Tony Kirtley has spent 26 years doing incident response work, the last stretch of it as head of incident response for IBM X-Force, following a career as a retired U.S. Army lieutenant colonel. His read on the state of cybersecurity right now isn't primarily about the technology attacking companies. It's about the state of the people defending them.
AI-enabled attacks are accelerating, up 56 percent over the past year by IBM's own count, but Kirtley argues that fact has crowded out a more urgent problem: "the human impact of machine-speed threats" isn't getting the attention the capabilities of AI-driven attacks themselves are.
The numbers back up his concern. Sixty-eight percent of incident responders say they regularly defend against two or more simultaneous attacks, and 67 percent report experiencing daily stress or anxiety tied directly to their incident-response work.
Kirtley describes incident responders working "around the clock" once a crisis hits, missing personal events and holidays in the process. He has seen relationships strained by weeks of continuous work, and some professionals leave the field entirely just to recover after a particularly difficult incident.
Rather than simply hiring more people, Kirtley's answer is "enabling the people we already have to operate more effectively." That means investing in workforce training and giving teams room to experiment with new technology, automating the repetitive parts of the job so people can focus on the decisions that actually require human judgment, and building in real support for wellness, recharge time, and continuous learning rather than treating those as optional.