Defender Mental Health

Mental health and affiliation in cybersecurity, DFIR and incident response: an evidence review, 2014-2026

Defensive cyber work, and DFIR and incident response in particular, carries a measurable mental-health burden. Roughly two-thirds to three-quarters of surveyed practitioners report stress, anxiety or burnout. The most rigorous recent data come from digital forensics, where a 2026 study using validated clinical instruments found one in five investigators reporting clinically significant suicidal or self-harm thoughts ST-001. The strongest protective factors are organizational rather than individual: supervisory support, peer connection, manageable workload and real control over the work.

Summary#

• The harm is real; the measurement is weak. Most headline figures are vendor surveys with single self-report items: Tines’ 71% SOC burnout ST-042, IBM’s 67% of responders with stress or anxiety ST-033, Nominet’s 88% of stressed CISOs ST-051. The best-validated data come from DFIR and law-enforcement studies using the PCL-5, STS scales and the Maslach inventory: 17% of digital and multimedia examiners met PTSD criteria ST-015, and 20% of digital forensic investigators reported clinically significant suicidal or self-harm thoughts ST-001.
• Workload and conditions are the main drivers; trauma exposure is second for many. Time pressure was rated very or extremely stressful by 50% of investigators against 36% for CSAM exposure ST-006 ST-007. Microsoft’s responder study tied burnout to workload, limited control, poor teamwork and missing recognition ST-031. AI shifts the load rather than removing it: 48% say it lowered their stress and 32% report anxiety from validating its output ST-065.
• Affiliation protects, but it is under-built and under-studied. Supervisory support predicted lower secondary trauma a year later ST-022, and team support separated burned-out from non-burned-out responders ST-032. Yet 86% of investigators rarely or never get a peer debrief ST-003 and 49% have no clinical supervision ST-002.

Key findings#

1. Consistently high, methodologically soft. Workforce studies (ISC2, CIISec), CISO studies (Nominet, Cynet), SOC studies (Tines, Splunk) and IR studies (IBM) all report majorities under strain. Almost none use validated instruments, and most are run by vendors whose products are pitched as the remedy.
2. DFIR has the strongest evidence base, because law-enforcement CSAM work has been studied since about 2012. About a quarter of ICAC personnel scored high to severe on STS ST-021, and STS predicts turnover intention.
3. Private-sector DFIR and IR are almost unstudied. The only peer-reviewed IR burnout study has 35 participants from one company ST-031.
4. Liability fear peaked and partly receded. The SEC dismissed its case against SolarWinds and its CISO with prejudice on 20 November 2025; Joe Sullivan’s conviction was upheld on 13 March 2025. No study has measured the psychological effect of either case.
5. Neurodivergence is over-represented and intersects with strain: 13% of the global workforce ST-066, 19% of a UK sample ST-067, and 17% ADHD and 10% autism among investigators ST-010. Neurodivergent respondents report more exhaustion and lower satisfaction ST-068.
6. Exit is driven by mental distance, not exhaustion. Across 354,861 practitioner posts, mental distance came with a stated intention to leave about twice as often as exhaustion, and it is the symptom peers adjust their replies to least ST-077.
7. Intervention evidence is thin. The only cyber-specific outcome data come from Cybermindz’s iRest program, which is provider-run, uncontrolled and lost about half its participants ST-081.

How to read the numbers#

Every statistic on this site carries a grade. A: peer-reviewed, validated instruments. B: peer-reviewed or validated with design limits, or official inspection data. C: large association or independent survey with ad hoc items. D: vendor survey with a commercial interest in the finding, or a forecast.

• Vendor bias. Tines and other automation vendors, Splunk, Cynet, Mimecast and IBM all sell products framed as burnout relief. Their figures indicate direction, not prevalence.
• Instrument gap. “Burnout” in industry surveys usually means one self-rated item. Studies using the MBI, BAT, PCL-5, PHQ-9, GAD-7 or STS scales cannot be compared directly with single-item figures.
• Self-selection. Wellness surveys draw in distressed respondents; every DFIR study here is a convenience sample recruited through community channels.
• Inconsistent reporting. IBM’s help-seeking figure appears as 65% in coverage; IBM’s release says 64% ST-034. CIISec’s 51% is framed two ways ST-073. See where sources disagree.

