The Iceberg Effect: What Lives Below the Surface

Good afternoon. In the summer of 2024, the most incredible woman that I have ever known, my mother, was in her last stages of life, dying from the effects of congestive heart failure. So, our family made the difficult decision to call in hospice care. I have seven siblings and they all traveled in from all over the country. But I want to tell you a little bit about my mom. She raised eight children and she ran a dairy farm. Well, my dad worked a corporate job. She dedicated her entire life to serving others. She didn't care about recognition. Her final years were spent caring for the other elderly people in our community. And I share this photo of her because it

represents what she loved most, her family. I raised those five boys as a single mother, and she was always in the background making sure that I raised them right. So, we called hospice on a Sunday, and I messaged work to let them know that I wouldn't be coming in on Monday. the hospice team was going to be coming to bring a hospital bed and a care team that brought comfort meds. I had known people that had been on hospice sometimes for weeks, months, and even years. Though I was relieved to know my mom would be able to spend her time at home. That Monday evening, I got word about a high priority security incident. So, I

headed back to my house to prepare for the next day. Tuesday morning, I joined a virtual call to work through the issue.

At 8:24, I got a text from one of my siblings sitting here today. It said, "Dad believes this will not be a long hospice program and sadly I agree with him." My response was, "I am dealing with an issue at work. It's going to be a long day. Please keep me posted." Later that day, I packed up my laptop and I drove back to my parents house. I worked from their dining room table for the rest of Tuesday and again on Wednesday. Thursday morning at 5:30, my mom passed away. I did not miss a single detail of the issue at work. But I sat at her dining room table working for the last days of her life.

If that story makes you uncomfortable, hold on to that feeling because it means that you haven't yet sold your soul in exchange for your career. And I don't think I'm unique in this story. I think many of us have a version of it. Maybe you haven't missed something as significant. Maybe you have. You probably know exactly what I'm talking about. How many of you have been in a meeting and answered an email at the same time, maybe while also responding to something on Teams? How many of you have sat at dinner with your family and found yourself mentally rerunning an incident, replaying a decision or wondering if you missed something while nodding along to a

conversation you were only half hearing? How many of you have taken a vacation day and checked your work emails before noon? So, I've done all these things daily. But what does this really cost us in the quality of our work, in the quality of our decisions, and in the quality of our lives? In this field, the stakes are high. If we miss a single alert, make one poor decision under pressure, or have one moment of fractured attention at the wrong time, it can mean the difference between containment and a very bad day for our organization. We treat our cognitive capacity as if it were an unlimited resource. This is an actively exploited vulnerability. We don't patch for it. Even worse, we

don't even acknowledge it.

Now, I was going to do a poll, but because there are not a lot of people in this room, we're I just would like you to do a show of hands. In the past month, have any of you experienced burnout? In the past week, has someone who loved you commented on how much you worked? Have you ever chosen work over a significant personal moment in the past year? Do you feel comfortable being honest with your manager or your teammates about your stress level? Do you feel genuinely valued in your current role? Have you considered leaving the cyber security field in the past year? Have you ever made a mistake at work that you believe was caused by

exhaustion? Do you have a dedicated recovery practice built into your daily routine? So the numbers are as I expected and if you look around the room you can see some of the data for yourself. So I want to talk about what happens inside your brain and inside your body. So, you know that feeling where you just can't think straight after some brutal stretch of work, where you're staring at something that you would normally catch in a few seconds and it's just not clicking. There's a reason for that. When we are under chronic stress, our bodies flood with cortisol and adrenaline. And those chemicals are designed for short bursts, which are great in a crisis. They're useful in security

incidents. The problem is that for most of us in this field, they never turn off. And when cortisol stays elevated for too long, one of the first places it damages is the prefrontal cortex. That's the part of your brain handling risk evaluation and decision- making under pressure. It's the part we rely on most in this work. Research shows that 17 to 19 hours without sleep, after 17 to 19 hours without sleep, our cognitive function drops to the equivalent of a blood alcohol level of 0.05, which is legally impaired in most countries. We would never let someone show up drunk for an incident response, but we have people showing up exhausted, and we call it dedication.

