A University at Albany-led study reveals that repeated exposure to cybersecurity requirements can cause employees to develop 'security fatigue,' leading to mental exhaustion and disengagement from security practices. The research, published in the European Journal of Information Systems, shows that constant security demands can overwhelm workers and reduce compliance.

Employees face an increasing burden of security tasks, from managing complex passwords to identifying phishing attempts and adapting to frequently updated policies. While each task is manageable individually, the cumulative effect creates a sustained cognitive load that depletes self-regulation capacity. This fatigue manifests as emotional exhaustion and disengagement from security practices.

When overwhelmed, employees may ignore warnings, reuse weak passwords, or seek workarounds to maintain productivity. The study surveyed nearly 300 full-time U.S. employees and found that security fatigue most often develops when requirements interfere with primary job duties. The research suggests organizations can reduce fatigue by providing training, simplifying processes, and integrating security into everyday workflows.