Mental Health in Cybersecurity: The Weight of Vigilance

It's 6:47 a.m. The incident was contained hours ago. The systems are fine. You're the one still running hot.

This episode opens the Month of Mindfulness, a five-week Plaintext with Rich series on mental health, spiritual health, physical health, burnout, and work-life balance for people working in cybersecurity and tech. May 1 happens to fall during Mental Health Awareness Month, which makes it the right time to start. We're talking about the mental load that comes with vigilance work: on-call rotations, alert fatigue, incident response, and the cost of being the person who carries worst-case scenarios in your head all day. Plus a Plaintext Starter Kit with five practical moves, including how to actually use your Employee Assistance Program (EAP) and where to find Mental Health Hackers at the next conference you attend. And three programs worth bookmarking: Pacific Mindful's CyberReset, The Zensory, and Shield Community, each built for the nervous system demands of technology and cybersecurity work.

If you've ever come off an incident and wondered why your body is still running an alert two days later, this is for you. Whether you're an analyst, an engineer, a CISO, or the one person doing security at a 40-person company, the load is real and so is the recovery.

Ten minutes or less. One topic. No panic. 

Pacific Mindful's CyberReset, a precision nervous system training tool built for high-exposure roles. https://www.pacificmndfl.com/reset

The Zensory, a science-backed wellbeing platform with a dedicated Cyber Mindfulness Campaign. https://thezensory.com

Shield Community, a wellness program built specifically for technology and cybersecurity professionals. https://www.shield.community/

YouTube more your speed? → https://links.sith2.com/YouTube  
Apple Podcasts your usual stop? → https://links.sith2.com/Apple  
Neither of those? Spotify’s over here → https://links.sith2.com/Spotify  
Prefer reading quietly at your own pace? → https://links.sith2.com/Blog  
Join us in The Cyber Sanctuary (no robes required) → https://links.sith2.com/Discord  
Follow the human behind the microphone → https://links.sith2.com/linkedin  
Need another way to reach me? That’s here → https://linktr.ee/rich.greene

