Stress in the cybersecurity profession: a systematic review of related literature and opportunities for future research

Abstract

PurposeThe impact of stress on personal and work-related outcomes has been studied in the information systems (IS) literature across several professions. However, the cybersecurity profession has received little attention despite numerous reports suggesting stress is a leading cause of various adverse professional outcomes. Cybersecurity professionals work in a constantly changing adversarial threat landscape, are focused on enforcement rather than compliance, and are required to adhere to ever-changing industry mandates – a work environment that is stressful and has been likened to a war zone. Hence, this literature review aims to reveal gaps and trends in the current extant general workplace and IS-specific stress literature and illuminate potentially fruitful paths for future research focused on stress among cybersecurity professionals.Design/methodology/approachUsing the systematic literature review process (Okoli and Schabram, 2010), the authors examined the current IS research that studies stress in organizations. A disciplinary corpus was generated from IS journals and conferences encompassing 30 years. The authors analyzed 293 articles from 21 journals and six conferences to retain 77 articles and four conference proceedings for literature review.FindingsThe findings reveal four key research opportunities. First, the demands experienced by cybersecurity professionals are distinct from the demands experienced by regular information technology (IT) professionals. Second, it is crucial to identify the appraisal process that cybersecurity professionals follow in assessing security demands. Third, there are many stress responses from cybersecurity professionals, not just negative responses. Fourth, future research should focus on stress-related outcomes such as employee productivity, job satisfaction, job turnover, etc., and not only security compliance among cybersecurity professionals.Originality/valueThis study is the first to provide a systematic synthesis of the IS stress literature to reveal gaps, trends and opportunities for future research focused on stress among cybersecurity professionals. The study presents several novel trends and research opportunities. It contends that the demands experienced by cybersecurity professionals are distinct from those experienced by regular IT professionals and scholars should seek to identify the key characteristics of these demands that influence their appraisal process. Also, there are many stress responses, not just negative responses, deserving increased attention and future research should focus on unexplored stress-related outcomes for cybersecurity professionals.

Reintegration of cyber veterans: challenges and strategies for post-war transition

“…Working in the field of cyber security has been compared to working in a warlike environment (Brody, 2015;Singh et al, 2023).…”

“…Recent studies have indicated that work-related stress is high in the cybersecurity profession (Nobles, 2022;Singh et al, 2023). According to a 2021 CIISec State of Profession report, over half of cybersecurity professionals report having stress-related sleeping issues (Wilson, 2022).…”

“…Even without the hostilities of war, work-related stress can be high in cybersecurity professions (Nobles, 2022;Singh et al, 2023). When this is combined with the additional concerns of personal health and safety, atypical working conditions, high stakes in operations and possible exposure to traumatic events, they will endure considerable strain in their tasks.…”

Psychological Effects of Continuity Threatening Cyber Incidents

“…Working in the field of cybersecurity has been compared to working in a warlike environment (Brody, 2015;Singh, et al, 2023). Cyberspace does not follow geography and threat actors can project their attacks easily to anywhere on the globe making organisations defences endlessly contested.…”

“…Cybersecurity professionals are providing critical service to ensure business continuity of organisations and government services in a constantly changing adversarial landscape (Paul & Dykstra, 2017). Recent studies have indicated that work-related stress is high in the cybersecurity profession (Nobles, 2022;Singh, et al, 2023). The VMware Global Incident Response Threat Report from 2022 demonstrates that 51% of cybersecurity professionals self-report having symptoms related to burnout and of that group, 65% have considered leaving the cybersecurity profession altogether (VMware, 2022).…”