Afflictions#

Burnout

Burnout follows the Maslach construct: exhaustion, cynicism and reduced efficacy, driven by six areas of worklife (workload, control, reward, community, fairness, values). Cybermindz and the University of Adelaide found cyber professionals below general-population Maslach norms, and on professional efficacy below frontline healthcare workers ST-080: a striking claim from a small, self-selected sample. Nepal et al. found burned-out responders worked more than 40 hours a week, slept worse and logged more after-hours work in telemetry, which is rare objective corroboration of self-report ST-031. The Burnout Assessment Tool separates four symptoms, and they carry different risks: mental distance travels with technical disillusionment and value misalignment and predicts leaving ST-077.

Secondary traumatic stress and vicarious trauma

STS concentrates in DFIR work involving CSAM, extremist content and violent media. STS predicted turnover intention and lower job satisfaction among ICAC personnel ST-021. People doing both examiner and investigator duties scored higher on STS and worthlessness than examiners only ST-028, but Tyagi and Seigfried-Spellar (2025) did not replicate the difference. Forensic examiners showed more depression and avoidance than officers viewing the same material ST-030. Examiners who met PTSD criteria endorsed 9 of 15 stigma items, many about agency culture ST-017.

Anxiety and depression

Validated anxiety and depression data exist almost only for DFIR (the 2026 Forensic Focus study used the GAD-7 and PHQ-9; Duran and Woodhams found the mode and volume of exposure predicted depression). Elsewhere the data are vendor items, such as IBM’s 67% “stress or anxiety” ST-033.

Moral injury

Moral injury is harm from perpetrating, failing to prevent or witnessing acts that violate deeply held moral beliefs, or from betrayal by authority. It fits incident response closely: responders who cannot stop harm to victims, or are overruled on disclosure or payment decisions. No validated moral-injury study of cyber responders was found. Conway et al. (2024) linked moral injury to poorer mental health and reluctance to seek help in UK officers investigating CSAM. In adjacent occupations, functionally impairing moral injury affects 7.3% of healthcare workers, 6.5% of combat veterans and 4.1% of first responders (Maguen et al., 2025) ST-088, and in a separate sample of 1,232, probable moral injury tripled the odds of current suicidal ideation after adjusting for PTSD and depression (Griffin et al., 2025) ST-087. Cisco Talos’s Human Incident Response Framework separates burnout, STS, vicarious trauma and moral injury for practitioners.

Substance use

The only figure found: the share of CISOs turning to medication or alcohol rose from 17% to 23% between 2019 and 2020 ST-053. Mental Health Hackers co-sponsors fundraising with Sober in Cyber, which suggests recovery needs exist in the community, but no prevalence data do.

Digital forensics#

Workload is often a bigger stressor than content. Case backlog and time pressure were the top-rated stressors in the 2026 study, ahead of exposure to harmful material ST-006. HMICFRS found device examinations waiting up to two years and caseloads of 30-54 per investigator in some forces ST-020. Exposure limits alone will not fix DFIR well-being without capacity fixes.

The help-seeking failure is structural. HMICFRS called reliance on self-referral “not acceptable”: staff feared being judged unsuitable and removed from work they cared about. Barriers were lack of time (48%), confidentiality (37%) and fear of career impact (34%) ST-011. Of those who get supervision, 27% rate it good or excellent ST-012.

AI-generated CSAM is a new stressor: 60% find it slightly more distressing than real material, partly because it undermines victim identification ST-009.

Documented mitigations in policing include HMICFRS Recommendation 15 (mandatory annual psychological screening for these staff and their supervisors by October 2026), Dorset Police’s image-grading exercise and counselor appointment before appointment with three monitoring appointments a year, Essex Police’s ‘Pause Point’ temporary redeployment, and hash matching with CAID to reduce re-viewing. Lighthearted humor is associated with lower STS and gallows humor with higher; denial coping predicts higher STS a year later ST-024 ST-023. Open the deep dive.

Incident response#

Tempo and concurrency. The first 72 hours are rated most stressful, more than a third of responders work over 12 hours a day at the peak ST-038, and 68% commonly carry two or more incidents ST-037. Nepal et al. identify unpredictable incident timing as a leading stressor; one participant described a belief that working “20 hours/day endlessly” is expected.

