A sustainable cybersecurity strategy is one that takes into account the budgetary and resource constraints of the organization. It requires an ongoing commitment to security awareness and training, as well as a focus on risk management. This talk highlights the core concepts of sustainable cybersecurity, and shares practices insights on how to reduce complexity, invest resources effectively and mitigate cyber risk without exhausting people.