An Antidote to Stress in Cybersecurity

Stress is an unfortunate, but unavoidable occupational hazard in cybersecurity. Think about it. Each time you go to work—or, in today’s world, log on from home—you are facing thousands if not millions of potential attacks. If a single one is successful, it can cripple the business and leave permanent scars on your organization’s credibility and goodwill. It can damage your own reputation and job security.

Whether you are the Chief Information Security Officer (CISO) at the top, or an analyst working in the Security Operations Center (SOC), the cumulative effects of constant stress can feel overwhelming. And that’s just in normal times.

When your organization has been breached, the pressure ratchets up intensely, to the point where many cybersecurity leaders and professionals feel they can never log off. They risk the anxiety of being in reaction mode all the time, 24 hours a day, seven days a week, often for weeks or even months at a time.

The shift to work at home for employees and IT teams as a result of COVID has piled even more challenges on cybersecurity teams that were already typically short-staffed, and operating beyond their normal capacity. It is a vast understatement to point out that dealing with that amount of stress is unhealthy. The statistics offer sobering and scary testament to the emotional impact of stress in cybersecurity.

More than 90% of CISOs said they suffer from moderate to high stress and a third believe their jobs would be at risk if their organizations were breached, according to a survey of 408 CISOs in the U.S. and U.K. Even more worrisome: 26.5% said stress was impacting their mental or physical health; 23% said the job was eroding their personal relationships, and 17% said they turned to medication or alcohol to deal with job stress.

This isn’t just bad for these individuals and their teams; it’s bad for business.

I am not here to tell you that you can eliminate stress from cybersecurity. As I said upfront, stress is an unavoidable occupational hazard. But I am here to tell you there is a proven way to deal with stress, and alleviate the pressure so teams can work productively and collaboratively even under the most trying of circumstances.

Managing stress effectively in cybersecurity starts with focusing on emotional intelligence (EQ) and, subsequently, practicing intelligent emotional leadership. Frankly, I shudder with trepidation as I write these words. It is my experience that many hard-driving business leaders, and computer professionals, are wary of the word “emotional.” It is also my experience that this happens more often with men than women.

If you’ve gotten this far, I urge you to continue. If you take in even a little bit of what I have to share, it will help – and may even reshape some of your attitudes at a time when organizations are desperately craving leaders who can think creatively, innovatively, and empathically. When we can include emotions balanced with our rational thinking, we are more successful and happy. When we are authentic to ourselves and our colleagues, we build closer and more powerful teams.

Transformative Power

I’ve come to believe in the transformative power of EQ and emotional leadership from two vantage points. First is the scientific evidence of its benefits; second is personal experience.

Let’s start with science. In the digital age, it is a natural tendency to rely primarily on data, facts and rational thought. However, we can never forget the human element, particularly in cybersecurity. Even with artificial intelligence and machine learning, many critical decisions will be made by humans, and everything that is impacted by people will have an emotional layer.

Scientists at UCLA2 have demonstrated that expressing emotions reduces the emotional reaction in the amygdala, which is the component in the limbic system that is best known in the processing of fear. When we are exposed to a fearful stimulus, information about that stimulus is immediately sent to the amygdala, which then sends signals to the brain to trigger a reactive response, such as “fight, flight or freeze.”

Research suggests that information about potentially frightening things can reach the amygdala before we are consciously aware, meaning a fear reaction may be initiated before we even have time to think about what might be so frightening. The scientists at UCLA have proven that putting feelings into words is a positive way to reduce the pressure on the amygdala. So, I always encourage all leaders to speak about their own fears in a trust environment to avoid reactive responses.

Now the personal. I was one of those hard-charging business executives I mentioned earlier. I wasn’t in cybersecurity, but I was the CEO of a midsized company. I worked insane hours, weekends, nights, constantly on the phone, on line, on high alert, “on” all the time. I felt it in my body, pressure in my chest.  My doctor warned I was headed for a stroke, or heart attack. I needed to stop, relax. But I couldn’t. I refused to listen to my doctor, or my body. I had headaches every day, constant pain in my chest.

