SoK: Beyond Burnout -- A Gap Analysis of Psychological Harm in Cybersecurity Work

Burnout among cybersecurity professionals drives workforce attrition, but its consequences extend beyond staffing shortages. Degraded judgment and human error, particularly during incident response, can be catastrophic. Yet the sources and forms of psychological harm across cybersecurity roles remain poorly understood. This Systematization of Knowledge (SoK) paper examines the literature on wellbeing and psychological harm in cybersecurity work. Using a scoping review across five databases, we review 101 papers and synthesize 57 covering wellbeing research on cybersecurity practitioners and four adjacent professions selected for structural similarity. We find that research on offensive cyber roles emphasizes harm driven by operational conditions, while the work itself is often experienced as meaningful. In contrast, research on defensive roles highlights stressors intrinsic to the work, including sustained vigilance, exposure to human malice, and invisible success metrics. Adjacent professions facing similar demands consistently report psychological harm extending beyond burnout. How such harm manifests in cybersecurity practitioners remains unclear, with existing studies measuring burnout, cognitive workload, fatigue, clinical distress, or wellbeing, but no studies to date assessing whether psychological harms beyond these constructs are present in this population. We identify cybersecurity-specific barriers to processing occupational stress, including confidentiality constraints, limited institutional support, cultures discouraging help-seeking, and temporal dynamics that prevent psychological closure. Our findings provide a structured foundation for research to explore cybersecurity interventions calibrated to the psychological harms the work actually produces.