The access paradox. 84% of responders at large IR vendors say they have adequate access to mental-health resources and 64% have used them ST-035. Access is not the bottleneck there; workload and tempo are.

Purpose as motive and burden. About 80% cite a duty to protect others among their reasons for joining ST-041. The same sense of responsibility is the precondition for moral injury.

Personal liability. U.S. v. Sullivan: the former Uber security chief was convicted in 2022 of obstruction and misprision over the 2016 breach, sentenced in 2023 to three years’ probation, 200 hours of community service and a $50,000 fine, and the conviction was unanimously affirmed by the Ninth Circuit on 13 March 2025. SEC v. SolarWinds and Timothy Brown: filed 30 October 2023 as the SEC’s first action against a CISO; most claims were dismissed on 18 July 2024, and the case was voluntarily dismissed with prejudice on 20 November 2025 (Litigation Release 26423). Liability fear is best treated as a chronic stressor that shapes disclosure decisions; its effect has not been measured. Open the deep dive.

SOC and threat intelligence#

Sundaramurthy et al. (SOUPS 2015) embedded an anthropologist-analyst in a corporate SOC for six months and modelled burnout as a human capital problem: vicious cycles among skills, empowerment, creativity and growth, and management metrics. It remains the foundational SOC model. Current vendor data fit it: 64% of analysts spend more than half their time on manual work ST-045, 46% spend more time maintaining tools than defending ST-047, yet most are satisfied with the work itself. The problem is job design, not the mission.

AI shifts the burden. 48% say AI lowered their stress while 32% report anxiety from validating its output ST-065, and only 11% fully trust it for mission-critical work ST-049. Automation that removes toil fits the human capital model; AI that adds an oversight role without removing accountability adds a demand. Measure both.

Threat intelligence has no dedicated mental-health study. Plausible stressors include exposure to extremist and violent content, attribution pressure and harassment by adversaries; content-moderator research is the closest analogue and should be reviewed separately. Open the deep dive.

Affiliation and protective factors#

• Supervisory support predicted lower STS one year later in a three-year panel of federal investigators: the only longitudinal protective finding ST-022. It matches HMICFRS’s finding that 65% of staff turn first to their line manager ST-019.
• Team support and recognition separated burned-out from non-burned-out responders ST-032.
• Relationships and climate. ICAC staff who described the job as positive for their relationships had lower STS ST-025; investigators are less adversely affected when the organizational climate is perceived as positive.
• Belonging. For neurodivergent staff, job satisfaction rises from 54% to 73% when they can be themselves at work ST-070. 21% of UK professionals could not say they would feel comfortable raising harassment concerns ST-072.
• Communities as break rooms. Practitioners discuss in online communities what they cannot raise at work. Replies are dominated by career advice and shift least for mental distance, the symptom closest to leaving ST-077. The authors warn that employer monitoring of these spaces would end the disclosure.

No security study measures psychological safety or peer support with validated scales in a large sample. Community infrastructure (Mental Health Hackers, Cybermindz, CIISec with PTSD Resolution, the Mental Health in CyberSecurity Foundation, the Forensic Focus campaign, Mind Over Cyber, Sober in Cyber, The Diana Initiative, BlackGirlsHack) is listed under Organizations. Open the deep dive.

Theoretical frameworks#

Instruments and the studies that used them are in Frameworks.

Interventions and evidence#

There are no randomized trials in a cyber population. The strongest evidence is one longitudinal law-enforcement study supporting supervisory support. Public-safety reviews support trained peer support and multi-component programs over stress management alone; classic Critical Incident Stress Debriefing is contested there and has not been evaluated in cyber. Inspection evidence shows self-referral and EAP signposting fail content-exposed staff. Resilience training has the only cyber-specific outcome data, and it is uncontrolled. Workload governance, post-incident recovery, on-call redesign and blameless reviews have no outcome evaluation. See all interventions and the leader’s checklist.

