Nobody sends a thank-you note for the breach that didn't happen
Sam is the IT person at a 25-person accounting firm. Security is part of his job, along with the printers, the Wi-Fi, new laptops and everyone's forgotten passwords.
It's 10:40 on a Thursday night in March, right in the thick of tax season. Sam is still logged in, pushing a security update to every laptop before the partners arrive in the morning. Earlier today he stopped a fake invoice from reaching the bookkeeper, reset six passwords and talked a nervous client through a scary-looking pop-up.
Nobody will mention any of it tomorrow. When Sam does his job well, nothing goes wrong, so nobody notices.
Sam is a made-up example, but his week will sound familiar to anyone who works in IT. Across the industry, the people who keep businesses safe are tired, stretched thin and often unthanked. How they're doing shapes how safe your business is, and as an owner or manager, you can do a lot to help.
The people behind your security are running low
Several recent surveys found the same strain:
- In ISC2's 2025 Cybersecurity Workforce Study, 47% of security professionals said they often feel overwhelmed by their workload, and 48% said they're worn out from trying to keep up with new threats and technology.
- Sophos surveyed 5,000 IT and security professionals in 17 countries in early 2025. About three in four reported some level of cyber fatigue or burnout during the previous year.
- Proofpoint's 2025 Voice of the CISO report found that 63% of security leaders had experienced or witnessed burnout in the past year.
Many of them feel they can't say so out loud. In a 2023 survey of 200 security professionals by Devo and Wakefield Research, 82% said they'd been told stress and burnout are simply part of the job. A small 2025 academic study of 50 practitioners found most were reluctant to tell management they were struggling.
Most of this research comes from larger companies with full security teams. In a small business, the same pressure often lands on one person, or on an outside provider looking after dozens of clients like you.
A tired defender has a harder time keeping you safe
In that same Devo survey, 83% said they or someone on their team had made a mistake because of burnout that led to a breach. Seventy-seven percent said stress at work directly affects their ability to keep customer data safe.
In a small business, it tends to show up quietly:
- Security alerts pile up, and the one that matters blends into the noise.
- Updates slide to next week, then the week after.
- A quick fix goes in "just for now" and stays for years.
- The person who knows how everything fits together starts looking for another job.
That last one is common. Gartner predicted in 2023 that nearly half of security leaders would change jobs by 2025, with a quarter leaving security work entirely because of workplace stress. When your IT person leaves, they take years of knowledge about your systems with them.
Gartner analyst Deepti Gopal noted that stress can't be wiped away, but "people can manage incredibly challenging and stressful jobs in cultures where they're supported." The way you lead shapes that culture every day.
Six ways to support the people who protect you
Most of this costs little or nothing. It comes down to paying attention and building a few steady habits.
- Thank them for something specific. "Thanks for catching that fake invoice on Tuesday" lands far better than "thanks for all you do." Say it in front of the team now and then, so everyone sees the work that usually stays hidden.
- Ask what would make their job easier. Then follow through on at least one answer. It might be a better tool, a few hours of training or permission to push a project back.
- Be realistic about what one person can do. Nobody can watch everything around the clock. Multi-factor authentication, solid backups and a monitoring service or managed provider can take real weight off their shoulders.
- Protect their time off. Plan coverage so they can unplug completely while they're away.
- Bring them in early. Ask for their input before you buy new software or change how work gets done, instead of calling them after something breaks.
- Make security everyone's job. When staff report suspicious emails quickly and follow the basics, your IT person stops carrying the whole load alone.
If you're the one doing this work
Your work counts, even on the days nobody sees it. Every update you push, every phishing email you block and every password you reset makes your organization safer.
A few things that can help:
- Know your early warning signs. One security professional told the BBC he watches for changes in his sleep, his eating and how much he exercises.
- Speak up before you hit empty. Telling your manager or client "I'm stretched too thin" is a risk report about your business's security. It deserves to be heard like one.
- Find your people. Professional communities like WiCyS, and nonprofits like Cybermindz that focus on the mental health of security professionals, exist so you don't carry this alone.
- Use the support you have. If your workplace offers an employee assistance program or counseling benefit, it's there for you too.
Start with one thank-you
October is Cybersecurity Awareness Month. Most of the spotlight goes to employees, passwords and phishing. This year, add one more item to your list.
Find the person who keeps your business safe, whether they sit down the hall or work for your IT provider. Tell them one specific thing they did that made a difference.
It takes two minutes. For someone whose best work goes unseen, hearing that it mattered can make their whole week.
|