The cybersecurity industry has a perverse incentive problem, and it's baked into how we measure success. We're rewarding companies for managing risk *after* it explodes into a headline, while starving investment in the unglamorous work that prevents disasters in the first place. Then we act surprised when security leaders burn out.
Look at the current landscape. Vendors sell flashy incident response tools and post-breach forensics platforms. Consultants charge premium rates to help companies recover from compromises. Insurance companies build entire business models around cyber incidents as inevitable events. Meanwhile, the CISO tasked with actually preventing those incidents operates on a fraction of the budget, with half the executive attention, and faces constant pressure to do more with less.
This is backwards incentive design, and the industry knows it.
Consider what happens when a major breach occurs. The affected company suddenly has board-level attention. Funding flows. Consultants flood in. New tools get purchased at markup. The media covers it extensively. Everyone mobilizes. But where was that urgency *before* the breach? Where was that budget allocation when the CISO was asking for better visibility into supply chain security, or warning that legacy systems needed replacement, or requesting staff?
The financial incentives reward crisis response, not crisis prevention.
CISOs aren't burned out because the work is hard. They're burned out because the system actively punishes them for success. A security leader who prevents a major incident gets no headlines, no budget increase, and no board commendation. A security leader whose defenses fail gets intense scrutiny, even if their team performed better than industry average given the constraints they operated under. The outcome is the same across the industry: talented people leave the field because they're exhausted by impossible expectations and misaligned incentives.
Recent trends underscore this dynamic. When phishing attacks spike and device code exploits surge, we discuss it as an emerging problem requiring urgent response. But the fundamental issue isn't that threats are new. It's that companies were never incentivized to implement basic controls that would have prevented these attacks at scale. The industry creates demand through failure, then profits from remediation.
Supply chain security offers another case study. Calls for better SBOMs and software transparency come *after* major incidents have exposed gaps. The real prevention work, the tedious process of mapping dependencies and auditing vendors before disaster strikes, happens on a shoestring. Only after a compromise do companies suddenly care enough to invest.
Deepfakes and AI-enabled social engineering represent the next chapter in this pattern. Rather than industry-wide coordination on detection standards and prevention frameworks, we'll likely see the same cycle: incidents occur, alarm spreads, funding flows to incident response tools, and executives congratulate themselves on better preparedness. Meanwhile, the work of actually making these attacks harder to execute successfully remains underfunded.
The fix requires uncomfortable changes. Boards need to reward prevention, which means accepting that good security looks like the absence of something. Companies need to measure CISOs on risk reduction metrics, not incident response speed. Vendors need to compete on making attacks harder, not on fixing them faster. Investors need to see value in boring, preventive work, not just dramatic recoveries.
This won't happen overnight because the current system benefits too many players. Security vendors, consultants, and incident response firms all profit from this arrangement. There's money in solving crises. There's less money in preventing them.
But here's what readers should notice: when a CISO tells you they're exhausted, they're not just tired. They're operating in a system where their incentives are actively misaligned with their stated goal. They're being asked to prevent the inevitable while being rewarded only when they fail to do so.
That's not a personal problem. That's an industry design flaw. And until we fix the incentives, we'll keep burning through talented security leaders while congratulating ourselves on how fast we respond to the next crisis.