The Invisible Load
The Invisible Load: Why Some of Our Best Security People Are Quietly Burning Out
Every security team has one. The analyst who sees the anomaly nobody else clocks. The engineer who holds the whole threat model in their head and spots the one log line that doesn't belong. The person whose pattern recognition feels less like a skill and more like a sixth sense.
What we talk about less is the cost they're often paying to do it.
A meaningful share of the cybersecurity workforce is neurodivergent. In ISC2's most recent workforce research, roughly 13% of respondents identified that way — and in some of the most specialized corners of the field, the proportion runs higher. That isn't an accident. The cognitive traits associated with autism and ADHD — deep focus, systems thinking, anomaly detection, an instinct for when something is subtly off — are close to a job description for defensive security work.
But the same environments that need those minds rarely fit them. And the work of fitting in, day after day, has a price we're only beginning to measure.
Masking is real work, and it doesn't show up on any dashboard
The term for it is masking, or camouflaging: consciously suppressing your natural responses to pass as neurotypical. Holding eye contact you don't need. Decoding tone and unspoken rules in real time. Sitting in open-plan noise and fluorescent glare and performing "fine." Rehearsing the small talk before the stand-up. Translating, constantly, between how your brain works and how the room expects you to behave.
None of that is laziness or fragility. It's labor — continuous, cognitively expensive labor running underneath the actual job. And because it's invisible, it's uncounted. A neurodivergent professional can deliver exceptional work and still end the week depleted in a way their performance review will never explain.
Over time, that load compounds. Emerging research links sustained masking to higher biological stress markers and to a distinct, severe form of exhaustion that the autistic community calls autistic burnout — a state of chronic depletion, loss of normally reliable skills, and a shrinking tolerance for everyday sensory and social input. Critically, it is not ordinary tiredness, and here's the part that matters most for high-performers: rest alone doesn't fully fix it. When your regulatory systems are worn down, a long weekend doesn't rebuild the capacity. People describe pushing through and finding the strategies that used to work simply aren't available anymore.
At the sharp end, some experience shutdown — an involuntary stress response where words, focus, and function drop offline and the system pulls back to conserve whatever is left. From the outside it can look like disengagement. From the inside, it's closer to an emergency brake.
Why cybersecurity makes this harder
Now layer on our field specifically. Always-on operations. Incident response that detonates your schedule and your sleep. High stakes where a missed signal has real consequences. Ambiguous, shifting priorities. A culture that prizes stoicism and rarely makes room for "I need the lights lower and the meeting agenda in advance."
The traits that make someone a brilliant defender — vigilance, depth, sensitivity to anomaly — are the same traits that make a chaotic, high-noise, high-pressure environment more costly to endure. We are, in effect, recruiting people for their sensitivity and then placing them somewhere that taxes exactly that.
And there's a trap inside the trap: disclosure. Telling an employer you're autistic still carries career risk, and many professionals know it. In one survey of neurodivergent tech workers, over half didn't feel comfortable disclosing their diagnosis at work. So the load stays hidden, the accommodations never get requested, and the burnout gets misread — often misdiagnosed as anxiety, depression, or simply "not handling pressure well." The people most likely to be struggling are frequently the ones least able to say so.
What we actually know — and what we don't
I want to be straight about the science, because credibility matters and overstatement helps no one.
The lived experience here is well documented and increasingly well researched. The autistic-burnout construct now has empirical definitions, a validated measure, and a 2025 systematic review behind it. The link between masking and psychological strain is consistent across studies.
The physiological story — how chronic adaptation wears on the body's stress-regulation systems — is genuinely promising but still being established. There are credible models pointing to cumulative "allostatic" load and autonomic strain, and there's real evidence; there's also legitimate scientific debate about how strong and specific those effects are. That uncertainty isn't a reason to look away. It's a reason to do the work properly.
What's almost entirely missing is research on any of this inside our own field. We have industry surveys telling us neurodivergent professionals are here and burning out. We don't yet have rigorous, cybersecurity-specific study of why, how much, and what actually helps people recover and sustain. That gap is exactly where I want to focus.
So here's my ask
I'm trying to gauge whether there's appetite — and a community — for researching this seriously: the load neurodivergent security professionals carry, what burnout and recovery really look like for them, and what changes would let this talent do its best work without grinding itself down.
If you think our field should study this, vote in the poll. You don't have to identify with any of it personally to say it's worth investigating. The number itself sends a signal.
And if this is you — diagnosed, self-identifying, or just quietly wondering — there's a private, anonymous sign-up here: https://forms.gle/sxTigjhFBdpRw4sK9.
It takes two minutes, it doesn't ask you to out yourself to anyone, and it's how I'll reach out if this becomes formal research. Undiagnosed and undisclosed voices matter here as much as anyone's; this is built so you can raise your hand without raising your profile.
You spend your working life noticing the signal everyone else misses. Consider this me asking you to notice one more — and, if it resonates, to let me know I'm not the only one seeing it.
Raise your hand. Let's find out how many of us there are.
Green Shoe Consulting researches human performance, resilience, and burnout in cybersecurity leadership. This post is the start of a listening exercise, not a conclusion — and every hand raised helps shape what comes next.