Cortisol Chaos - Why You Need Stress Management for a career in Cybersecurity

By the time I arrived at the office to help in the recovery of the business, all servers had been destroyed by the IT Manager. It took them just fifteen minutes and a hammer to reduce the server room to a heap of twisted metal and a million fragments of plastic.

The reverberation of that night's event impacted the business, their clients, the team and of course the IT Manager.

This is just one example of a risk we don’t talk enough about.

Stress Management – The risk we don’t talk about in Cybersecurity

Before we get into this topic, we should say that we are NOT mental health professionals, nor are we biologists. However, we do have a lot of knowledge and first hand, real-world experience in the area of stress management.

But let’s start with something we believe we all know; Cybersecurity is stressful and can negatively impact our lives in a number of ways. In fact, at its worse, it can be a killer!

This is the dark side of our industry that few talk about, but we need more open discussions on it.

I’m not saying that other professions aren’t stressful, because clearly, they are. Let's face it, when I’m having a bad day, at least I’m not being shot at and my life isn’t in danger!

But although that is true, there are aspects to this career that are harmful to our lives, which are specific to our profession. This need to be understood by business leaders, those within the profession and those thinking of a career in it.

So take this blog for what it is meant to be; A rallying cry for more understanding and a warning of future risks and issues within your business.

Crisis Management – a Very Human Response

Over the years I’ve dedicated a lot of time in understanding how people respond in a crisis situation. As a dedicated Business Continuity Manager, I felt it was important to know how to reduce stress when a major incident occurs.

The Fight, Flight or Freeze Response

First it’s important to recognise that our stress response is something which is inherent within us all. We have evolved over millions of years to see, or sense danger and when this happens, our bodies will react in a myriad of ways that change as the crisis situation unfolds.

Many of us will have experienced being in stressful situation, and we feel a sudden ‘sick feeling’ in the pit of your stomach. You might feel cold, and seem to be frozen to the spot as your body is flooded with a complex mix of hormones, including adrenaline and cortisol.

Adrenaline increases your heart rate and blood pressure and should help you react quickly to the danger, real or perceived, that you’re facing. While cortisol helps to suppress non-essential functions, such as digestion, and increases energy levels. This is why some people will respond to a crisis by becoming highly energised and make rash decisions.

This response helped you when facing an animal with claws and sharp teeth, or a volcano that was about to swallow your entire village!

Thankfully, these aren’t scenarios we face in the modern (business) world (too often), but the hormones are still there and they’re ready and waiting to be used when facing perceived threats. They’ll happily flood your body when you are required to present to an audience, or when you have multiple ‘attacks’ from competing deadlines and an inbox that never sleeps.

What’s the risk for Cybersecurity?

First it’s important to remember that these hormones are meant to be there to protect us. They are intended to flood our bodies in order to respond to a crisis. We are not meant to be in a constant state of ‘crisis’ that the body cannot recover from.

Unfortunately Cybersecurity professionals are often in a stressful dance with cortisol and adrenaline because the threats we face are every increasing, and our resources (physical and financial) are depleted.

The relentless stress of a possible attack means that our ‘spidey senses’ are constantly tingling, as we anticipate the next attack, the next data breach or system outage. In this situation, cortisol, the body’s stress hormone increases so that we can have sustained energy.

While being under moderate stress increases cortisol for a period of time, prolonged cortisol increases have a negative impact on our health, including;

Burnout and exhaustion. This can manifest itself in multiple ways, including ‘quiet quitting’, cynicism and disruptive behaviour.
Disrupted sleep patterns leading to lapses in concentration, mistakes and an increased risk of data breaches.
Cardiovascular issues caused by the cortisol which can increase risk of heart disease, high blood pressure and strokes.
Digestive problems leading to ulcers and weight gain
Weakened immune systems meaning that the cortisol will reduce your ability to fight off infections and illness.
Increased risk of mental health issues, such as anxiety and depression.

From a business perspective, this presents us with a number of risks that need to be addressed. We need to be proactive about protecting those within our business, but recognise that some of us (especially those in Cybersecurity) are in an almost constant state of ‘crisis’ that few others are.

We’re not saying that other roles or professions aren’t stressful or important. But few roles are specifically tasked with;

Looking at all the threats that we face, but knowing we can never be fully aware of who might attack us or from which direction the attack will come from.
Looking for all the vulnerabilities there are, both internally and externally, but knowing we will always be vulnerable to attack because the attack surface is ever increasing.
Explaining all of this to an audience that is tired, overworked, distracted and bored(!)
Leading in a crisis. When it does go wrong, we’re often the ones expected to stand at the head of the business and lead through the disaster. The CEO or business owner looks to us to ‘sort it out’, but are we equipped with the knowledge, skill and experience to do this?

Few other roles have the diversity of undertakings that we do. That’s partially why we enjoy it. But too much stress, and overwhelm is not a good thing. It’s simply not sustainable.

That’s why it’s good to talk about this topic.

But it’s better to listen

Ok, so what can we do? How do we address this problem? First, we need to recognise that this is a risk. We need to speak to HR about how we manage stress within the workplace, because increased stress can lead to mistakes, which can lead to data breaches.

There are a range of stress management techniques you can implement, from mindful practices such as meditation through to regularly exercising. On an individual, intellectual level we all know this. Even at a corporate level, you might have initiatives in place to encourage regular breaks or exercise.

But this isn’t enough.

We need to listen.

Are you, as a leader, as the HR function, as a manager, as a colleague, as a friend, really listening and taking notice?

Has someone's behaviour suddenly changed? Are they quieter than they used to be, never fully taking part in meetings anymore (aka ‘quiet quitting’)? Are they disruptive and having regular mood swings? Are they making more mistakes? Have they not taken a holiday in months? When was your last 1-2-1 meeting with them?

You need to listen to the verbal and non-verbal indicators that they are struggling.

Sometimes they might mention their stress. This might be ok. But are they saying it on a weekly or daily basis? Some might tell you that they feel overwhelmed and ‘stressed out’. Is this part of their normal vocabulary? Or is there truth in their remarks?

Stress can be a killer. Stress can have an impact on your business and your team in very real ways.

At the top of this blog I recounted an incident I had to deal with, and the ‘root cause analysis’ was determined to be stress. However, in truth, the root cause was that the organisation just didn’t listen. The IT manager displayed all the signs of stress - lack of sleep, poor eating patterns, and feeling overwhelmed. This affected their decision at work and led to several system issues. Their home life was affected, as they took this stress home, which eventually led to their relationship breaking down.

They blamed the company for all of this. Their mental health was suffering and the business didn’t listen, so they took action.

Our bodies are designed to protect us. Adrenaline and cortisol are good things, in brief bursts. But if they become constant, we will all suffer.

We believe we need to do more to protect each other, and be there for each other. It’s not difficult if we all take time to listen more.

Consultants Like Us