The real test of security AI is whether responders get their time back

Setting increasingly capable AI against increasingly strained responders creates a false choice. Both pressures meet inside the same incident-response workflow, where more signals, investigations and decisions can collide with limited attention and long working hours.

Tony Kirtley, Head of Incident Response for IBM X-Force, brought that tension into focus in commentary published by Fortune on 8 October 2026. Drawing on what he described as about two and a half decades in incident response and team leadership, he argued that workforce strain deserves more attention amid the debate about AI. That is an experienced practitioner’s judgement, not proof that burnout is objectively a greater sector-wide danger than AI. But it points towards a better question: what kind of incident-response system will AI amplify?

My answer is that automation will inherit the priorities of the operating model around it. If leaders use it to remove repetitive work, improve context and protect human attention, it could make response more sustainable. If they use it mainly to demand greater throughput from the same team, it may intensify the conditions that already generate fatigue. Responder sustainability should therefore be treated as a measure of security reliability and governance, not as an individual self-care problem.

The workload exists before the automation arrives

The available workload evidence is dated and should not be mistaken for a current clinical measure of burnout. Even so, it describes pressures that any AI programme should examine rather than assume away. IBM said a 2022 study conducted by Morning Consult surveyed more than 1,100 incident responders across 10 countries. Sixty-seven per cent reported daily stress or anxiety associated with the work, while 68 per cent said assignment to at least two concurrent incidents was common.

More than one third reported working longer than 12 hours a day during the most stressful phase of an engagement. IBM said that phase typically lasted about a month. These findings do not establish a clinical burnout rate, nor can a self-reported 2022 survey be treated as a precise description of working conditions in 2026. They do, however, support a practical inference: concurrency, working time and recovery are properties of operational design, not evidence that individual responders need to become more resilient.

This distinction matters because organisations can too easily answer a structural problem with personal benefits. The same survey found that 84 per cent of respondents reported adequate access to mental-health resources and 95 per cent felt senior leaders provided the support structure they needed to succeed. Organisational neglect was plainly not universal among those respondents.

Yet high reported support coexisted with high reported stress, concurrent assignments and extended crisis working. The survey does not reveal which support programmes people used or whether those services reduced workload. It therefore cannot settle the issue. What it does show is that the presence of support should not be confused with the absence of operational strain. Access to support does not by itself shorten a queue, improve a handover or create recovery time after an intense engagement.

Cost savings are not proof of lower pressure

IBM’s 2026 Cost of a Data Breach page, describing research with the Ponemon Institute, presents AI as both an offensive accelerator and a defensive advantage. It reports a 56 per cent increase in AI-driven attacks. It also reports US$1.93 million in breach-cost savings for organisations making extensive use of AI and automation in security, compared with organisations using none.

Those figures deserve caution. The quantitative evidence here is substantially vendor-led, the full methodology behind the 2026 findings was not available in the reviewed material, and IBM sells security, automation and incident-response services. The reported cost difference does not show that responders worked fewer hours, handled fewer simultaneous cases or experienced less stress. Nor does the attack figure establish that AI-driven activity directly causes burnout.

Still, the two findings expose the central management challenge. AI is neither simply the threat nor automatically the cure. It may increase adversary productivity while helping defenders collect evidence, enrich information and coordinate work. Whether that becomes relief for responders depends on how the resulting efficiency is used.

If automated outputs are reliable and observable, repetitive collection and enrichment could consume less human time. If consequential actions retain appropriate approval and accountability, responders could preserve their attention for decisions that require judgement. But if people must extensively validate a larger stream of machine-generated findings, automation may create review work rather than remove it.

There is a second risk. If efficiency becomes an excuse for staffing cuts or ever higher throughput targets, the apparent saving could concentrate responsibility among fewer people. That is a conditional scenario, not evidence of a practice already occurring. It depends on management converting automation gains into reduced capacity while leaving the remaining team with equal or greater responsibility. The point is that productivity is not synonymous with sustainability.

Measure the burden that technology leaves behind

Security leaders already have incentives to value speed and volume. AI can produce impressive-looking numbers for investigations processed, findings generated or information summarised. Those measures are incomplete if the system also increases after-hours interruptions, creates noisy outputs or makes handovers harder.

A more credible evaluation should ask how much reliable work the technology removes. Leaders should track repetitive evidence-gathering time, case concurrency, alert and false-positive review, after-hours escalation, handover quality and recovery time after severe engagements. They should also examine whether automation improves the decisions responders make, rather than merely shortening the path to a recommendation.

These are proposed governance tests, not a validated industry standard. The reviewed research supplies no benchmark for an acceptable number of concurrent cases or a sufficient recovery period. That absence is not a reason to ignore the measures. It is a reason for each organisation to establish its own baseline before introducing automation, then test whether conditions improve afterwards.

Decision rights deserve equal attention. A system that supplies useful context while leaving consequential choices with an accountable person is different from one that obscures how a recommendation was formed. Human approval alone is not enough if the reviewer is overloaded, rushed or expected to endorse outputs they cannot meaningfully assess. The objective should be better judgement under pressure, not a ceremonial human presence at the end of an automated process.

Meaningful work still needs limits

There is a fair counterargument that incident response is inherently intense. Many practitioners are attracted to urgent problem-solving and protecting others. In IBM’s 2022 survey, nearly 80 per cent included a sense of duty among the main reasons they entered the work, and about 36 per cent ranked it first. High intensity should not automatically be portrayed as proof of a broken profession.

But purpose and unsustainable workload can coexist. A strong mission may help people endure difficult engagements, yet it can also make excessive demands easier for an organisation to normalise. Commitment should not become an invisible staffing resource. Leaders should not rely on professional duty to absorb chronic concurrency, weak handovers or inadequate recovery.

Preparation can help. IBM’s study summary recommends involving responders in the design of response plans and playbooks, then testing those plans through realistic exercises rather than relying on a compliance-only annual event. That does not prove rehearsals reduce burnout, but it reflects a sound operating principle: the people who will carry the pressure should help shape the process through which it is managed.

The useful debate is therefore not whether burnout matters more than AI. It is whether AI investment improves the human system on which incident response still depends. Boards and security leaders should demand evidence that automation removes toil, reduces avoidable interruption and supports accountable decisions. If it only produces more output while the same people remain trapped in permanent crisis conditions, it has accelerated the wrong thing.

Measuring automation by the burden it leaves with responders calls for technical context as well as management judgement. For self-paced study of cybersecurity fundamentals, turn to The Hack Academy’s online cybersecurity training programme, where practical exercises accompany the theory.