"We have to stop treating sustainability as a personal wellness program and start really treating it as an organizational design problem," said Chris Bevil, global cyber resilience and AI leader at Commvault and a former CISO, during an episode of Lock It Down with Security Magazine.
Chris Bevil on organizational design and CISO sustainability
Bevil framed CISO burnout not as an individual failing but as a structural challenge. Drawing on his experience as a former CISO and his current role leading cyber resilience and AI at Commvault, he told Security Magazine's Lock It Down podcast that sustainability must be embedded in how organizations are designed and governed, rather than left to personal wellness programs.
That distinction — personal coping versus organizational responsibility — is the central through-line of his remarks. In Bevil's view, treating sustainability as an individual problem places an unfair and unsustainable burden on security leaders.
Why CISOs are at high risk of burnout
On the podcast, Bevil dug into the roots of CISO burnout and shared first-hand accounts from his time in the role. He argued the issue "isn't something CISOs should be expected to shoulder and solve alone," emphasizing that systemic factors in organizational design contribute to recurring overload and stress for security leaders.
While the episode explored multiple causes, the core point Bevil repeated is that responsibility without corresponding structural support creates conditions where burnout is predictable rather than exceptional.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadAI-fueled attacks as an exacerbating factor
Bevil also addressed the role of emerging threats, saying that "AI-fueled attacks may exacerbate this issue." In the podcast he connected the evolving threat landscape — specifically the arrival of attacks empowered by AI — to increased pressure on security teams and leaders.
He presented this connection as a contemporary risk multiplier: new attack methods could increase the frequency or complexity of incidents, making the existing organizational strains on CISOs more acute unless design changes are made.
Building an organization that does not require a "hero every Tuesday"
Bevil sketched a maturity target for organizations: "The next stage of maturity is building [an organization] that does not require a hero every Tuesday, because that’s where the burnout is happening," he said. That image — a recurring weekly crisis that depends on extraordinary individual effort — encapsulates the problem he warned against.
Framing sustainability as an organizational design problem implies different remedies than personal wellness programs: rethinking roles, responsibilities, escalation paths, staffing models, and the operational expectations placed on security leadership so that crisis management is distributed and repeatable rather than hero-driven.
What this means for technologists, procurement leaders, and executive teams
- Technologists and security teams: Bevil’s comments signal a need to track how new threat vectors, including AI-fueled attacks, shape operational tempo and incident response demands so those pressures can be reflected in team design and capacity planning.
- Procurement leaders and affected enterprises: If sustainability is an organizational design problem, procurement and staffing decisions should align to reduce reliance on individual heroics — for example by investing in tools, processes, or service models that distribute risk and workload.
- Executive teams and boards: According to Bevil, leadership should not expect CISOs to "shoulder and solve alone." Executives must consider structural changes to prevent repeated crisis cycles and to move organizations toward the maturity he described.
Bevil’s comments in the Lock It Down episode make a simple but consequential point: do not treat CISO endurance as a personal resilience question alone. Instead, make organizational design the locus of the fix. The podcast episode is available through Security Magazine and on Apple Podcasts for those who want the full conversation and the real-world examples Bevil draws from.
