Cybersecurity leaders are working the equivalent of a six-day workweek while absorbing fundamentally new responsibilities, according to new research from Seemplicity, a provider of an agentic AI platform for cyber remediation.

The newly released State of the Cybersecurity Workforce Report gathered insights from U.S.-based cybersecurity leaders and found that nearly half (45%) work 11 or more extra hours per week, with one-in-five logging 16 or more additional hours.

“Until organizations hardwire ownership, automate prioritization, and reduce the daily judgment load placed on security leaders, they’re not managing exposure; they’re relying on exhausted humans to hold the system together,” Seemplicity said.

Seemplicity’s agentic Exposure Action Platform features AI agents that proactively analyze business risk while applying automation to the aggregation, prioritization and remediation of exposure management.

Other key findings from the report include:

  • 44% say their role feels emotionally exhausting more often than rewarding.
  • Still, 94% would still choose cybersecurity as a career.
  • 73% say AI oversight and governance is the most important future capability, outranking technical expertise (68%).
  • 89% of cyber leaders say their position now requires significant cross-functional collaboration and business alignment, while 85% feel pressure to strengthen communication and business skills because of AI.
  • 82% say people skills are more central to cybersecurity leadership than five years ago.
  • 64% report sufficient budget for AI, but 52% say training for human-AI collaboration is limited or insufficient.

Beyond revealing a hyper-committed workforce, the survey suggests that AI is fundamentally reshaping what cybersecurity leadership requires: elevating judgment, communication, and business alignment above traditional technical skills, Seemplicity said.

As AI takes over more of the technical execution, cybersecurity leadership roles are shifting toward oversight, decision-making, and accountability.

The survey shows AI governance now outranks traditional technical expertise as the defining capability of modern cyber leadership. At the same time, leaders report growing expectations to collaborate across the business and translate technical risk into executive decisions.

The data points to a fundamental role transformation: cybersecurity leaders are becoming risk governors, responsible not just for detecting threats, but for interpreting AI-driven outputs and owning the outcomes those systems produce.

“We’re watching the cybersecurity workforce hit an inflection point,” said Yoran Sirkis, CEO of Seemplicity, in a media statement. “For years, the industry tried to solve every problem by adding more tools, more alerts, and more people. AI is changing that model. It’s forcing a shift toward smarter prioritization, clearer ownership, and leaders who can translate technical risk into business decisions. The organizations that thrive will be the ones that redesign the role around outcomes, not just activity.”

Seemplicity said that companies are pouring money into AI tools, but many aren’t investing in the people who must manage them.

“Organizations are deploying AI capabilities faster than they can govern, explain or effectively use them. Many organizations are equating AI investment with AI readiness, even as leaders report limited training for human-AI collaboration,” the statement said.

Burned Out But All In

Seemplicity’s State of the Cybersecurity Workforce Report was conducted by Sapio Research during January 2026. The survey gathered insights from 300 U.S.-based cybersecurity leaders across multiple industries to understand how AI adoption is reshaping workforce dynamics, leadership expectations and operational readiness.

Despite significant workload and emotional strain, cybersecurity leaders remain deeply committed to the profession, Seemplicity said, noting that research reveals reports from many leaders that they have difficulty stepping away from their roles.

“This isn’t a talent retention story. It’s a system failure,” said Ravid Circus, Chief Product Officer at Seemplicity. “The people aren’t leaving, but the system is breaking around them. Burnout has little to do with resilience problems and usually comes down to an operational failure. Until organizations hardwire ownership, automate prioritization, and reduce the daily judgment load placed on security leaders, they’re not managing exposure; they’re relying on exhausted humans to hold the system together.”