Burned-Out Teams Are Easier to Hack: Why Wellness Is Security

by Zoe North | Giftbit Head of Marketing

On November 5, I attended an Incentive Gift Card Coalition (GCC) education session on the recent cyberattacks that hit the digital rewards and gift card provider industry this fall.

I expected to come away thinking about firewalls and fraud rules.

Instead, I left thinking about people.

As a marketing leader (read: someone with nothing to do with security infrastructure), I’ve always seen team wellness as a way to avoid the cost of turnover, keep great expertise on the team and, of course, work with happy people. After that session, I’m starting to see it as an essential layer of security too.

Cyber attacks now look like status quo

Panelists at the session described a shift from opportunistic theft to organized operations that are patient, well-funded and using AI to scale. As one legal expert put it, a few years ago this was shoplifting, and now it’s an operation.

What stuck with me is that the most effective attacks don’t break in. They blend in.

Attackers place orders that look routine, write to customer support with convincing stories, and reach out to employees posing as recruiters, vendors or colleagues. Many attacks start by targeting a person who takes a request at face value.

That’s how the October attack on crypto exchange Binance began. According to Binance’s own report, it started with a fake job interview and a tampered download on an employee’s computer, and grew into a theft affecting about US$6.34 billion in digital assets. 👀

Who is easy to fool?

Social engineering works by applying urgency, pressure or temptation at the moment someone’s guard is down. Burnout, a culture of fear, and overall disengagement each lower that guard in a different way.

• Tired people miss things. At the end of a long day, a convincing link gets clicked and an “urgent” request gets approved without a second look.
• Fearful people don’t ask. In a culture where looking silly feels risky, people don’t stop to check whether a request is real. They’re also slower to admit they clicked something 'bad,' which gives an attacker more time.
• Disengaged people are looking for an out. Someone who feels undervalued is more likely to answer a recruiter’s message, and to follow whatever steps they request.

None of these are character flaws. They’re predictable results from how people are treated at work, which means a company can change them.

People who feel valued, rested, and safe to speak up are harder to fool.

The business case was already there

Most companies don’t need convincing that burnout is expensive.

Turnover means hiring and training costs, lost expertise, and slower teams.

Disengagement shows up as missed details and weaker work.

Even the panelists talking about incident response came back to it: incidents are handled by people under real strain, so looking after the team is part of responding well.

Security adds one more line to the case, because a team that feels rested, recognized, and invested is harder to compromise.

How to build a team that's harder to fool

None of what we're talking about requires a big, new program Most of it is simply good management, applied consistently.

1. Keep workloads realistic. Chronic overtime and constant context switching are where mistakes happen. Watch for people who are always online, and rebalance work before they burn out.
2. Protect time off. Encourage people to take their vacation and actually disconnect. Then actually cover their work so they aren’t checking email from the beach.
3. Recognize people specifically and often. A timely, specific thank-you tells someone their work is seen. People who feel valued are more invested in the team and less tempted by an offer that seems too good to be true (my CCO also wrote about employee recognition mistakes companies often make here).
4. Give permission to slow down. Make it explicit that pausing to verify an unusual or urgent request is always the right call, even if it delays something. Urgency is one of the most common tools attackers use.
5. Make it safe to speak up. If someone clicks a bad link, you want to hear about it in minutes, not days. Thank people who report mistakes instead of blaming them.
6. Pay attention to transitions. New hires, people on their way out and teams going through change are under extra pressure. Check in more during those stretches, and remove access promptly when someone leaves.

What I'm taking back to my team

Security training teaches people what to look for. Wellness decides whether they have the energy and confidence to act on it.

I’m not going to become a security expert, but I can help make sure the people I work with are rested, recognized and comfortable saying “this doesn’t look right.”