Now look at where this industry actually stands. 76% of cyber security professionals experienced burnout in the past year and 69% say it's getting worse. On average, workers in this field are losing nearly five hours a week to stress and burnout. That's more than six weeks of lost productivity per person. 74% have taken off time for mental health. 63% of CISOs have either experienced or witnessed burnout in the past year. The World Health Organization has classified burnout as an occupational phenomenon. It's a documented condition that comes from chronic workplace stress that was never addressed. We have tools and platforms to address every risk in our environment. We measure meanantime to detect and meanantime to respond. But we do not

apply that same process to the people running those systems.

Early in my cyber security career, I had a mentor who was the first person in this industry who genuinely saw something in me. He recognized my intensity and my drive, but he had 30 years in the field. And with that came a kind of wisdom I didn't yet have. He told me early on, "Be careful not to get so focused on your career that you leave nothing for the people who matter to you." He told me about the marriage that he lost. He had poured everything into his work and built an impressive career and started over alone in every other area of his life. I heard him. I appreciated him telling me and I filed it away and kept moving.

A few years later, he reached out to me and informed me that he had suffered a TIA, which is a mini stroke. He attributed it to stress from his job. He decided to step away, relocate, and focus on his health. And I remember thinking, don't let this be you. And then I registered for another certification exam. Most of us in this room know that we are running too hard. We've watched colleagues burn out. Some of us have been the cautionary tale for someone else. The gap between knowing and actually changing something is where most of us live. We can probably all name someone in this field who we lost too soon. A colleague or a mentor, someone whose work we chose

to admire.

Heart attack at 48, stroke at 51, gone before anyone saw it coming. And when it happens, we do what this industry does best. We post tributes. We add their photos to walls of honor. Sometimes we create awards and fellowships that celebrate their contributions. What we are not good at is asking the harder question. How many of those deaths had stress written somewhere in the margins? How many of those people were managing a chronic condition while running at full speed?

How many of their families watched them work themselves toward an edge and nobody in the industry ever acknowledged? Why do we memorialize the work, but we fail to examine the cause? These tributes come from real grief and real respect. But neither grief nor respect change anything. And years later, the burnout numbers keep climbing. And the conditions that wear people down remain exactly the same. I'd like to propose an award for the leader who looks at a loss like that and changes how their team operates. Let's give recognition to the organizations that build something structurally different because of what they witnessed. Given that that award doesn't exist yet, it tells us something about what this industry values.

Four months after my mother passed away, my husband and I boarded a plane for Argentina. On December 19th, 2024, we boarded a ship headed for Antarctica. This was the first international trip either of us had ever taken. My husband, who is not a fan of technology, was particularly excited about getting me away from screens, alerts, and dashboards. Our trip was meant to be a reward for years of hard work. In the months leading up to it, I finished my master's degree. I passed a certified CESO exam. I completed an 8-week coaching program. I had also lost my mother, but I moved through her death the same way I moved through everything else that year. I just kept going.

For the first week on the ship, I kept sneaking off to check work emails. I didn't want my husband to see. I wanted him to believe that I was fully present. But I didn't know how to stop. Every time I sat still, I felt the pull to check messages and emails and make sh make sure things were going smoothly at work. But after that first week, I turned my phone off and put it in a drawer in the cabin, and I only took a digital camera with me. And that was the first time since the 1990s that I was not immediately reachable. Very slowly, something shifted. My brain stopped waiting for the next alert. I started really noticing things.

