Chapter 14 of 14 · Whenever you need it
When None of This Works: Burnout and Escalation
- What do I do when leadership ignores a serious risk?
- When should I escalate above my boss?
- How do I know if I am burning out?
- When is it time to leave?
Sometimes you do everything in this book and it still does not work. A serious risk is ignored. The budget is cut after an incident. You are blamed for a decision someone else made. This chapter is for those weeks.
Escalating a risk properly
- Write the risk down plainly: what could happen, how likely, what it would cost, what fixing it would take.
- Give it to the person who owns the decision, and ask for a decision with a date.
- If they accept the risk, record that they did. That is a legitimate outcome.
- If they will not decide, or the risk is beyond their authority, tell them you will take it to the next level, then do.
- Keep copies of what you sent and when.
Escalation is not betrayal. It is how organisations make sure the right person makes the big calls. Do it openly, never around people. Most companies have a route to the board or an audit committee for exactly this.
The question you might not ask out loud
Could I be personally on the hook for this?
There have been cases where security leaders faced personal legal consequences, and the details matter a great deal. This is a question for your own lawyer, not a handbook. What is always wise: keep honest records, never sign or say something you believe is false, and ask whether your role is covered by the company's directors and officers insurance.
Noticing burnout
- You dread checking your phone, even on quiet days.
- Small problems feel like disasters.
- You have stopped caring whether a fix works.
- Sleep, health or relationships are taking the hit.
This job carries constant low-level alarm. Build in rest on purpose: a deputy who can cover, a real handover when you take leave, and someone outside work you can talk to. If you are struggling, talk to a doctor or a professional. It is a health matter, not a weakness.
When to leave
If you have escalated properly, the risk is serious, and the organisation has chosen not to act and not to own that choice, you may have reached the end. Leaving well means a clean handover and an honest record of the risks you raised. Your reputation is built on the decisions you can defend, including the decision to go.
Rule of thumb:You cannot protect a company that will not let itself be protected. You can make sure the choice was clear.