Why cybersecurity professionals leave: what we hear versus what studies say

In recent months, we've interviewed cybersecurity professionals in Mexico, from specialists to CISOs. One of the questions we always ask is why they want to leave their jobs. We compiled the responses from those who mentioned this and compared them with published studies.

• 40%: the role reached its peak

• 20%: change of leadership or restructuring

• 13%: the company context

• 7%: compensation

• 20%: other reasons

1. The role reached its peak (40%)

This was the most common reason, and it almost never came with a complaint. They had already learned what the position could teach them, they lacked the authority to make decisions, or the area had stopped growing.

Studies point in the same direction. In ISACA's 2022 State of Cybersecurity survey, with more than 2,000 professionals, 47% cited limited opportunities for advancement and development as a reason for leaving. ISC2's 2025 Workforce Study found that 32% are dissatisfied due to a lack of growth. In academic literature, a review of 40 years of research on career plateaus, published in the Journal of Vocational Behavior, links it to lower engagement and a greater intention to leave.

2. Leadership changed (20%)

A new boss arrived with a different vision, or a restructuring made the position more operational than agreed.

Research confirms that a change in leadership affects the team. A study in Organizational Behavior and Human Decision Processes found that, after a change of manager, those who had the best relationship with the previous one were the most likely to leave. Another, published in Organization Science, observed that turnover in a unit increases when a high-performing leader departs. ISC2 adds a nuance: satisfaction with one's own team (78%) is higher than satisfaction with the leadership (63%).

3. The company context (13%)

Uncertainty about the future of the business, structures where deciding something takes too long, or companies where security receives little investment.

In the ISACA survey, 34% cited a lack of management support. In the ISC2 study, 23% are dissatisfied because leadership does not prioritize cybersecurity.

4. Compensation (7%)

This is where we differ most from the surveys. In the ISACA survey, 48% cited low salary or bonuses as a reason for leaving; in the ISC2 study, 31% cited it as a cause of dissatisfaction.

One possible explanation comes from an article published in Human Resource Management: people tend to underestimate the importance of money when explaining their decisions, even though their behavior shows that it does matter. In an interview with a recruiter, this can be even more pronounced. Just because money isn't the stated reason doesn't mean it's not important.

5. Other reasons (20%)

End of a project, departures unrelated to performance, or people who were not looking to change but were willing to listen.

This aligns with Lee and Mitchell's turnover model, published in the Academy of Management Review: not all departures stem from dissatisfaction. Many begin with an event, such as the end of a project or a call from a recruiter. In the ISACA survey, the most frequently cited reason was precisely that other companies recruited them (59%).

What didn't appear: stress

In the ISACA survey, 45% cited work-related stress as a reason for leaving, and in the ISC2 study, 48% said they felt exhausted from keeping up. A study of 157 cybersecurity professionals, published in ICIC Express Letters, found that stress increases the intention to leave. In our conversations, no one cited it as their primary reason. This may be due to the profile of those we interviewed, with a high proportion of leadership positions, or to the fact that fatigue is less frequently discussed in job interviews.

What does it mean for the employer?

1. Before considering counteroffers, check if your specialists have room to grow: greater reach, new challenges, or a clear path forward.

2. When the security leader changes, talk to the team. That's when they're most open to suggestions.

3. Don't assume money "doesn't matter" just because no one says so. Make sure the compensation is competitive.

4. Ask about the workload, even if no one mentions it.

About this data

Our percentages are derived from recruitment interviews, with one open-ended question and one primary reason per person. ISACA and ISC2 are global surveys of professional associations, with multiple-choice responses; the others are academic studies from other sectors or countries. The figures are not directly comparable; they serve to show whether patterns overlap.

In the next article: what they look for when they accept a new offer.

If you're about to open a cybersecurity position or are worried about retaining your team, write to us at angelrossio@beethon.com .

Sources

• ISACA (2022). State of Cybersecurity 2022.

• ISC2 (2025). Cybersecurity Workforce Study.

• Yang, Niven and Johnson (2019). Career plateau: A review of 40 years of research. Journal of Vocational Behavior, 110, 286–302.

• Ballinger, Lehman and Schoorman (2010). Leader–member exchange and turnover before and after succession events. Organizational Behavior and Human Decision Processes, 113(1), 25–36.

• Li, Hausknecht and Dragoni (2020). Initial and longer-term change in unit-level turnover following leader succession. Organization Science.

• Rynes, Gerhart and Minette (2004). The importance of pay in employee motivation. Human Resource Management, 43(4).

• Lee and Mitchell (1994). An alternative approach: The unfolding model of voluntary employee turnover. Academy of Management Review.

• Cho, Yoo and Lim (2020). Analysis of job stress's impact on job performance and turnover of cybersecurity professionals. ICIC Express Letters, 14(4), 409–415.