There is a type of fatigue that does not show up in burnout surveys, does not get discussed in team retrospectives, and does not appear in any CISO dashboard. It accumulates quietly, over months, in people who spend their days reconstructing what happened on a murdered child’s phone, parsing chat logs from a grooming case, or reviewing CCTV footage of a violent assault frame by frame.

cover

Digital forensic analysts and secondary investigators occupy a peculiar position in the broader law enforcement and cybersecurity ecosystem. They are not frontline officers, not emergency responders, not the people whose faces appear on documentaries about cold cases. They are the civilians in the back office who make the prosecutions possible: the ones who extract, triage, and catalogue evidence that most human beings would struggle to look at once. And because the work is technical rather than physical, because it happens on a screen in an office, the assumption has often been that it is somehow easier to bear.

That assumption does not survive contact with actual data. A longitudinal study published in April 2026 in the Journal of Police and Criminal Psychology, conducted by Fazeelat Duran and Jessica Woodhams at the University of Birmingham, is among the first to follow newly recruited law enforcement staff from their first day through eighteen months on the job and document what repeated exposure to distressing material actually does to a person over time. The picture that emerges is not pretty.

What the study found, and why it matters

The research followed twenty-one newly hired crime and intelligence analysts at a UK law enforcement organization across three interview rounds: at six months, twelve months, and eighteen months in post. Sixty-three interviews in total. The participants worked on cases involving sexual assault, homicide, and serious crime, regularly reviewing investigative reports, interview transcripts, recorded interviews, and crime scene or autopsy imagery.

At six months, nobody reported significant distress. The researchers describe participants as being in a training phase: engaged, motivated, still somewhat cushioned by novelty. Most said they “enjoyed” the role. A few noted growing awareness of how frequently crime occurs, a kind of peripheral vigilance starting to form. But no sleep problems. No intrusive thoughts. No significant psychological symptoms.

By twelve and eighteen months, the picture had changed substantially. More than half reported disturbed sleep patterns, including recurrent nightmares directly linked to cases they were working on. A large subset described intrusive thoughts, the kind that arrive unbidden on a quiet road at night or in the back of a taxi. Fourteen participants reported hypervigilance to perceived threats in their personal lives: excessive suspicion of strangers, anxiety about partners walking alone, compulsive security behaviors. Nine described feelings of isolation and loneliness, rooted in the simple fact that you cannot explain what you do all day to the people in your life.

The researchers frame these changes around the concept of “dosage”: the cumulative weight of repeated exposure to distressing material, which does not average out but compounds. Each new case adds to a growing reservoir of intrusive memory rather than displacing the old ones. The study found that as dosage increased, participants increasingly reported experiences consistent with PTSD-like symptoms, depression, and burnout.

The coping strategies evolved too, and not always in useful directions. Early on, participants mostly went with the flow. Later, sixteen of twenty-one described thought suppression as a primary technique, trying to push case-related imagery out of their heads. Eight reported reading material at a surface level as a protective mechanism, staying deliberately shallow to avoid emotional engagement. The researchers note that both of these strategies are associated with poorer outcomes over time in the relevant psychological literature: suppression tends to backfire, and shallow engagement can coexist with growing underlying distress.

Eight participants, by the eighteen-month mark, were actively planning to leave the role.

The DFIR angle that the study does not cover

The Duran and Woodhams research focuses specifically on law enforcement staff in the UK, and its findings are directly applicable to a category of professionals that the cybersecurity and DFIR community tends not to think about in these terms. Incident responders, digital forensic analysts, malware reverse engineers, child exploitation investigators working in digital evidence units, and threat hunters who sift through terabytes of logs looking for indicators of harm sit on the same spectrum.

The specific content varies. A DFIR analyst working a ransomware case is not reviewing CSAM. But the picture is not uniformly benign either. CSAM cases handled by digital forensic units are an obvious pressure point, and anyone who has spent time in a serious case unit will know that the material is rarely limited to the technical artifacts. You encounter what the files contain. You read the communications. You watch the footage.

And beyond the most extreme material, there are subtler accumulations. Months of working homicide cases leave sediment. So do years of processing the wreckage of domestic abuse, financial fraud, and child exploitation, even when you are technically focused only on the data layer. The dosage concept applies here too. Every case adds a frame to the reel.

The cybersecurity industry has invested considerable energy in the past decade into technical burnout: the kind caused by alert fatigue, undersized teams, and the permanent asymmetry between attackers and defenders. There is reasonable awareness that SOC analysts working twenty-four-hour shifts with a hundred alerts per hour is a sustainability problem, as discussed in my post on 24/7 security monitoring for small teams. The psychological damage from content exposure is a different category of problem, less visible, less discussed, and possibly more corrosive precisely because it tends to be minimized or treated as simply part of the job.

The organizational machinery that makes things worse

One of the more uncomfortable findings in the Duran and Woodhams study is not about the material itself but about how organizations respond, or fail to respond, to the people handling it. By twelve months, most participants perceived the wellbeing support offered by their employers as generic and institutional: a wellness email that goes to everyone, an online resource portal that no one reads, and the option to flag yourself to a line manager who is equally overloaded. This perception of inadequate support had a name in the study: psychological contract breach. Employees had entered the role with an implicit expectation that the organization would recognize the nature of the work and provide meaningful support. The organization had not delivered on that expectation, and the gap was itself a source of distress.

This will sound familiar to anyone who has led a DFIR team. The post-incident retrospective focuses on technical findings. The team debrief, if it happens at all, covers process improvements. The question of how analysts are doing after three weeks of working a ransomware case that hit a hospital network, where the artifacts they are reviewing include patient data and the clinical systems that failed, tends not to be on the agenda.

This concern is consistent with what I described in Protecting the Protectors, where sustainable incident response depends on explicit team rituals for decompression, peer support, and workload redistribution, not only on technical excellence.

The study also documents how understaffing drives exposure dosage up. Fewer analysts means each one handles more cases. More cases means more content, compressed into tighter timelines to meet monthly targets. The individual absorbs the organizational shortfall. Twenty participants explicitly mentioned the pressure of monthly targets as a significant stressor, distinct from the material itself, but interacting with it in ways that accelerated exhaustion.

There is also a finding about humor that deserves attention. Research cited in the study distinguishes between light humor, which appears to be genuinely protective, and dark humor, which correlates with greater psychological distress. Anyone who has spent time in incident response teams will immediately recognize the dark humor register: the jokes that serve primarily to signal that you have seen things, that you are not rattled, that the appropriate response to the worst material is ironic detachment. It functions as social bonding and as a signal of professional identity. The research suggests it is also, over time, a marker of someone who is not coping well.

A practical baseline for DFIR team leads

  • Set explicit exposure limits per analyst on high-impact content each week.
  • Add a mandatory 15-minute decompression break every two hours during severe cases.
  • Run a short wellbeing check-in at the beginning and end of major incident shifts.
  • Rotate case types when possible, so the same people are not repeatedly assigned to the hardest material.
  • Include one people-focused metric in monthly operations reviews, such as turnover intent or sustained overtime.

What changes, and what does not

The Duran and Woodhams longitudinal design reveals something that cross-sectional snapshots cannot: the trajectory matters as much as the state. A new analyst at six months who reports no symptoms is not safe. They are at the beginning of a dosage accumulation curve that, without intervention, tends to produce symptoms by month twelve.

The implication is that early intervention is more effective than late intervention, and that waiting for visible distress to emerge is waiting too long. The study explicitly recommends that organizations equip staff with skills to recognize distress and adopt adaptive coping strategies within the first six to twelve months, before cumulative exposure increases risk. This means psychoeducation not as crisis response but as routine onboarding. It means normalizing the conversation before the conversation becomes about someone who is struggling.

The most protective factors identified were social support from colleagues who understand the work, genuine flexibility on workload, managerial attention that is specific rather than generic, and the ability to physically step away from the material at intervals during the day. Exercise, mindfulness, and hobbies outside work appeared in the adaptive coping category. None of this is surprising. What is surprising is how rarely organizations treat it as a design constraint rather than individual employee responsibility.

The DFIR community has built an impressive body of technical knowledge around the artifacts that crime and compromise leave behind. It has been slower to build comparable knowledge around the artifacts that the work leaves in the people who do it. The Duran and Woodhams research is not the first word on this, but it is among the most methodologically rigorous, and it tracks change over time in a way that earlier cross-sectional work could not. For anyone leading a DFIR team, managing a digital forensics unit, or working in one of these roles without anyone checking in on how they are doing, the paper is worth reading in full. This matters even more now that incident response is evolving toward continuous operations, as discussed in DFIR from break glass to always-on.

The evidence does not always stay on the screen. Sometimes it follows you home. That is not a weakness. It is a psychologically predictable outcome of being human and doing difficult work. The question is whether the organizations that depend on that work have decided to treat it as their problem too.

FAQ

What does the 18-month longitudinal study show about analyst wellbeing over time?

Distress was limited at six months, then rose significantly by months twelve and eighteen, with recurring sleep disruption, intrusive thoughts, and hypervigilance linked to cumulative exposure.

Why is cumulative exposure in DFIR often underestimated by organizations?

Because the work is screen-based and technically framed, leaders often treat it as lower-impact than frontline exposure, even when analysts repeatedly process severe and emotionally distressing material.

Which coping patterns were associated with poorer outcomes in the study?

Thought suppression and deliberately shallow engagement were common and correlated with worsening long-term distress rather than durable adaptation.

What should DFIR leaders implement first to reduce secondary trauma risk?

Set exposure limits, enforce decompression breaks, run regular wellbeing check-ins, rotate high-impact case assignments, and track one people-focused indicator alongside operational metrics.