Transcript

After The Incident Quiet

SPEAKER_00 0:00

It's 6:47 a.m. The incident was contained around 3 a.m. You showered, you ate something, you answered three follow-up emails. Now you're sitting in your kitchen staring at the coffee maker, wondering why you can't quite remember what day it is. The systems are fine. You're the one still running hot. Welcome to Plain Text with Rich. This is the start of something different. May is Mental Health Awareness Month, which makes today a good day to begin. But this isn't a one-off observance, right? The next five episodes are a series. I'm calling it the month of mindfulness. We're going to talk about mental health, spiritual health, physical health, burnout, and work-life balance. All of it through the lens of working in security and tech. And today we start where most people don't want to start, and that's mental health. A note before we go further: I'm not a therapist, I'm not a clinician. I'm simply a person who has worked in this industry long enough to see what it does to good people and to feel some of it myself. So this isn't medical advice. This is one practitioner talking to another. In plain text, mental load is the cost of running your brain in the background, even when you're not actively at the keyboard. It's the cognitive price of vigilance, right? Cybersecurity work is mental load by design. And here's why. The job is to imagine what could go wrong, then prevent it. It's to think like an attacker without becoming one, to carry the worst-case scenario in your head so the company doesn't have to. That sounds noble in a job description. In real life, it can be exhausting. Because the moment you log off, the threat landscape doesn't go quiet. The phishing campaigns keep running, the new CVE drops at 11 p.m. on a Saturday, the pager, for those that still have them, keeps working. You're never really off. Even when you're off, you're not. Let me name some of the specific stressors, right? They're real and they compound. On call rotations. You sleep with one eye open. Your nervous system learns to anticipate the alert even on weeks when you're not on call. Your body sometimes forgets that. We have alert fatigue, right? Hundreds or thousands of signals a day, most of them benign, a few that matter. Your brain has to triage at machine speed without going numb. The contradiction is the cost. What about incident response? A breach hits and time bends. Hours feel like minutes. You skip meals, you skip sleep, you skip your kids' recitals. The adrenaline carries you for a while and then it doesn't. What about being the person who says no? Security professionals are often the ones telling sales they can't ship that feature. Telling leadership the timeline is wrong, telling a developer their PR introduces risk. You're the friction in someone else's velocity day after day, and that tends to wear down on some folks. Carrying secrets, right? You know what was almost lost. You know what nearly happened. You can't tell anyone outside the response team that isolation is real, constant rehearsal, or worst case scenarios. Most jobs don't require you to imagine catastrophe as a daily practice, and yours does. Imagination does have a price. When you stack those, you get a workload that doesn't show up on a timesheet. There's a phrase I keep gummicked to, and you'll hear this a couple of times, or at least different phrases, and that's vigilance has a cost. We talk about cost in terms of headcount and budget. We don't talk about it in terms of nervous systems. The bill comes due either way. And here's the part I want to land carefully. Our industry has a culture of stoicism, right? Heads down, get it done, don't complain. The folks who came up in the 90s and 2000s, they often wear the grind as a badge of honor. I respect the discipline. I came up in some of those rooms, right? But discipline without recovery isn't strength. It's compounding interest on debt that you can't see yet. The strongest operators I've worked with weren't the ones who refused to rest. They were the ones who knew how to recover so they could do it again. Same idea applies here. So what do you do with this? This is our plain tech starter kit for protecting your mental load. Five moves, all small enough to start this week. One, name the load out loud. Most of us minimize what we're carrying because nobody around us is naming theirs. So someone has to go first. Right? In your next one-on-one, say it. This week was heavy. You can admit it. That's that's enough. You don't have to perform, you just have to stop pretending. Number two, build a recovery window into your shift, right? 20 minutes after instance, after long days, after a hard customer talk, walk, sit, breathe. Don't refresh email. Don't doom scroll vendor blogs. Recovery is not a reward for finishing, right? It's part of the work. Number three, know what your employer actually offers, right? Most companies have an employee assistance program or EAP. It's usually a free confidential service that includes short-term counseling and referrals. Most people who have one don't know they have one. Look it up this week. You don't have to use it. Just know where the door is in case you do need to. Number four, find peers, not just colleagues. There's a community called Mental Health Hackers that runs at most major security conferences. They set up quiet rooms, they talk about this stuff openly and without judgment. Find them at the next event you attend. There are also Slack and Discord communities of practitioners who get the specific weight of this job. Peers who understand the work make a real difference. And number five, protect your sleep like it's a production system. You wouldn't let a critical service run on uptime that bad. Don't let your brain. Sleep is when your nervous system processes the day, right? Skip it consistently and the load compounds in ways you can't argue your way out of. Now, a few resources I'll point you toward before we wrap. Pacific Mindful runs a program called Cyber Reset, a precision nervous system training model built specifically for high exposure roles. Two-minute resets, micro learning modules, tactile recovery tools, evidence-based built for the kind of days we actually have. The Zensory, it's a science-backed well-being platform with a dedicated cyber mindfulness campaign used by teams at Google, KPMG, and a plethora of others. If you want something accessible, you can pull up on your phone between calls, start there. And Shield Community, a wellness program built specifically for technology and cybersecurity professionals, right? It combines evidence-based methods from neuroscience and psychology with grounding practices to help people regulate stress and lead from a steadier place. Still growing, so make sure you get on the list. Well, there'll be links in the show notes. So our plain text recap. Mental load is real. It's part of the job description, right? We don't print on the job description. Vigilance has a cost. Recovery isn't weakness, it's how strong people stay strong. You don't have to fix everything this week. You just have to stop pretending the load isn't there. That's the first leg of the stool. We'll get to the second next Friday. If you have a topic you want broken down in plain text, or you just want to tell me what this week has been like, send it my way. Email me, DM me, drop in the comments, right? Notes left on the meditation cushion you keep meaning to use are also accepted. I do read them all and I will try to get back to you. If you're listening in a browser, hit subscribe and whatever app you use. It's the single best way to make sure you don't miss the next one. If this episode helped, share it with someone who'd actually benefit. This has been Plain Text with Rich. 10 minutes or less, one topic, no panic. I'll see you next time.