IBM's cyber response chief says the industry's fixation on AI's offensive power is missing a more immediate problem: the strain on the people defending critical systems.
In remarks published by Fortune, he said he has spent 26 years in incident response and now sees burnout as a greater concern than AI itself. He described incident response as 'a human profession disguised as a technical one,' pointing to the analysts and responders who work nights, weekends, and holidays under pressure.
He said recent global research found AI-enabled attacks increased 56% over the past year. He also cited figures showing 68% of incident responders regularly defend against two or more attacks simultaneously, while 67% reported daily stress or anxiety tied to cyber incidents.
The IBM executive said the industry often talks about cyberattacks in financial terms such as costs, losses, downtime, and recovery expenses, but pays less attention to the human cost. He said organizations should shift the conversation from whether there are enough people to whether the people already in place are being enabled to work more effectively.
His prescription is aimed at management as much as technology. He said security teams need more time to experiment with new tools, understand them, and fold them into daily workflows. He also said leaders should reduce unnecessary cognitive load, eliminate repetitive tasks, and provide better context so responders spend less time gathering information and more time acting.
He said retention, wellbeing, and sustainable workload management matter more than ever. He added that allowing team members to experiment with technology and research areas they care about has helped his own team, and in some cases those projects have been incorporated into workflows.
The market has already voted on AI's value in cybersecurity, but the harder question is whether firms are building institutions that can survive the pace they are creating. Capital rewards clear rules, and the same principle applies to security operations: if companies want resilience, they need to treat the workforce as infrastructure, not an afterthought.
There is a broader lesson here for every organization chasing automation. Technology can speed response, but it cannot replace judgment under pressure. The winners will be the firms that use AI to amplify human expertise instead of burying it under more alerts, more noise, and more fatigue.
