Skip to content

Cybersecurity Burnout Doesn't Always Announce Itself. Sometimes It Starts With a Longer To-Do List.

CYBR.SEC.Community Co-Founder Sam Van Ryder shares his personal experience with burnout, the warning signs he nearly missed, and why cybersecurity professionals need to recognize exhaustion before it becomes a crisis.

Burnout doesn't always arrive as a dramatic collapse. Sometimes it shows up as a shorter temper, a growing to-do list, forgotten commitments, or the realization that even a weekend away from work isn't enough to recharge.

For Sam Van Ryder, co-founder of CYBR.SEC.Community, those warning signs had been accumulating while he continued doing what he'd always done: pushing forward.

In the latest episode of CYBR.Signal, Van Ryder offered a candid assessment of his own experience with burnout, what finally made him recognize it, and why he believes professionals across the cybersecurity industry need to pay closer attention to their own warning signs.

Full episode:

Recognizing Burnout with Sam Van Ryder
Sam Van Ryder sits down and has an honest conversation about burnout and recognizing it before it starts to do real damage.

When pushing harder stops working

Van Ryder doesn't work in a security operations center or hold a traditional cybersecurity practitioner role. His day job involves managing large strategic accounts, while his responsibilities as co-founder of CYBR.SEC.Community consume considerable additional time. Add major projects at home, and the demands rarely stop.

"I'm basically burning the candle at both ends in a lot of cases," he acknowledges.

For years, that pace seemed normal. Van Ryder describes himself as a typical Gen Xer, accustomed to constantly moving, taking on new responsibilities, and thinking about whatever comes next.

But eventually, something changed.

He found himself becoming frustrated with people and situations that ordinarily wouldn't bother him. His energy disappeared halfway through the day. Even espresso couldn't compensate for the exhaustion.

Weekends offered little relief because he struggled to disconnect from work.

More concerning, his productivity began slipping. His to-do list grew longer, important responsibilities fell off his radar, and he found himself forgetting things he normally wouldn't forget. He was also making commitments he couldn't fulfill.

These weren't simply the consequences of having a busy schedule. They were signals that his workload and recovery time had fallen out of balance.

A cybersecurity conference presentation triggers a realization

The turning point came during CYBR.SEC.CON, where Joe Marshall delivered a closing presentation introducing a framework for measuring burnout. Here is the article and full video on that keynote:

Cybersecurity Burnout Needs an Incident Response Plan
In his CYBR.SEC.CON. 2026 keynote, Joe Marshall introduces the Human Incident Response Framework, a practical playbook for recognizing cybersecurity burnout, secondary traumatic stress, vicarious trauma and moral injury — and responding before the human incident becomes a crisis.

Marshall's presentation helped Van Ryder recognize that the problems he'd been experiencing weren't isolated frustrations. They were part of a larger pattern. Van Ryder believes he's still in the early stages of burnout, which gives him an opportunity to address the problem before it becomes more serious.

Burnout isn't limited to overwhelmed SOC analysts, incident responders, or executives carrying responsibility for an organization's security posture. It can affect account managers, community organizers, entrepreneurs, and anyone trying to balance competing demands without sufficient opportunities to recover.

"You don't have to be somebody in a specific profession," Van Ryder says. "It can happen to everybody."

His experience also highlights a problem within professional cultures that reward constant availability. Working through weekends, answering emails during personal time, and accepting every new responsibility can become so routine that the warning signs of exhaustion are easy to dismiss.

Recognizing burnout is only the beginning

Van Ryder isn't treating his realization as an abstract lesson. He's scheduled approximately a week of paid time off and is preparing colleagues and contacts for his absence. His goal is to genuinely disconnect rather than simply relocate his work to a different setting.

That means limiting email, avoiding unnecessary calls, and spending time with friends and family. He even jokes that meditation might make the agenda.

The larger point is that recovery requires more than acknowledging exhaustion. It requires changing the habits and expectations that helped create it.

Van Ryder encourages others to watch for their own warning signs, seek out Marshall's burnout presentation, and take action before those symptoms deepen.

He also emphasizes the importance of asking for help when needed.

For cybersecurity professionals accustomed to responding to emergencies, managing risks, and solving other people's problems, recognizing their own limits can be difficult.

But Van Ryder's message is straightforward: You don't have to wait until you're completely burned out to do something about it.

Taking time away from work shouldn't require reaching a breaking point first.

Latest