My breaking point came when I saw myself through the eyes of my 8-year-old daughter. I promised her that I would spend more time with her and her younger brother, and spend less time at work. “Mommy, I don’t believe you,” she replied, angrily. “You always say you are going to work less and you never do it. And the worst thing is, you are not okay. I can see it in your eyes.”

This was a real turning point for me. I realized she was right: I was not okay at all. So I changed. I decided to get a coach to guide me to become aware of my emotions, accept, and manage them. I learned to share them with people I trusted. I learned that being open and vulnerable sometimes makes me stronger. I eventually left that job, and I am now devoted to training business and technical leaders on the value of EQ and emotional leadership. As I’ve experienced first-hand, emotional leadership can not only change your relationship with your teams and colleagues; it can also change your life.

Understanding Emotional Leadership Competencies

Everything we say, and do, is affected by our rational intelligence – but also our feelings. Emotions have an inevitable effect on all of our activity, and even more so if we are a leader. In leadership, it is commonly accepted that interpersonal skills matter more than cognitive skills. Examples of interpersonal skills include, the ability to communicate; show respect; express empathy; active listening; adapting to your environment; giving, and receiving feedback. These are all competencies of emotional intelligence.

Because interpersonal skills are key to communicating and managing our relationships, EQ is a must for today’s digital leader. But what does EQ actually mean? I use this simple definition: Emotional intelligence means being able to identify, understand and manage our own emotions and also the same applied to others’ emotions.

To be able to connect with the emotions of other peoples’ we first need to be able to identify, accept and manage our own emotions. The leader that reacts to pressure with angry screaming, who loses control and shows low capability to manage his or her own emotions, will have serious difficulties connecting, understanding and managing emotions in others.

In a stressful cybersecurity environment, the results of this type of leadership can be disastrous. Emotions are highly contagious. If the leader reacts poorly to stress, the team reacts poorly to stress. In the work I do, with CEOs all around the world, I see leaders who have what I call “emotional radar” and others who do not. To develop emotional radar and be able to perceive the emotions of those around you, you need to be in a state of internal calm. Without our own self balance, the emotional radar will never work.

Each of us has at least three types of intelligence: rational, emotional and intuitive. When a leader is emotionally intelligent, I say he or she is a balanced leader who has the ability to include and balance these three types of intelligence.

How to Lead With Emotional Intelligence

Talented people – particularly younger people – love this kind of leader. The next generation of people with high technical skills wants to be led with empathy and autonomy. In cybersecurity, where the skills shortage is pronounced and competition is fierce to hire, retain and inspire talent, the difference in leadership can have long-term tangible benefits; and the risk of poor leadership can likewise have severe negative consequences.

As Fred Laloux wrote in his book Reinventing Organizations, the future will no longer be organized as in the Industrial Era, where the boss gave instructions and humans worked as machines. Modern organizations are more refined; decisions are made based on trust and collaboration instead of on ego-driven fears, ambitions and desires. On the current VUCA world, where we need to face Volatility, Uncertainty, Complexity and Ambiguity all together, there is no super leader who has the capacity to decide on his own and find the way alone. Team power is vital, collaboration is essential to generate Collective Intelligence and overcome the challenges. So the leader needs to have EQ to generate the right environment for the team.

Today's Talent Wants To Be Treated as Human Beings. Are You Ready For That?

Based on my experience working with dozens of leaders and teams, I have several practical recommendations on how to leverage emotional leadership to effectively manage cybersecurity teams in today’s environment – particularly in light of the uncertainty and disruption that has been caused by COVID.

