Why CISOs are burned out and what we can do about it

It’s not just you. The exhaustion so many of us in security leadership feel right now is real, and it's getting harder to ignore. The inbox never slows, the stakes keep rising, and no matter how far we run, the goalposts keep moving.

Over the past few months, I’ve had countless conversations with fellow CISOs who are considering stepping back, changing careers, or simply asking, “How much longer can I keep doing this?” These are some of the most resilient, battle-hardened people I know, and yet they’re worn thin. And I’ll be honest, I’ve felt it too.

The question is, why now?

When the responsibility grows but the influence doesn’t

One of the greatest challenges facing CISOs today is a fundamental mismatch between responsibility and authority. We're being asked to sign off on high-stakes initiatives, manage risk across every corner of the business, and appear at board meetings as the voice of cyber resilience. But when it comes to actual influence, budget, resourcing, strategic direction, we're often left sidelined.

I’ve sat in rooms where critical investment decisions were being made without security at the table. And when we raise the red flag, we’re told there isn’t budget or appetite for more controls. Until, of course, something goes wrong, and then all eyes are on the CISO.

That tension wears you down over time. It’s the weight of carrying responsibility without having the levers to manage it. You can only run at that pace for so long before something gives.

Burnout isn’t just about workload

Yes, the hours are long. Yes, the incident response demands are relentless. But what truly drives burnout in this role isn’t just the sheer volume of work. It’s the lack of clarity. The feeling that you’re fighting invisible battles in silos, often without a shared understanding of the stakes.

Security leaders today are expected to be everything: technologists, crisis managers, legal interpreters, educators, diplomats. And we wear these hats because we care, about the people, the mission, and the trust we’re helping to protect.

But caring without support is a dangerous equation. It leads to overcommitment, under-recognition, and ultimately, disillusionment.

The CISO role is evolving fast

I’ve said this before in panels and private conversations: the CISO role isn’t what it used to be. And it shouldn't be.

We used to be the architects, the engineers behind the scenes. Now, we’re front and centre. We’re being asked to report to the board, align with business priorities, and become stewards of brand and trust. In many ways, that’s a huge opportunity. But it’s also a risk, because the industry hasn't fully caught up with what this expanded role needs to succeed.

If we're going to ask CISOs to be strategic business operators, then the environment around us needs to change too. That means building cultures that support decision-making accountability, that embrace shared risk ownership, and that truly invest in security not just as a compliance requirement, but as a core business enabler.

What needs to change

For starters, we need to stop treating burnout as a personal failing. It’s systemic. And the solutions must be, too.

Organisations need to be clear about the outcomes they expect from their security leaders, and then match those outcomes with the tools, teams, and influence required to deliver. That means giving CISOs more than a seat at the table. It means making space for security to shape the conversation, not just respond to it.

That also means educating the board. Too often, board members don’t fully understand the role of the CISO or the complexity and pressure that come with it. We’re not just tech leads; we’re managing risk at a scale that impacts every function in the business. When boards recognise that, they start to ask better questions, offer stronger support, and drive more aligned decisions. And that’s when real progress happens.

We also need to rethink how we define success in this role. If everything is urgent, nothing is strategic. I’ve found that the more we can shift from reactive firefighting to proactive risk framing, the more sustainable our work becomes. It’s not easy, especially when the threat landscape changes overnight, but it’s critical.

And finally, we need to create pathways for renewal. I’ve spoken with more than a few CISOs who are exploring board roles, advisory work, or even moving into venture capital, not because they’re leaving security, but because they want to lead from a different angle. That’s not failure. That’s growth. We should celebrate it.

For others, it’s about finding the right environment where your values, influence, and responsibilities are in sync. I’ve been fortunate to find that at the companies I have worked with, where I can focus on building forward-looking strategies in a culture that genuinely supports the CISO function. That balance matters. And we should be creating more of it across the industry.

A new chapter for security leadership

I believe we’re at an inflection point. The challenges are real, but so is the potential for change. If we get this right, we don’t just make life better for current CISOs. We help define a healthier, more impactful future for those who come after us.

Burnout isn't inevitable. But addressing it requires honesty, empathy, and above all, action. So to my fellow CISOs who are feeling the strain: you're not alone. Your work matters. And it’s time we made the system work for you, too.

Rinki Sethi is CSO at Upwind Security.