Uncharted Minds: Mental Health in Cybersecurity (Panel)

Uncharted Minds: Mental Health in Cybersecurity

Speakers: Deidre Diamond (Cyber-SN), Peter Coroneos (Cybermind), Kayla Williams (Field CISO, Cyara)

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch the full talk

Reading time: ~9 minutes

TL;DR

Burnout in cybersecurity is not just feeling overwhelmed — it is a neurological phenomenon recognized by the World Health Organization, with three specific clinical dimensions that predict resignation intent in a field already short 4.8 million professionals globally. This panel examines the data, the neuroscience, and the organizational practices driving a mental health crisis that threatens the workforce's ability to defend anything.

Introduction

The BSidesSF conference theme is "Here Be Dragons" — uncharted territory, unknown risks. Panelist Peter Coroneos noted that the phrase applies with uncomfortable precision to the state of mental health in cybersecurity: it is territory that the profession has largely refused to map, and the creatures living there are doing real damage.

Deidre Diamond founded Cyber-SN, the largest cybersecurity talent firm in the United States, after spending decades watching talented practitioners leave the field. Coroneos founded Cybermind to address the neuroscience of burnout specifically within the cyber workforce. Kayla Williams recently announced a new role as Field CISO at Cyara and previously served as CISO at Devo Technology and in VP of GRC roles — a career marked by the exact stressors the panel discusses. Together, they presented statistics, neuroscience, and a call to action that landed heavily in a packed room.

▶ Watch: Panelist introductions and the scale of the problem (00:00)

The Numbers Behind the Crisis

▶ Watch: Industry statistics and workforce burnout data (06:00)

Diamond cited figures that represent a structural crisis, not individual weakness: cybersecurity practitioners are experiencing burnout, depression, and exit intent at rates that are uniform across jurisdictions and organizational types. Coroneos noted that a study conducted in Australia found that cyber professionals were experiencing higher levels of burnout than frontline healthcare workers — after a pandemic. The finding made national news in Australia; it was largely unknown to the profession it described.

The backdrop makes the numbers harder to absorb: worldwide, approximately 4.8 million cybersecurity positions are currently unfilled, with roughly 350,000 vacancies in the United States alone. The profession is simultaneously experiencing a staffing shortage and burning out the professionals it does have at rates that predict resignation. The churn is self-reinforcing.

Diamond highlighted a LinkedIn poll she had run in the preceding week: of 115 respondents, just under 50% reported having a low to no-EQ manager. "You've got a fifty percent chance that you're gonna work for somebody that isn't there to care for you," she said. The panel was careful not to make this about blame — managers, especially those promoted from individual contributor roles without management training, often lack the skills the role demands because those skills are not taught.

What Burnout Actually Is

▶ Watch: Burnout as a neurological phenomenon (22:01)

Coroneos pushed back on the popular conflation of burnout with stress. "Many people associate burnout with just too much to do. Actually, it's almost the opposite: it's like there's nothing left. The tank is empty. The work is still there, but you are depleted."

The World Health Organization has formally recognized burnout as a condition. Its three clinical dimensions are:

1. Emotional depletion — The tank is empty. The individual has nothing left to give, including the capacity for empathy toward colleagues or family. As Coroneos noted: "As a leader, that's bad because it means you can't be empathetic, and you don't have the emotional reserves to care for yourself or anyone else."

1. Depersonalization or cynicism — A growing sense of detachment from mission. "I don't know why I'm here. Nothing's ever going to change. Why are we doing any of this?" The quiet quitting phenomenon, Coroneos argued, is a behavioral consequence of this dimension.

1. Reduced professional efficacy — The dimension he described as most concerning, because it is the one that most strongly predicts resignation intent. The individual begins to doubt their own competence and value. In a profession that already struggles to retain talent, this dimension drives departures.

▶ Watch: Three dimensions of burnout and resignation intent (28:01)

Coroneos emphasized that burnout is neurological, not merely psychological. The limbic system — the brain's threat detection and response apparatus — is calibrated for discrete, resolvable threats. Under sustained, chronic stress, the amygdala physically enlarges, and the brain remains in a threat-response state even when no stressor is present. "You can't talk yourself out of it because it's actually a neurological phenomenon," he said. This matters for intervention design: a week off will address stress but will not remediate burnout, which is a deeper structural change in brain function.

