Cyber Exodus: Burnout Symptoms, Exit Intention, and Peer Response in Online Cybersecurity Communities
Text analysis of 354,861 security practitioner posts shows burnout symptoms differ in causes, and mental distance predicts exit intention peers respond to least.
Researchers adapted the Burnout Assessment Tool into a text annotation scheme, reaching macro F1 of 0.75 across four symptoms and 0.98 for detecting any burnout signal. They applied it to 354,861 posts and 296,442 replies from five online cybersecurity practitioner communities. The four symptoms point to distinct workplace problems; mental distance is the only symptom unrelated to operational issues and co-occurs with stated intention to leave roughly twice as often as other symptoms. When posters mention leaving, peer replies shift toward career advice, but this shift is smallest for mental distance.
- Annotated 354,861 posts and 296,442 replies from five online cybersecurity practitioner communities.
- Annotation scheme reaches macro F1 0.75 across four symptoms, 0.98 for any signal.
- Mental distance is the only symptom unrelated to operational problems like staffing or workload.
- Mental-distance posts state exit intention roughly twice as often as other single symptoms.
- Peer replies shift toward career advice when leaving is mentioned, least for mental distance.
Full article249 words · extracted from arxiv.org · click to collapse
Security practitioners burn out at high rates, and the resulting attrition is itself a security problem. This workforce is hard to study: security operations centers are closed to outside researchers, studies that reach practitioners recruit through employers, and those who have disengaged most may have the least reason to answer an employer's survey. The same practitioners discuss their working conditions openly in online communities. We adapt the Burnout Assessment Tool, a validated clinical instrument, into a text annotation scheme and apply it to 354,861 posts and 296,442 replies from five online communities of cybersecurity practitioners. Checked against two trained coders on 100 posts, the annotation reaches a macro F1 of 0.75 across the four symptoms and 0.98 for detecting any burnout signal. We find that the four symptoms point to different problems at work, not to the same problem at different levels of severity. Exhaustion appears in almost any complaint about staffing or workload. Mental distance, a loss of belief that the work is worthwhile, is the only symptom unrelated to operational problems, and among posts with a single symptom it is accompanied by a stated intention to leave roughly twice as often as any other. Peer responses show the opposite pattern. When a poster says they are considering leaving, the mix of replies shifts toward career advice, but this shift is smallest for mental distance. The symptom most strongly associated with leaving is thus the one peers adjust to least, and a single burnout score obscures both patterns.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.19556