Cybersecurity Workers Face Burnout Amid AI-Driven Threat Surges

Cybersecurity workers are struggling to assess large volumes of threat data generated in a fight largely enabled by AI. Defenders must identify affected companies and distinguish dangerous attacks from other threats. The growing demands on incident responders are worsening the industry's persistent burnout.

Troy Bettencourt, who leads Palo Alto Networks' global digital forensics and incident response practice, said demand for the team's services rose by double digits over the last six weeks. Bettencourt described this year's workload as unrelenting, unlike earlier surges associated with major attacks such as SolarWinds. Bettencourt said the pressure extends across the industry, with even Palo Alto Networks' incident response subcontractors operating at full capacity. Bettencourt said investigations previously manageable by one consultant now need five to 20 people. Palo Alto Networks is moving employees from other projects into incident response while preparing for further attacks exploiting PHP vulnerabilities disclosed last week.

Samantha Lewis, Armadin's head of threat intelligence, said customer requests have overwhelmed the team as customers assess exposure to AI-discovered flaws in foundational internet code. Lewis described this week's workload as chaotic and exceptionally burdensome. The team spent days assessing hundreds of purported exploits to identify genuine threats to customers. Many of those purported exploits failed to work.

Justin Timothy, a threat intelligence consultant at GuidePoint Security, described the strain by saying, "The last month has been the longest year of my life." Timothy was already overloaded before "Black October" as hacker groups resumed activity after a summer slowdown. Those groups specialize in ransomware, attacking institutions' networks and holding the networks hostage. Ransomware has disrupted pipelines, hospitals, education software and other essential services for years, although AI now contributes to many new cyberattacks. The threat is expected to worsen this year because powerful new AI systems are strengthening attackers faster than defenders can protect large, exposed parts of the internet.

AI's capacity to discover additional software flaws threatens to increase defenders' workloads further. Security firms are turning to AI and automation to find weaknesses and complete investigations faster. Lewis said the staffing levels needed to defend against these threats are becoming unmanageable. However, Bettencourt said workers exhausted by investigations also worry that AI tools intended to reduce workloads could replace those workers. Bettencourt said media coverage predicting that AI will take jobs adds to the pressure on workers already experiencing burnout.

Even companies with little exposure to the latest security threats have faced additional strain. Jack Nelson, Ivanti's chief information security officer and deputy general counsel, said Nelson slept less than usual this past week despite Ivanti's limited exposure to the PHP vulnerabilities. Nelson described the period as busy.

Cyber defenders cannot sustain the current pace indefinitely. Many defenders hope AI will strengthen defensive capabilities in a fight that some expect to continue for 12 to 18 months.