Business and security impact#

• Turnover. STS predicts turnover intention among ICAC personnel; 28% of investigators are likely to leave within 12 months ST-005; 64% of SOC analysts expect to switch jobs ST-044; 74% of SMB CISOs are losing team members to stress ST-056.
• Performance. 31% of CISOs say stress affected their ability to do the job, and average tenure is about 26 months ST-054; 65% of SMB CISOs say stress compromises protection ST-055.
• Risk. 88% report a significant security consequence from skills shortages ST-064, and organizations with severe staffing shortages averaged $1.76 million more per breach ST-083. Gartner’s prediction that human failure would cause over half of significant incidents is a forecast, not an outcome.
• The missing link. No study links validated burnout scores to missed detections, error rates or time to respond. The often-quoted $626 million productivity-loss figure is vendor-modelled and only secondarily sourced. This is the most valuable gap for making the business case.

Regional and sector variation#

Strain after major incidents varies by country: India 77%, Brazil 65% and Spain 57% against a global figure above 40% ST-040. Burnout was reported at 35% in the Netherlands against 56% globally ST-085, and 85% across six APAC countries ST-084 (both vendor, secondary). The UK has the richest public-sector DFIR evidence (HMICFRS, Gullon-Scott, Conway) and the CIISec series; Australia has the Cybermindz MBI data; the US has the ICAC literature and most vendor surveys. Validated data are overwhelmingly public sector; no MSSP versus in-house comparison was found. CISO stress stayed high from 2019 to 2020 while reported mental-health impact rose from 27% to 48% ST-052; SOC burnout eased slightly from 71% to 63% between 2022 and 2023 ST-043.

Research gaps#

1. Commercial DFIR and IR consultants have no validated clinical study.
2. Only one longitudinal study exists (Craun et al., 2014); Forensic Focus plans a 2027 repeat.
3. Alert fatigue, on-call load and liability fear have no validated scales.
4. Moral injury in incident response is untested.
5. Burnout-to-outcome links (time to respond, missed detections, insider risk) are unquantified.
6. No intervention has been tested in a randomized trial in a cyber population.
7. Neurodivergent practitioners: high prevalence and higher exhaustion, no stressor research.
8. CTI analysts and exposure to AI-generated content: no data.
9. The psychological effect of the Sullivan and SolarWinds cases is unmeasured.
10. Peer support matched to the symptom disclosed is untested.

See each gap with who it affects and what would close it.

Recommendations#

• Treat this as operational risk, with Job Demands-Resources as the unifying lens. The recurring evidence points to demands (caseload, concurrency, tool sprawl, unpredictability) and missing resources (supervision, team support, control). Individual resilience programs supplement structural fixes; they do not replace them.
• For DFIR and IR leaders, including small firms: proactive confidential screening, structured monthly supervision for anyone exposed to harmful content, trained peer debriefs after major engagements, concurrency caps, explicit recovery time after incidents, and exposure-reduction tooling. Measure with the MBI-GS or BAT, PCL-5 and PHQ-9 so internal data can feed the evidence base.
• For the research community: the DFIR Summit and SANS community are well placed to run the missing study: a validated, longitudinal survey of private-sector DFIR and IR practitioners, ideally with academic partners already active in this space (Seigfried-Spellar at Purdue; Gullon-Scott at Northumbria).

Caveats and corrections#

• Most prevalence figures are vendor or association surveys with single-item measures and self-selected samples. Grade D figures indicate direction only.
• Figures marked secondary were verified only through secondary reporting and should be checked against the originals before publication. List them.
• The Gartner figure is a forecast, not an observation.
• Moral-injury prevalence by occupation comes from Maguen et al. (2025, J Gen Intern Med); the suicidality association comes from Griffin et al. (2025, npj Mental Health Research). Earlier summaries attributed both to the second paper.
• Content-moderator research, the hospital-ransomware harm literature and EU-specific data were not primary-sourced and are listed as expansion workstreams.
• A “Cyber Mental Health Fund” could not be verified as a distinct organization and is not listed.

Method#

Compiled in October 2026 from a structured web and literature search covering peer-reviewed studies, official inspections, association and vendor surveys, court and regulator records, and community sources from 2014 to 2026. Each statistic was recorded with its population, sample size, year, instrument, design, region and source, then graded A-D on study design and commercial interest rather than sample size. Where a figure could be checked against the original publication or its press release it is marked as primary. The dataset behind every page is embedded in this file and can be exported from any library as CSV or JSON.