IBM X-Force Chief Says Defender Burnout Deserves Attention Alongside AI

Tony Kirtley, head of incident response for IBM X-Force, says cybersecurity leaders should give defender burnout as much attention as artificial intelligence as machine-speed attacks increase pressure on overstretched teams.

IBM and Morning Consult surveyed more than 1,100 incident responders across 10 countries for a 2022 study. Sixty-eight percent said handling two or more overlapping incidents at the same time was common, while 67% reported stress or anxiety in their daily lives related to incident response.

Ransomware added to that strain. Eighty-one percent of respondents said rising ransomware activity increased the psychological demands of their work.

Among U.S. respondents, 34% said an average incident-response engagement lasted four to six weeks. About one-third said they worked more than 12 hours a day during the most demanding period.

AI can increase the speed and scale of attacks, shortening the time available to detect, investigate and contain breaches. IBM’s 2026 research, which covered 602 organizations affected by data breaches, found that AI-driven attacks increased 56% from the previous year and added an average of $1 million per breach.

The same research found that AI and automation reduced breach costs by an average of $1.93 million per breach. Kirtley argues that those tools should also reduce repetitive work and cognitive strain for security teams rather than simply increase the pace of crises.

IBM’s 2026 X-Force Threat Intelligence Index found that attacks beginning with the exploitation of public-facing applications rose 44% year over year, based on activity observed in 2025. The increase adds to the workload for responders defending systems exposed to the internet.

“Incident responders are the frontline defenders standing between cyber adversaries causing disruption and the integrity and continuity of critical services,” IBM Security X-Force incident-response lead Laurance Dine said.

The earlier survey found that 84% of respondents had adequate access to mental-health resources, while 95% said senior leadership provided sufficient support structures. Those figures indicate broad access to support, even as overlapping incidents, ransomware and faster attacks continue to increase demands on response teams.