The Organizational Drivers

▶ Watch: Workplace culture, underutilization, and the impact on women (16:01)

The panel examined the workplace conditions that create chronic stress in the first place. Diamond's list included: unclear role expectations, excessive workload, lack of autonomy, poor management, and — a point Williams returned to repeatedly — underutilization.

Williams described a role in which she sought expanded responsibility, was refused, and watched the organizational cost of that decision play out over time. "Being underutilized impacts our professional efficacy as much as being overutilized," she said. This connects directly to the Yerkes-Dodson curve: optimal performance requires an appropriate level of stimulation. Too little is as damaging as too much; both collapse professional efficacy.

The panel discussed the particular pressure on CISOs: public scapegoating during incidents, personal legal exposure in a post-SolarWinds enforcement environment, governance responsibilities without authority, and the expectation that they absorb all organizational security anxiety without distributing it. Diamond noted that if the CISO is not being cared for, they cannot care for their teams.

Williams and Diamond also addressed the gendered dimension of these pressures — that all the stressors they described are compounded for women in the field, who face additional barriers to both advancement and recognition.

The Neuroscience of Recovery and Prevention

▶ Watch: Interventions, EQ skills, and the Yerkes-Dodson curve (34:02)

Coroneos distinguished between stress interventions (a week off works) and burnout interventions (a week off does not). Burnout requires more targeted approaches. He referenced the Integrative Restoration (iRest) protocol developed by Richard Miller in California — a mindfulness-based intervention that adapts to the individual rather than applying a one-size-fits-all approach. He specifically criticized Employee Assistance Programs (EAPs), the standard corporate mental health benefit, as "very one size fits all, not customizable down to the individual." For neurodivergent employees, who are both over-represented in cybersecurity and more prone to burnout according to current research, EAPs are particularly inadequate.

Diamond presented a framework of seven skills for building what she called "emotional intelligence infrastructure" for the workforce:

• Positive relationships — Social connection is load-bearing for mental health; isolation (a particular risk for remote workers) erodes it.
• Accountability to calendar — A practical signal of organizational reliability and respect.
• Win-win communication — The skill that salespeople were trained in for decades but that now applies to everyone.
• Listening — Actively listening more than speaking.
• Consistent self-care — Movement, hydration, nutrition. Coroneos noted the pandemic fundamentally disrupted burnout statistics and that remote work specifically increases the risk of isolation-driven burnout.
• Change tolerance / resilience — The ability to pivot without destabilization.

The panel's message for managers was equally direct: you are either turning people on or turning them off. The metaphor came from Diamond's mentor at her first management promotion. "Unfortunately, we have a lot of off going on."

Notable Quotes

"Burnout can be the consequence of long-term unmanaged stress. The brain that we carry now, the product of two hundred million years of evolution, is not optimized for the kind of environment in which we're putting it." — Peter Coroneos at 26:01

"We already don't have enough people, and yet people are leaving because we're not managing this issue. It just makes no sense at all." — Peter Coroneos at 24:01

"If you have skills, you can vote with your feet. Uh, if you don't have skills, it's gonna be very difficult. But if you have skills, you can vote with your feet, and I encourage you to do that." — Deidre Diamond at 20:01

Key Takeaways

• Burnout is a neurological condition, not a character defect. It is recognized by the WHO, has specific clinical dimensions, and does not resolve with a long weekend. Interventions need to match the condition.
• The three dimensions of burnout — emotional depletion, cynicism, and reduced efficacy — are measurable. Organizations that track these signals can intervene before the resignation stage.
• Underutilization causes burnout as reliably as overutilization. Both conditions collapse professional efficacy. The Yerkes-Dodson curve applies.
• The talent crisis and the burnout crisis are the same crisis. 4.8 million unfilled positions worldwide, combined with high burnout-driven attrition among existing practitioners, is not a recruiting problem — it is a retention and conditions-of-work problem.
• EAPs are not sufficient for the cybersecurity workforce. Generic, one-size-fits-all mental health programs miss the specific dynamics of the cyber environment and are particularly inadequate for neurodivergent employees. Organizations should advocate for more targeted, evidence-based interventions.