If you or someone you know needs help right now
United States: call or text 988, or call 911. Anywhere: findahelpline.com lists free, confidential support lines by country. US veterans and service members: call 988, then press 1.
You don't need to read anything on this page first.
Cybersecurity has one word for what this work does to people, and it's the wrong word for most of it.
Four severity states, adapted from military stress doctrine. The framework gives you a way to see movement between them, and tells you what to do at each one.
Workload injury. Rest and structural change fix it. It's the only one of the four that responds to time off.
Comes from exposure to what happened to other people. Rest does nothing for it.
A slow change in how you see the world, accumulated across years rather than incidents.
Being party to something you believe was wrong, or being stopped from doing what you believed was right.
Each has a different cause, a different signal, and a different fix. Calling all four burnout means three of them get the wrong treatment, and the people carrying them conclude that nothing works.
The complete work. Four injuries, four zones, six exposure drivers, the check-in protocol, escalation, the organizational layer, and the full source list.
The practitioner half, built for one person acting alone with no program and no mandate. Everything except the role-exposure map and the organizational layer.
A two-page operational card. Zones, the four injuries and their different fixes, the seven C's, what to say and what not to say, escalation triggers, and where to route. No argument, no citations.
Anyone in a high-exposure security role, and anyone responsible for people in one. Threat intelligence, incident response, digital forensics, security operations, vulnerability research, trust and safety.
It's written to be usable by an individual with no budget, no program, and no institutional backing. That case is the whole reason the Field Guide exists.
This is a detection aid. It isn't a safety system and shouldn't be treated as one.
People can be in serious trouble with none of these indicators present. Someone can hold a normal conversation, hit every deadline, answer a check-in honestly by their own reckoning, and still be nowhere near all right. Someone can also decline to tell you anything, and that's their right.
Peer support sits alongside clinical care and crisis services. It replaces neither, and it doesn't turn a colleague into a safety net.
If you are worried about someone right now, don't run a protocol. Use the numbers at the top of this page.
Read the framework first, then get trained. Two bodies of work sit underneath everything in it, and they're structured differently from each other.
Stress First Aid is a published model rather than a certification. The manuals are free from the National Center for PTSD. Instruction is available from several institutions, including Duke University's School of Nursing and the Schwartz Center for Compassionate Healthcare.
Mental Health First Aid is a formal certification course delivered by licensed providers, free in many jurisdictions. Outside the United States, find your country's program at mhfainternational.org.
The framework gives you vocabulary and a protocol. It can't give you the judgment that comes from training.
The framework is archived on Zenodo with a permanent identifier, independent of this repository.
doi.org/10.5281/zenodo.22821413
Marshall, J. (2026). The Human Incident Response Framework: A Practitioner Wellbeing Framework for Cybersecurity Operations. Version 1.6.60. Zenodo.
Disagreements, adaptations, and arguments about where this gets something wrong are all welcome. Open an issue.
Every empirical claim has been checked against its primary source, and several were cut or rewritten when they didn't survive that check. If you think a citation is wrong, say which one and what it should say. The role-to-injury mapping is explicitly clinical inference rather than empirical finding, and challenges to it are the most useful thing anyone can send.