The incredible blues and greens of the water, the peace, the way my husband's eyes sparkle when I'm not on the phone. Then came the morning of December 28th. We had crossed the Drake Passage, which if you don't know is the most treacherous stretch of water on Earth. We were in Antarctic waters and we were so excited about what we were going to see. We went up to the cafe on the top deck and got our coffee. We sat down with breakfast and looked out the window with great anticipation of what the next leg of the journey would reveal. Before long, something appeared in the distance. It was difficult to make out through the fog. It was just a pale shape in the

blue gray water. As we sailed closer, it started to come into view. It was an iceberg. The coolest thing I never imagined I'd get to see with my own eyes. And I was mesmerized by it. And my very first thought was, "I can't wait to tell my mom about this. And then I remembered, all right, she's gone. It's not like that was new information. I was there for the visitation and the funeral. I laid a rose on her coffin, but I had never stopped long enough to feel any of it. Not until that moment when my world was so quiet that there was nothing left to distract me. The tears started slowly and I tried to

pull myself together. Of course, the harder I tried, the harder I cried. And I dropped my head into my hands. And I was aware that there were other people on the ship, but I didn't care. And then I heard my husband's voice saying "Honey honey." But I couldn't even look up at him. Honey, he said to me again, "Your hair is in your eggs." And he did what he does best. He made me laugh. That iceberg was more than a piece of ice. It was a mirror. Above the waterline is breathtaking, solid and massive and still. But we all know that the danger is hidden below the surface. And we are no different. Above the surface, we show capability and

competence and control. Below it, we carry fatigue, regret, and everything we haven't had time to feel. Being still doesn't weaken us, but it will show us what we've been carrying. When we got home from Antarctica, I was different. I was a lot more honest with myself about what the previous year had actually cost me. The first call I made was to my dad. At that time, he was 91 years old and had just spent the last four and a half months without his partner of nearly 65 years. After we talked about the trip, he changed the subject and let me know that while he was gone, he had gotten a PET scare and he had been diagnosed with

metastatic prostate cancer. It was in his bones. This time I did something different. I went to my manager and said, "When my dad has his infusion treatments, those days are off limits. I will be there and that is not negotiable." I had to be the one to say it. I knew no one was going to offer it. I had to claim it. Still, I was afraid to. I had spent years building a reputation as someone who showed up and delivered, not someone who asked for accommodations. Saying this out loud felt like admitting something I wasn't sure I was allowed to admit, but my manager supported me without hesitation. Our team supported me. The work got

done. We spend a lot of time waiting for permission to be present in our own lives. permission from our managers, from our organizations, from the culture of this industry which has decided that always on is a professional standard. The permission is rarely coming. We have to decide what we need to protect and then protect it. I don't have it all figured out and I'm still learning, but I'm a much better version of myself than I was when I chose to work o when I chose work over my dying mother. I don't ever want to go back to that. After I made the decision to prioritize, I started thinking about why it had taken me so long to get there. I went

looking for the science behind what was actually happening in my brain during all those years and what happened when I finally stopped. Sleep is more than downtime. Most of us treat it like the absence of work. The neuroscience behind it though is fascinating. During sleep, our brains are actively working. They replay and integrate what happened during the day, strengthen connections, and file things away for us to retrieve later. There's also a system called the glimpmphatic system that flushes out the toxic byproducts that build up from a day of heavy cognitive work. That process doesn't happen while we're awake. When we consistently cut short our sleep, we wake up less capable of pattern recognition and threat detection

than we were the day before. Even 10 minutes of stillness without any screens produces measurable changes. Our cortisol drops, nervous system shifts that shifts out of threat response mode. Research shows that chronic stress impairs the functional connectivity in your prefrontal cortex and that genuine rest reverses that damage. The version of us that is rested is a better analyst and a better decision maker. We're neurologically better. Rest is how we patch the most important system in our operation. What is the thing that you are telling yourself will finally make you happy when you get it? For a lot of you in this room, I suspect the answer involves something on a resume, a certification you're working toward,

maybe a specific job title. You might have a salary number in your head, a seat at the table that you haven't gotten to yet. Arthur Brooks talks about this in his book from strength to strength. He talks about what he calls the four idols of high achievers money, power, pleasure and the admiration of others. His point are that these are the things that feel urgent, the things are industry rewards and measures and posts on LinkedIn. But the research on what actually sustains people over time points somewhere else entirely. He makes an important distinction about virtues. He separates what he calls resumeé virtues from eulogy virtues. Resume virtues are the things we use to impress people and post on LinkedIn.

