UK CISOs face mounting stress, career changes imminent

Chief Information Security Officers (CISOs) in the UK are under increasing strain, with many facing significant stress and considering career changes.

A recent study commissioned by Splunk, a Cisco company, has highlighted the mounting pressures faced by UK CISOs throughout 2024. According to the survey, CISOs are experiencing heightened levels of stress and fatigue, with a noticeable impact on their professional and personal lives.

The survey findings reveal that 35% of UK CISOs have frequently encountered stress and overwork over the past year. An alarming 87% believe their role has become more challenging compared to two years ago, primarily due to a faster pace of work. Notably, 23% of CISOs are actively searching for new job opportunities, citing stress and mental health concerns as major reasons.

Splunk's report, drawing from the UK Government Cyber Security Breaches Survey, underscores the gravity of the situation. Cyber-attacks on UK businesses have escalated, with incidents rising from 39% to 50% over the last year, placing CISOs under immense pressure. James Hodge, Chief Strategic Advisor for Splunk EMEA, stated, "For businesses, it's not a matter of 'if' the next major, disruptive cybersecurity incident occurs, but 'when'."

Stress and overwork are not the only challenges. The survey disclosed that 50% of CISOs are getting an average of only six hours or less of sleep per night, which is below NHS guidelines. A considerable 63% of respondents expressed that they lack enough time to recharge, while a significant majority—76%—have not taken their full holiday allowance in the past year.

Work demands are spilling into personal realms as well. One-third of CISOs have missed family engagements due to job requirements, and 33% feel that enjoying a whole weekend free from work is unrealistic. These figures suggest a concerning imbalance between work responsibilities and personal life.

These pressures are not limited to CISOs themselves but extend to their teams. Over one-third of CISOs have noted signs of stress and burnout among their staff. With the continuous rise in cyber threats, 31% of CISOs fear that stress within their teams could negatively affect business operations and security measures.

The survey indicated a notable gap in employer support, as fewer than half of UK businesses offer mental health services to support their cybersecurity staff despite the evident need. James Hodge emphasised the importance of supporting cybersecurity teams, stating, "Businesses won't be able to protect their operations without protecting their teams first." He called for increased investment in wellbeing and talent management to aid security teams.

The findings present a pressing issue for organisations aiming to retain cybersecurity talent while preparing for future threats. As the industry faces a skills shortage, maintaining the existing workforce is crucial for addressing escalating cyber risks.