• Breathe: Whenever you feel triggered by emotions, just stop six seconds and breathe. Take one to three deep breaths. Our breathing connects us immediately with our body and has the key to connect emotions with our rational thinking.
• Sharing: Working from home means we all have to share a little bit more of our private lives with our colleagues. This should be a good thing. I’ve heard leaders say that they have two separate lives, their work life and then their personal life. But that is not the real world. Each of us is one whole person, we cannot be split into two. We need to integrate both parts. We need to feel warmth and be authentic. It is important to be open, to talk about our personal ups and downs, and also our fears, concerns, triumphs and losses. As the leader, create the space and trust for sharing, ask your team directly: What is the worst-case scenario? As I said before, iIf we speak about our fears we can confront them. We can put light on the darkness.
• Meetings: Build into the work process informal spaces to connect. With people working from home, we run the risk of losing some of that personal connection that takes place in an office, at the coffee machine or during lunch breaks. Put aside 40 minutes each week where you have a team call where you don’t talk business, you just connect as human beings. Also, when you are conducting work meetings, create a space at the beginning and the end to talk. Check in as the meeting starts: How are you feeling today, are you ready to address today’s challenges, is there anything worrying you? Check out before the meeting ends: What did you think of the meeting, are you prepared to take the next step? Create the emotional energy for the team to work at their best.
• Feedback: This is a vital point for any team going through a crisis such as a cybersecurity breach. Every tech professional nowadays needs to learn and improve continuously to deal with today’s rapidly changing environment. Talented professionals may be highly prepared for their jobs, but face new challenges they have never before confronted. How can they evolve if they don’t receive quality feedback? So prepare your team for that.

One of the keys to being an emotionally intelligent leader is the ability to give and receive feedback. Feedback triggers emotions, so it is important to pay attention to the emotional impact feedback may have on you and others. Feedback needs to be:

• Constant and integrated as a process for improving and learning.
• Bi-directional – it is just as effective to give as to receive.
• More positive than negative. A Harvard study talks about a ratio of feedback/performance in a work team, i.e., leaders should give six positive comments for each negative comment in order to keep people motivated.

Here is an effective formula in having a positive feedback conversation:

• Prepare the environment, the right place, the right time. 
• Explain the situation (facts as specific as possible).
• Explain the behaviour seen.
• Explain the impact of the behavior.
• Make your suggestion.
• Encourage the person to do it better the next time and focus on future possibilities.

Always check how the message has been received. How do you see it? Can we agree on my suggestion? Any alternatives? Assertive communications is a key skill for the emotional leader. Practice it.

As you would learn a new programming language, or sign language, or any other new form of communication, get ready to understand emotional language, I can tell you it is much easier than all the technological or business knowledge you have learned. You only need to put a little bit of attention to it and ask for training if needed. You will be surprised at the amazing results you will get with relatively little, but focused, effort.

Being Flexible

Covid-19 has taught us that organizations need to be flexible to succeed in today’s environment. We are not machines – why do we continue working as if we were? Taking care of our human part increases our productivity. For example, we don’t need to all take breaks at the same time or eat at the same time. Some people work better in the morning, others at night.

Young professionals understand that flexibility and autonomy lead to more productive and empathetic corporate cultures. I know of one company where many of the employees love surfing, the water kind not the web kind. On rainy, dark days their part of the office is bustling and amazing work gets done. On windy days, not so much. The result: high engagement and rotation near to zero on fintech. So apply your own formula and be creative!

The Best Leaders

To me the best leader is the one that role models what we want to see on the team. Leaders can be a role model by using mistakes to teach, sharing emotions but also learnings and challenges, offering help and care to colleagues and team members to find better solutions and become stronger.

We are never going to eliminate stress from cybersecurity unless we eliminate the human element, and it would be a sad day, indeed, if that were to ever happen. For the foreseeable future, at least, people will remain vital to successfully navigating the digital age. And as long as we are managing people, we need to be able to manage their stress.

Good leaders understand the value of emotional intelligence in inspiring, motivating and empowering today’s workforce. As the workplace continues to change in response to a global pandemic, good leadership in cybersecurity may mean the difference between avoiding breaches and protecting the organization or, at the other end, being more vulnerable to successful attacks.

In today’s era, cybersecurity leaders can’t afford to ignore emotions and the power of intelligent emotional leadership. Emotions are part of our whole intelligence. In fact, I can assure you that the best leaders will be the ones that embrace and harness it.

As a computer needs electricity to work, we need emotions to give us energy. Emotions are the energy that moves us into action. Emotions move teams to do amazing things. Emotions move the whole world.

Gemma Garcia Godall is the Founder of Instituto de Inteligencia Emocional, where she guides leaders, teams and organizations to shine through cultural transformation projects. Previously, she was the Chief Executive Officer of a leading player in the financial services industry.