CISOs Have the Toughest Job in the World

For CISOs, stress comes with the territory

Today’s CISOs face daunting challenges. They are constantly fending off increasingly sophisticated attacks, balancing scarce resources, and working with a board that too often doesn’t understand the inevitability of a breach and the criticality of the CISO’s role. So it’s not surprising that CISOs are experiencing damaging levels of stress, according to the Life Inside the Perimeter: Understanding the Modern CISO¹ report, published earlier this year.

• 100% of CISOs surveyed find their role stressful, with 91% saying they suffer moderate or high stress.
• 88% of CISOs are doing more than the average 40-hour work week, with 60% saying they rarely disconnect.
• 25% think the job has had an impact on their mental or physical health (or both), as well as their personal and family relationships.
• Nearly 17% of CISOs are either medicating or using alcohol to deal with job stress.

The stakes are high

In the information security game, stakes are high and challenges can be overwhelming:

• At risk are a company’s sensitive data, revenue, profits, reputation, and customer loyalty.
• Anywhere a line of code is present provides an opportunity for attack, regardless of sector.
• The enterprise attack surface is massive and continues to grow exponentially.
• Analyzing and improving cybersecurity posture is not a human scale problem anymore.
• Any employee can make a single mistake by clicking on a bad link or forget to patch a system in a timely manner. Every employee is an attack vector.
• Data signals that need to be analyzed and monitored run in the billions.
• Badly needed talent is always in short supply.

At the start and end of every attack, there are people; whether this is a criminal launching attacks or a security team trying to stop them. The majority of CISOs say they don’t have enough resources to defend the organization they are trying to protect.

Factors contributing to CISO stress

CISOs are working hard, with nearly 60% of those questioned saying they rarely or never disconnect from their security duties, and 22% saying that they are available virtually 24/7:

• This situation is contributing to a significant feeling of anxiety for the CISO.
• When asked which technical facet of the job drives the most stress, CISOs pointed the finger at “staying ahead of threats” (33%), securing the network (28%), and securing endpoints (26%).
• Added to that, only 60% of CISOs think their CEO believes a breach is inevitable.
• Roughly one-third of CISOs think they would receive a warning or be fired in the event of a breach.

For the CISO, the personal cost seems to be accumulating:

• Over a quarter of those questioned (26.5%) said the stress of the job is impacting their physical or mental health.
• Just as worryingly, nearly a quarter (23%) admitted that the job had also eroded personal relationships.
• Nearly 17% of CISOs say that they are medicating or using alcohol to deal with job stress, even though this is not a healthy or sustainable strategy.
• As more of a professional concern, 27.5% of CISOs also admit that stress levels are affecting their ability to do their job.

Strategies for relieving stress

On a professional level, CISOs say that these three things would reduce their job stress:

• Automation using AI and machine learning
• Getting complete visibility into the enterprise cybersecurity posture
• Building the right team
• Having the right reporting tools to effectively communicate “the CISO story”

On a personal level, CISOs can use these coping mechanisms to regain perspective and reduce stress:

• Healthy diet
• Regular exercise
• Switching off from the job
• Taking time away to avoid burnout

The buck stops here

When a company suffers a breach, everyone looks to the CISO for answers. Sad to say – it is part of the job description that everyone sees the CISOs failures (i.e., breaches) and almost no one sees their successes (prevented attacks).

Balbix can be a strong technology partner to CISOs as they deploy a proactive protection strategy within the enterprise, one that uses AI-powered cybersecurity to gain 100x better visibility, greatly improved team efficiency, a 95% reduction in breach risk, and high-impact, risk-based reporting to the board.

——-

^{1 Life Inside the Perimeter: Understanding the Modern CISO}