along for this wild ride because it’s the ride you want. They often see signs of burnout before you do. Listen to them.

Bonus points if you get involved in something your family cares about. Some of the most respected leaders I know coach kids' sports, serve on school advisory boards, volunteer, whatever pulls them into another headspace.

Take a real vacation at least three times a year. It doesn’t have to be three once-in-a-lifetime getaways. Just unplug quarterly. Why three? Because then there’s the holidays, which don’t really count (threat actors love to deliver their own “gifts” right around the holidays, remember). 

And the end of the year? That’s a crush of budget reviews, vendor renewals, and project wrap-ups. You may be out of the office during that time of year, but if your life is anything like mine, it’s hardly restful (though it can be fun and awesome in other ways).

And when you do take time off, actually take it. No obsessively checking your phone, no “just one quick call.” Be gone. Let your team step up.

Cultivate your bench. Train your people to step in while you’re away. Set clear thresholds for when they should loop you in, and let them run with everything else. 

This not only prepares them but also builds their confidence and trust in you. This takes time, but the ROI is real.

2. YOUR STAFF (Because you can’t, and shouldn’t, do it alone)

Training, training, training. They want to grow. Sure, some of that is focused on career advancement. But they also want to be excellent at what they do, contribute more, and earn your trust. Who loses in that scenario?

Make space for fun. Whether it's chili cook-offs, game nights, or online trivia for remote teams, create opportunities to decompress together. You likely have someone on your team who loves planning this stuff. Empower them.

Give recognition and context. Your team is often seen as the “no” department, stopping people from doing what they want to do. Remind them of the why. Walk them through your strategy. Involve them in the mission. No mushroom treatment: don’t leave them in the dark.

And when they’re crispy, make them rest. Crushing multi-day response? That’s comp time. Mandatory recovery. For everyone, leadership included. You set the example by doing the same.

Promote a culture of courage. Foster a culture where making new mistakes is part of the learning process. The goal is progress, not perfection. When something goes wrong, document it, iterate, and train on the improved approach.

3. YOUR PROGRAM (Because burnout isn’t just about people. It’s about process.)

Get the basics right. Burnout often stems from chaos: constant alerts, missing agents, and broken integrations. The fix is to strengthen your foundation. That starts with full visibility into your environment.

When you can see the whole picture, you can reduce churn, cut down on context-switching, and make your program actually manageable.

Audit your tools. Which ones are working for you? Which ones aren’t pulling their weight? Know where to double down and where to consolidate.

Look for tools that:

• Serve multiple teams (like Axonius, which provides data visibility that supports Security, IAM, IT, and other key functions) in multiple ways.

• Add to the capabilities of your department, not the workload. Remember: every new tool is a “mouth to feed.” Consider the total cost of tool ownership (financial and operational) when deciding whether or not to buy that new whiz-bang solution.

• Are well-liked by the people who rely on them daily. If your engineers, SOC analysts, or GRC team find the tool clunky or ineffective, take that seriously.

Understand your risk profile. Translate your risk profile into measurable outcomes. What are you protecting? What’s most likely to be targeted? Define measurable outcomes tied to your risk, and map that to a 2–5 year strategic plan. Whether you work with consultants or start grass-roots, the point is: start.

Let threat intel shape your priorities. You can’t defend against everything. Use intel to focus on the threats that matter most, and match that with how your environment is actually configured.

And don’t forget: no amount of intel helps if your builds aren’t secure. Standardized, automated, hardened builds are essential.

Automation is your best friend. It’s key to taming alert fatigue and freeing your team to focus on higher-value work. Make it a goal of your program to focus on the signal-to-noise ratio. False positives are part of the job; automate what you can and save human brainpower for what actually matters.

Burnout is a risk. Treat it like one.

There’s no silver bullet for burnout, but there is a path forward. It starts with how we lead.

Take care of yourself. Build trust in your team. Strengthen your program’s foundation. That means stepping away when needed, creating space for others to grow, and choosing tools and processes that reduce chaos instead of adding to it. Burnout is real, but it doesn’t have to define your career or your leadership.

If you missed part one of this series, where I discuss the symptoms we don’t talk about and share my own story, you can find it here.