When ransomware hits home: putting your people first

Picture the scene. The head of IT security at a major business has just managed their team through several weeks of grueling work in containment and recovery after the latest ransomware attack. Their critical systems are back online, but after constant crunch time and sleepless nights, the team is visibly fraying; morale is low, anxiety is high, and there is more than one empty desk where senior personnel have taken extended sick leave.

This kind of scenario rarely gets attention in the press, where the focus of cyberattacks is on profit and loss, the impact on customers and the bottom line. But serious attacks take their toll on security teams too, and the aftermath can persist for months, leaving the organization even more vulnerable to future threats.

True cyber resilience, then, cannot be measured solely by systems restored or data decrypted - it must also factor in the people whose well-being determines not just how swiftly an organization recovers but whether it can withstand the next digital onslaught.

The hidden internal impact of an attack

The impact of an attack is typically weighed by system downtime, lost business, and potential reputational, legal and regulatory damage. Successful cyber strategies are measured in terms of key metrics like mean time to detect and respond to incidents.

But when the smoke clears and systems are back online, the human cost to personnel dealing with the attack is rarely tallied in stakeholder reports.

A landmark RUSI and University of Kent study found that cybersecurity personnel frequently experience PTSD-like symptoms, from panic attacks to insomnia, long after a crisis has been resolved.

This results in a second wave of disruption as sick leave and diminished morale ripples through the department and goes on to impact the rest of the company. Burnt-out IT and security teams will struggle to keep up the company’s baseline security, further increasing its risk exposure.

One major financial services firm in the University of Kent’s study reflected that placing its exhausted engineers on gardening leave immediately after a ransomware crisis could have averted “months and months” of subsequent sickness absence and spared the organization the hidden costs of burnout.

In short, serious attacks like ransomware don’t just hold data hostage; they also trap people in a cycle of exhaustion and fear. If organizations treat staff wellbeing as an afterthought rather than a key element in the front-line defense, they risk allowing human capital to become the weakest link in their cyber-resilience strategy.

The growing cyber leadership crisis

While the personnel on the frontline of incident response and containment are suffering from stress and overwork, things are often even worse higher up the chain. CISOs and other senior security leaders are usually held ultimately accountable for any failure to prevent or contain a breach, and it’s a responsibility that weighs heavily.

Leaders may be held personally responsible for crises they may lack the budget, headcount or organizational clout to address. Adding to the strain, success in this field frequently remains invisible: a CISO and their team may stop hundreds of daily attack attempts without fanfare, yet a single breach can spell career-ending catastrophe.

Putting in extra hours to stay on top of this workload is standard practice and our research found that 98% of security leaders admit to routinely logging an extra nine hours a week on top of contracted time as they attempt to keep ahead, with 15% pushing beyond sixteen hours overtime.

Soberingly, over half of the respondents said they are actively exploring new roles. This would be a troubling statistic for any industry, but it’s especially damaging in the cybersecurity field grappling with a long-term skills drought. When an IT security leader leaves, they take years of hard-won experience and knowledge with them, leaving the company’s security on less stable footing.

Organizations must protect their security talent

If the individuals responsible for your defenses are exhausted, no firewall can effectively prevent the relentless tide of burnout. Enterprises must integrate human resilience into their incident-response framework, a process that commences well before an alert is triggered.

However, it need not be a resource-heavy exercise for the organization. For example, our research found that 65% of organizations already offer flexible hours and 62% enable hybrid or remote working as standard. Simple measures like this grant staff a sense of control and space to recharge.

On a larger scale, enterprises need to ensure they have a framework in place to protect security personnel, especially leadership roles where the heaviest burden falls. CISOs need to feel empowered on a strategic level with the tools and influence to properly protect the company, not left struggling to make do.

When an incident does occur, the aftermath and recovery phase should focus on forward-looking conversations about what happened and what can be improved for next time. This support is even more important as we see a growing trend towards personal accountability and legal liability when procedures for reporting are not followed.

Removing the stigma of security stress

Alongside specific security processes, there’s a strong psychological element here too. The high-stress nature of cybersecurity should be openly acknowledged and accommodated, not treated as a burden that CISOs should conceal. Conversations around mental health should be normalized, and companies should consider wellbeing checks to spot early warning signs of burn out.

Communication is a key part of this. During an incident, the security team should feel connected to the company they are protecting, not in isolation, and should have a reporting process for feeding back on challenges and concerns if they need additional support.

When an attack has been resolved, a team wellbeing check should be a standard part of the post-incident process. Not every team member will have the same resilience in the face of a stressful crisis, and not every incident will hit the same. Businesses must be aware of who is struggling and provide support to them as needed.

Resilience beyond recovery

Ransomware may be a security issue, but its true impact plays out in human terms: sleepless nights, frayed nerves, and the talent exodus that follows unaddressed burnout.

By incorporating people-first measures into your cyber-resilience strategy, you can ensure that your organization won’t be weakened from within after a breach. The true test of resilience shouldn’t be solely about restoring systems quickly; it should also assess how effectively you protect and preserve the individuals who defend them.

We list the best firewall for small business.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro