Well-being and care

A hacked account, a threatening message or a phone taken at a border doesn’t only hit devices. It hits the people who use them, and often the people around them.

A digital attack is never just a technical incident. It often comes with psychological distress, leads to burnout, and opens up new threats to physical safety that require expert support.

Access Now, 2026

This guide is about looking after your team through that, and looking after yourself.

Why care is part of security

Holistic Security, Tactical Tech’s manual for human rights defenders, treats self-care, well-being and digital security as fundamental to keeping people safe. Fear changes how people act. When we feel in danger, survival responses such as freezing, flight, posturing or fighting can kick in, and much of what we do becomes automatic and harder to control (Holistic Security). A frightened, exhausted team is more likely to miss a warning sign or skip a step.

Recognising stress and burnout

The World Health Organization describes burnout as long-term work stress that hasn’t been managed, with three signs: exhaustion, growing distance or cynicism about the job, and feeling less effective at it (WHO). In a colleague, that can look like someone who’s tired all the time, who pulls away from the work or talks about it bitterly, or who feels nothing they do makes a difference.

People also react to threats in different ways. Some freeze, some want to get away, some try to look tougher than they feel and some fight back (Holistic Security). None of these is wrong. Knowing the range helps you read a colleague’s reaction without judging it.

Psychological first aid

Psychological first aid is practical, humane support for someone in distress. Anyone can give it: it isn’t something only professionals do, and it isn’t counselling (WHO). It comes down to three actions:

1. Look. Check whether the person is safe and what they need right now.
2. Listen. Let them talk if they want to, without pressing them to.
3. Link. Help them reach the information, people and support they need.

Don’t push anyone to go over what happened in detail, and don’t force help on someone who doesn’t want it; stay easy to reach. People recover better when they feel safe, connected to others, calm and hopeful (WHO). WHO’s guide is free to download in many languages, including Kiswahili and Arabic.

Trauma-informed support, in practice

Trauma-informed support starts from safety and trust, gives people back choice and control, and doesn’t assume everyone reacts the same way. As Hera Hussain, founder of the survivor-led nonprofit Chayn, writes, “Trauma is never prescriptive” (Chayn).

In security work, that means:

• explaining what you’re doing and why, and not promising what you can’t deliver
• letting the person choose the pace and what they share
• keeping them in control of their own accounts and devices: doing things with them, not to them
• offering to read abusive messages or screenshots for them, so they don’t have to see them again

Asking for help takes courage. In Hussain’s words, “It’s scary and brave to reach out for help” (Chayn). Meet it with warmth, not alarm.

A team where people can report mistakes

People report problems early, and admit their own mistakes, when they trust the people they work with (Holistic Security). So thank every report, even a late one, and never make an example of anyone.

A few habits help:

• Start team meetings by checking in on how people are, and how much stress they’re carrying (Holistic Security).
• Bring in new security habits in small steps. When people are already overwhelmed, a few short sessions work better than one long one (SAFETAG).
• After a hard incident, offer time off and support (SIIRF).

During and after an incident

When something goes wrong, people may feel guilty, ashamed, anxious, angry or helpless, and the feelings can differ across a team (Digital First Aid Kit).

There is no “right” way to feel, as your state of vulnerability and what your personal information means to you is different from person to person. Any emotion is justified, and you shouldn’t worry about whether or not your reaction is right.

Peter Steudtner and Flo Pagano, Digital First Aid Kit

Nobody has to fix it alone. A trusted person can work through the steps with them (Digital First Aid Kit). Women facing online harassment often feel anxious and ashamed; tell them plainly that they aren’t alone and that it isn’t their fault (SAFETAG).

Check in again a few days later, and again after that. Support works over time, not just once (SIIRF). Every playbook in Incident Response has a section on looking after the person.

Look after yourself

Helping others through an attack takes something out of you too. Plan your own rest, share the load and name someone who can stand in for you. Security champions has more on keeping the role sustainable.

Where support is

Most small organisations have nothing formal for emotional support. Where it happens, it’s colleagues, the champion and sometimes a helpline. Find out where support is before anyone needs it, and write it into your incident response plan. SIIRF’s Readiness Assessment asks whether staff who face harassment can get support.

• Access Now’s Digital Security Helpline is free for civil society, day and night. People who need psychological first aid or mental health support are connected to Vita Activa, which helps journalists, activists, human rights defenders, women and LGBTQ+ people facing stress, trauma, burnout or digital violence. If they meet its criteria, support is free and confidential, in Spanish, Portuguese, English and Arabic (Access Now).
• Some helplines pair technical and emotional help. Pakistan’s Digital Rights Foundation offers counselling alongside its helpline (Digital Rights Foundation).
• The Digital First Aid Kit keeps a list of support organisations.

For anything that looks like a mental health condition, point people to a professional. Psychological first aid isn’t treatment.

Where to go next

• Security champions: your role, and its limits.
• Your incident response plan: write support into the plan.
• Online harassment and abuse: supporting a colleague who’s targeted.
• Training your team: sessions that don’t add to the stress.