In our industry, it's all too common to see people leave for their next job, receiving pay increases of 20% or more.  Tens of thousands of dollars; sometimes more.  And it's an easy thing for all sides to point to and say 'well, we simply can't compete with an increase like that.'

If your company maintains data on why people leave, I'd be willing to be that the overwhelming loss code category is 'left for higher compensation.'  

But that’s just looking at the part of the iceberg above the waterline. 

It's usually a lot deeper than that.  Chalking departure up to higher pay avoids tough conversations at that exit moment. But there's a reason people take the inbound calls.  65% of people in our industry are actively thinking about quitting (Ponemon). That's a stunning number. Turnover of 20% is typical; 35% isn’t uncommon. 

Of course, it's true that there are many, many instances where comp really is the principal driver. And it's also true that there are many people for whom money is the overwhelming motivational factor, and they are happy to switch jobs in pursuit of the most lucrative opportunity.  But that isn’t most people. 

What’s going on?

 Here are some common patterns I see as we speak with people who are considering greener pastures elsewhere.

 1) Personal growth

• Below comp, this is the most commonly cited reason with why people leave.  In our industry, things move so quickly that it’s imperative to stay current.  Most cyber professionals are growth oriented and curious.  And the market is moving around all of us.  People want to feel like they are growing.
• Frequently, training opportunities are either not funded.  And even when they are, they may not be funded with 'expectations' (i.e.- funds are available but there's no relaxation of expectations, so it practically becomes very difficult to dedicate the time to accomplish the ‘extracurricular’ training).
• Many managers are afraid that if they train their employees, they will just quit for other, higher paying jobs.  We aren't saying that there isn't some truth to that fear.  However, you have to look at the alternative... those folks are going to go anyway (because they aren't growing).  Wouldn't you rather have a brand as a place where great people can come to build their career, get those folks up to speed faster, and then build loyalty and strong engagement with a significant part of the team?
• Another issue is career path.  Often, no clear path exists.  This is a particular problem for smaller security organizations, which may just not have the number of roles to offer people a viable internal path up.  Even with this, we recommend levelling within roles to be able to keep up with escalating market value and acknowledge the increased productivity and breadth of skills a person can bring to bear (and to reflect the costs of replacement).

 2) Burnout

• When there simply aren't enough people on the team, the work doesn't just go away… it gets spread around.  And when people leave, this can feed a downward spiral that makes those that still remain more likely to consider leaving.
• Nobody wants people on their team to be burnt out, and most leaders are very sensitive to this condition.  There is no easy answer.  In a market with a 1/3 of the work simply not being covered, a degree of this may just be a reality.  
• Despite the shortage of talent, and high amount of work do be done, there are things managers can do.  Focus on what you can control.  Check in with your team, look for warning signs.   Sometimes a little empathy can go a long way.  Help your team feel valued.  Help them feel seen.  

 3) Leadership

• The average term of a CISO is stunningly short.  Some studies quote 18-24 months (ESG);  others a little bit longer.  Regardless, it's hard to expect stability in the rank and file when leadership changes regularly.  And new leaders want to make their mark.  New strategies and priorities are put in place.  New managers come in.  The priorities that have been pursued up to that point may be put aside.  But the new initiatives being put in place will still take 12-18 months to show results.  So many companies are trapped in this treadmill cycle of constant change, but little progress.  And this type of environment is a recipe for turnover, loss of institutional knowledge, and poor results.
• Our advice for CISOs is similar to that for other security professionals- know yourself and do your diligence.  What type of environment is right for you?  Large or small?  Mature or immature?  What type of challenge do you want to face?  What’s the security culture of the company?  And then get to know the company and opportunity as much as possible before you sign on. Once your diligence feels uncomfortably deep, then you've found the right level.

 4) Trust

• At the end of the day, trust is the single most important factor in employee engagement.  Do employees feel secure and valued?  Do they feel like they are part of a cohesive team?  Do they feel free to speak what is on their mind?  When people feel trusted and trust those they work with, you get a much stronger bond.
• Trust is built over time and lost easily.  Look at the actions you take as a manager and the culture you build through a lens of trust. This does not mean giving people responsibilities that they aren’t cut out for.  It’s about building an environment that empowers but also supports at the same time.  An environment where there is accountability- but not fear. An environment where the team feels collectively accountable for reaching a certain set of outcomes.

There’s a lot more that we can say on all of the above points, but we will save that unpacking for future blog posts.

You may never be able to compete with somebody offering one of your people $100K more to move to another role.  But you don't have to be resigned to a constant revolving door and endless onboarding.

Our belief is that it all starts upfront.  Hiring the people that are the right fit for your program, your team, your company, and your culture.   Of course, in a market this tight, that's easier said than done.  Our methodology goes deep on people's technical and non-technical skills, motivations, and aspirations so that you have the best odds out of the gate to build a team, and culture, that will endure.  If you want to learn more, drop us a note.

‍