Eulogy virtues are what people actually say about you when you're gone. That you showed up. That you were kind. That when someone needed you, you were there. When I was working from my parents' dining room table, I was dedicated and responsive. I was building resumeé virtues. And I missed something I can never get back. Brooks talks about what he calls transcendence, having a source of meaning that exists outside your own achievements. For some people, it's faith. For some, it's nature. For some, it's community or service. Think about what that is for you. What is the thing that when you return to it reminds you who you are outside your job title? That thing is where your eulogy

virtues lie. This past Easter, I took my grandson to an egg hunt. The older kids spread out across the yard and they cleaned up. His little legs couldn't keep up. He came back. He had found three eggs and he was running with the greatest joy. He was absolutely elated and holding those three eggs up like he had just won the lottery. To be honest, I was thinking of knocking a couple of kids down and stealing their eggs and putting them in his basket. But my grandson, he didn't compare what he had to what they had. He was filled with joy just for having the opportunity to participate and having something to show for it. He

obviously doesn't know what a resume is yet. He's living entire entirely in eulogy virtue territory and he doesn't even know it. We were like that once, but somewhere along the way we learn to measure our success against that of everyone else. There's always someone who got more, did it faster, got a better title, that we keep going back to be revalued, and we wonder why we never feel like we're enough. There's a story about that. A father before he died called his son in and handed him a watch. He said, "This watch belonged to your grandfather. It's almost 200 years old. Before I give it to you, I want you to take it to the jewelry store downtown

and find out what they will offer for it. The son went to the jewelry store and came back. They offered $150. It's too old. The father said, "Go to the pawn shop." The son went to the pawn shop and came back. They offered $10. He said, "It looks too worn out." The father said, "Now take it to the museum." The son went to the museum and came back and this time he looked different when he walked in the door. He said, "Dad, the curator offered $500,000. They said it's rare and precious and they want to keep it for their permanent collection." The father looked at him and said, "The watch never changed. What changed was

who was looking at it." He said, "I want you to understand something. The right place values you in the right way. Do not find yourself in the wrong place and wonder why you are not being seen. I think about that story in the context of what we do in this field. We take our watch to the pawn shop over and over again and every time the number comes back lower than we'd hoped. We work harder to earn a better offer from the same place that was never going to see our value to begin with. Sometimes we have to change where we are going to be valued. So the obvious question is what do we do

about all of this? So I went to the internet to get suggestions and this is what I found. Fix your diet. Cut sugar. Exercise more. Meditate. Journal. Take cold showers. Try intermittent fasting. Time box your calendar. Skip meetings. That could be emails. Set better boundaries. Learn to say no. Practice mindfulness. Optimize your sleep hygiene. Get more sunlight. Limit caffeine. That's your emails. Do a weekly review. Read for 30 minutes a day. Limit social media. Take up yoga. My god, I need a nap. It's exhausting just reading it. And then I feel even more overwhelmed than before I started, which is exactly the opposite of the point. So I'm going to share four basic things that have

made a real difference for me. Four things, not 40. And my suggestion is to pick one. Try it for a few weeks and actually stick with it before you add to anything else. One thing done consistently will do more for you than 10 things abandoned by Thursday. The first 30 minutes of my day now belong to me. I don't check my emails or read through any threat feeds. I don't check social media. I used to roll over in bed and immediately scan my phone. I thought it was getting a jump on my day. But checking our phones first thing in the morning spikes cortisol. We train our brains to be hyperreactive before the day even starts.

