Survey Finds Compliance Demands Burned Out or Drove Turnover in 37% of Security Teams

Summary

A survey of 504 IT and security professionals found compliance demands contributed to burnout or staff turnover at 37% of organizations, while documentation work also diverted time from active security efforts.

Key points

The survey was conducted for Huntress in May 2026 and included 504 U.S. IT professionals involved in security, IT management, or compliance.
37% of respondents said compliance and audit demands led to security-team burnout or staff turnover in the past year.
34% said they delayed or deprioritized security initiatives to handle documentation, and 65% reported a moderate or significant impact on active security work.
21% said their organization lost a contract or business opportunity because of compliance demands.
Only 17% of respondents said they were always audit-ready without preparation; 64% of manual-heavy teams needed at least two weeks to prepare.
Changing compliance requirements were the most commonly cited barrier to staying continuously audit-ready, named by 23% as their biggest barrier.

Article Details

Publisher: Huntress
Report Period: Survey fielded May 12, 2026; respondents reported on the past 12 months.
Scope: Survey of U.S.-based IT professionals at manager level or above, directly involved in security operations, IT management, or compliance, at organizations with more than 100 employees.
Sample Size: 504 completed surveys; unweighted; approximately +/-5% margin of error for the overall sample at a 95% confidence level.
Key Statistics: 37% of respondents said compliance and audit demands led to security team burnout or staff turnover over the past 12 months.
37% said their organization hired additional headcount specifically for compliance work over the past 12 months.
34% said they delayed or deprioritized active security initiatives to keep up with documentation demands over the past 12 months.
21% reported losing a contract or business opportunity during the past 12 months.
65% said compliance documentation has a moderate or significant impact on capacity for active security work.
Recommendations: Automate evidence collection so it runs continuously rather than in a pre-audit sprint.
Align security and compliance teams around shared documentation workflows.
Use a SIEM designed for compliance requirements to centralize log management and reduce manual work.
For teams using CMMC or similar frameworks, map controls by domain to clarify continuous-readiness coverage.