Most security teams have one. It’s the person who always picks up the phone at 2 a.m., who knows where every old system lives, and who somehow gets the team through the bad week again. We thank them, we lean on them, and without meaning to we build the whole program around them. Then one day they’re worn out, or they leave, and we find out how much was riding on one tired person.
Chris Bevil, a former CISO who now leads global cyber resilience and AI work at Commvault, put it well on Security Magazine’s Lock It Down podcast, as quoted by Security Magazine on Oct 21: “We have to stop treating sustainability as a personal wellness program and start really treating it as an organizational design problem.” He added that the next stage of maturity is building an organization “that does not require a hero every Tuesday, because that’s where the burnout is happening.”
I agree with him. This is a leadership problem, not a personal one. ISACA’s 2026 State of Cybersecurity survey, a global survey of more than 1,800 security professionals, found that 68 percent say their roles have become more stressful over the past five years. Unrealistic expectations and too much work were named as a key source of stress by 52 percent, and 58 percent of organizations believe their security team is understaffed. A reminder to use your vacation days won’t fix numbers like that. Leaders design the work, so leaders have to fix the design.
If your program depends on a hero, here are a few places to start:
- Find the single points of failure that are people. If only one person can do a task, that’s a risk, the same as an unpatched server. Cross train, and write it down.
- Look at who gets called after hours. If it’s the same name every time, spread the load and build a real rotation.
- Protect time off. When someone is on vacation, they should actually be off, and the team should be able to run without them.
- Thank your hero, then ask them to teach. The best thing you can give the person everyone calls is a team that doesn’t need to call them every Tuesday.
None of this means we stop appreciating people who step up in a crisis. Every team needs them, and they deserve real credit, by name. But a crisis should be the exception. If somebody has to save the day every week, the problem isn’t them. It’s how we built the job.
Links: Security Magazine’s article on Chris Bevil (https://www.securitymagazine.com/articles/102660-ciso-burnout-isnt-a-personal-problem-its-organizational) and ISACA’s article (https://www.isaca.org/resources/news-and-trends/newsletters/atisaca/2026/volume-19/isaca-state-of-cybersecurity-report-tracks-ais-growing-influence-on-security-landscape).
