IBM cyber chief: Defender burnout is the bigger AI risk

AI-enabled cyberattacks rose 56% over the past year, but the more pressing risk to enterprise defenses may be the burnout of the people expected to stop them, according to IBM's cyber response chief.

After 26 years responding to incidents and leading response teams, the IBM executive says the industry's conversation about AI in cybersecurity has focused too narrowly on attacker capability. "Incident response has always been a human profession disguised as a technical one," the chief wrote in a Fortune commentary. The question now is not what AI lets attackers do, but what its acceleration means for the analysts working around the clock to defend corporate networks.

What is changing for incident responders?

The workload has intensified. IBM's global research found that 68% of incident responders regularly defend against two or more attacks simultaneously. A separate 67% reported experiencing daily stress or anxiety tied to their work.

The IBM chief said they have missed sporting events, birthday parties, and holiday celebrations because attackers tend to ramp up activity on weekends and holidays. The executive has also watched colleagues step away to recover after particularly difficult engagements.

Why are machine-speed threats different?

AI-enabled attacks compress response timelines. Defenders no longer face human-paced adversaries working in eight-hour shifts. They face automated operations that probe, pivot, and exfiltrate at machine speed.

"Those life-disrupting incidents are about to become much more frequent and stressful," the IBM chief wrote. The concern is not that AI will outsmart defenders, but that it will accelerate the incident cycle to a pace humans cannot sustain.

What does IBM recommend?

The IBM executive argues that organizations need to stop asking whether they have enough people. They need to ask "whether we're enabling the people we already have to operate more effectively."

Her prescriptions include:

• Giving security teams time to experiment with new tools before a crisis forces adoption
• Eliminating repetitive tasks that add cognitive load
• Providing better context so responders spend less time gathering information
• Building in recovery periods between major incidents
• Encouraging continuous learning

At IBM, the executive's own team has benefited from allowing analysts to pursue research and tooling projects they care about. "We've been able to put some of what they built into our own workflows," the chief wrote. That autonomy helps both individual contributors and the broader operation.

What is at stake?

The financial cost of cyber incidents dominates boardroom discussions about security. The human cost does not. That imbalance is now a strategic risk, the IBM chief argues. "If we don't change how we support defenders, AI won't just expose gaps in our technology. It will expose the limits of the people we've been asking to carry the burden for years."

The executive frames retention, wellbeing, and workload management as core security investments, not human-resources add-ons. "Technology changes constantly, human limits don't," she wrote. "And as cybersecurity enters the age of machine-speed threats, taking care of our people may become one of the most important security investments we can make."

What's next for security leaders?

The IBM chief expects AI to reshape adversarial tactics, autonomous operations, and machine-speed offense. She expects boardroom attention to follow.

The companies that come out ahead will be the ones investing in their security workforce now, before burnout drives attrition and institutional knowledge out the door. For organizations still framing cybersecurity as a technology problem rather than a human one, the 67% stress figure and the 56% attack increase should reset the agenda.