30 screenfree minutes changes that. Now I start my day in silence. I make coffee and take time to enjoy it. I sit with my husband and watch the world come to life outside. We take time for reflection. We're fully present for each other. I have done this for well over a year now. There have been a handful of days when I broke that streak and I jumped straight out of bed into alerts. Every single one of those days I was sideways for the rest of the day. I was reactive and scattered and never quite myself. Second thing, digital sunsets. At a certain point in the evening, I close my laptop and put my phone on do

not disturb. I aim for 8:00 p.m. Our recovery system needs time to do its job. If our minds are never allowed to power down, they cannot consolidate what happened during the day or restore what was depleted. Disrupting that process with alerts and screens right up until we close our eyes is exactly like refusing to run the glimpmphatic cleanup cycle I described earlier. We would never skip patching a critical vulnerability night after night. Don't skip this. I don't get it right every night, but I do feel a difference when I honor it. Tactical breathing. One to two minutes of intentional breathing can reset your nervous system between meetings or after an alert storm. I use a method called 478

breathing. Inhale for four, hold for seven, exhale for eight. The long exhale activates the vagus nerve, which signals your nervous system to shift out of threat response bone. This is a real technique used by Navy Seals and surgeons. First responders use it to rapidly bring themselves back to calm under pressure. The first few times I tried it, I literally felt like I was failing at breathing, but I kept at it. And now I use it between meetings and before difficult conversations. It's one of the fastest ways I found to go from reactive to clear. And you don't need anything special to do it. Just two minutes and the willingness to try. This one is the most person.

Recovery rituals for me. It's walking barefoot in the grass with my grandson. He cracks me up when he discovers a dandelion and he shows me the flower he found. I really like to watch him when he hears a motorcycle in the distance and he starts convulsing with excitement. Those moments do more for my nervous system than any productivity technique I've tried. It reminds me what I'm actually working for. Once you determine a recovery ritual that works for you, protect it. For those of you in leadership roles, individual recovery habits can only do so much inside an organization that does not support them. I want to tell you what leading by example actually looked like for me recently.

I showed up for a team meeting on Friday morning after putting in probably 50 hours already that week. I knew the team could see the exhaustion on my face and hear it in my voice, and I knew I was not leading by example, and I openly admitted. I promised them I would find a way to schedule some time off, so I ended up taking a vacation day the following Monday. I spent the day sitting outside watching my husband knock over cedar trees with a skid steer. It was a fabulous day, and honestly, one of the most entertaining things I have ever watched. By Tuesday, I was refreshed and ready to go. And tomorrow, our team is going to

have one heck of a bonfire as a result. That is what it looks like. You don't have to pretend you're fine when you're not. You don't have to pretend to be invincible in front of a team that you lead. What they need to see is that you take your own recovery seriously because that is what gives them permission to take theirs seriously, too. Structured recovery at the team level means more than generous PTO policies. It means mandatory decompression after major incidents, rotation schedules that prevent chronic alert fatigue and reviews that include conversations about how the team is doing mentally, physically psychologically and emotionally. It also means creating an environment where people can tell you when they are

struggling without worrying about the professional cost. Most of us in this field have learned to perform competence even when we're running on empty. We can change that when the person at the top models something different. But I want to come back to where we started. My mother spent her last days in a hospice bed in her living room surrounded by her children. All of them except me for part of those days. I was too busy working about on something that I can't even tell you about today. I could barely tell you what it was 6 months after it happened. I can tell you exactly what it feels like to take that time for granted. And I don't share this story to punish

myself in front of you. I'm telling you because I think you need to hear that someone who stands up and talks about strategic disconnection, recovery practices, and the neuroscience of burnout also sat at a dining room table and chose work. Many of us have. The question is, what do we choose next? So, I'd like to ask you to do something. Please close your eyes for just a moment. What I want you to do is picture the face of the person or the people you most want to be present with this weekend. Now open them. That's why this matters. It's not about stress management. It's about what we miss when we don't slow down. the people waiting for us at

home who need us to actually show up. We spend our lives protecting systems and when we ignore our own and run on fumes, we become the vulnerability. So here's my challenge tonight. Put your phone away, out of reach. Step outside, breathe in the air. Get quiet enough to hear what really matters. If you lead, model being present. If you protect systems, protect yours, too. If you love someone, show up for them undistracted. Not later, a day.