Security Fatigue: What It Is and Why More Training Backfires

Security fatigue is the mental exhaustion and growing indifference employees feel after repeated exposure to security demands: password resets, MFA prompts, phishing warnings, and mandatory training. First documented by researchers at the National Institute of Standards and Technology (NIST) in 2016, it explains why well-trained employees still click, reuse passwords, and approve requests they shouldn’t, not from ignorance, but from depletion.

Where the Term Comes From

NIST researchers Brian Stanton and Mary Theofanos weren’t looking for fatigue when they interviewed 40 computer users about their security habits and beliefs in 2016. It showed up anyway, consistently, across nearly every interview. Their study defined security fatigue as a weariness or reluctance to deal with computer security, and found it drove people toward the path of least resistance: reusing an old password because it’s easier to remember, dismissing a certificate warning without reading it, or deciding a decision isn’t worth the mental effort it demands.

Theofanos later summarized the underlying shift in plain terms: security used to mean remembering one password at work. Now employees are expected to manage dozens of passwords, MFA prompts, and security decisions across every tool they touch, with no corresponding reduction in how much attention each one demands.

The Psychology Behind the Exhaustion

Security fatigue isn’t laziness. It’s a predictable response to cognitive overload, and it shows up in a few recognizable patterns:

• Desensitization. Repeated exposure to security warnings, especially ones that turn out to be false alarms, trains people to dismiss them automatically. This is the same mechanism behind alert fatigue in security operations centers, applied to the individual employee’s inbox.
• Learned helplessness. Employees who’ve seen breaches happen anyway, despite following the rules, start to believe their own caution doesn’t change the outcome. That belief quietly erodes the motivation to keep trying.
• Decision fatigue. Every MFA prompt, every “does this link look right” pause, every password rule draws from the same limited pool of mental effort. By the end of a long day, that pool is emptier, and judgment gets worse exactly when an attacker is most likely to test it.

A concrete, well-documented example of security fatigue being weaponized directly is the MFA fatigue attack: an attacker who already has a stolen password sends repeated MFA push notifications until an exhausted employee approves one just to make the prompts stop. The 2022 Uber breach followed exactly this pattern. The attacker didn’t need to break MFA. They needed an employee tired enough to tap “approve.”

Why More Training Doesn’t Fix It, and Can Make It Worse

The instinctive response to a security failure is often more training, more warnings, more reminders. Against security fatigue, that instinct backfires. Adding more security decisions to an already-overloaded employee doesn’t build resilience; it accelerates the exhaustion that caused the problem in the first place.

NIST’s own researchers proposed three design principles instead of more volume:

1. Limit the number of security decisions employees have to make. Every unnecessary prompt is a withdrawal from the same finite attention budget.
2. Make the right action the easy action. If reporting a suspicious email takes five clicks and a ticket number, most employees will quietly delete it instead.
3. Design for consistency. Security cues that look and behave the same way every time require less cognitive effort to process than ones that vary by tool, team, or moment.

This is also why role-based security awareness training tends to outperform one-size-fits-all annual modules: it cuts the volume of irrelevant decisions a given employee has to process, rather than adding another generic layer on top of what’s already overwhelming them. Programs built on strong security awareness training fundamentals apply the same logic at the platform level, sequencing content instead of dumping it all at once.

Blameless Reporting Reduces Fatigue, It Doesn’t Just Feel Nicer

There’s a direct link between security fatigue and how an organization responds when someone makes a mistake. Insider incidents are rarely malicious; far more often they’re a tired, overloaded employee who made a reasonable-sounding call and got it wrong. An employee who fears blame for reporting a mistake late learns to avoid reporting altogether, which is learned helplessness with an audience.

Organizations that treat a reported near-miss as useful data, not a disciplinary event, get two things in return: earlier warning when something does go wrong, and a workforce that hasn’t concluded that staying quiet is safer than raising a hand. That shift costs nothing to implement and directly counters the “why bother” resignation NIST’s research identified as security fatigue’s most damaging symptom.

Reducing Security Fatigue Without Reducing Security

A few concrete changes lower the cognitive load without lowering the bar:

• Cut the volume of low-value alerts so the ones that matter aren’t buried in noise the way phishing warnings get buried when they fire on every external email regardless of actual risk, an approach phishing simulation programs can help calibrate by showing which warnings employees actually act on.
• Shorten the path to reporting something suspicious to one click, not a form, a ticket, and a wait.
• Replace long annual training blocks with short, frequent touches embedded in the flow of work, since gamified, bite-sized formats ask for less sustained attention per session and are easier to sustain over a year than a single 90-minute module nobody remembers by March.
• Standardize security prompts across tools wherever possible, since employees who see five different-looking MFA screens across five different apps carry a heavier cognitive load than those who see one consistent pattern.
• Track fatigue indicators, not just training completion. A rising rate of dismissed warnings or declining phishing report rates over time is often a fatigue signal, not a discipline problem, and best practices for employee training increasingly treat these behavioral signals as the metric that matters, not completion checkmarks.

Fatigue Is a Design Problem Before It’s a Discipline Problem

Nearly a decade after NIST first named it, security fatigue remains one of the most underestimated risks inside organizations, precisely because it looks like carelessness from the outside and feels like exhaustion from the inside. Treating every lapse as a training gap misses what the research actually found: the fix is reducing unnecessary friction and decision load, not adding more of both.

Programs that measure human risk rather than just tracking training completion are better positioned to catch fatigue before it shows up as a breach, because the warning signs (declining report rates, rising dismissal of warnings, growing password reuse) are visible well before the incident is.

Frequently Asked Questions

Dinesh Varma

Dinesh Varma is the Director of Business Growth & Strategy, MEA at Threatcop, with experience in cybersecurity consulting, business strategy, account management, and growth. He focuses on helping organizations understand evolving cyber threats and strengthen their security posture. His areas of interest include cybersecurity awareness, human risk management, phishing, social engineering, email security, and People Security Management, with a focus on building stronger organizational resilience against emerging threats.

Dinesh Varma

Dinesh Varma is the Director of Business Growth & Strategy, MEA at Threatcop, with experience in cybersecurity consulting, business strategy, account management, and growth. He focuses on helping organizations understand evolving cyber threats and strengthen their security posture. His areas of interest include cybersecurity awareness, human risk management, phishing, social engineering, email security, and People Security Management, with a focus on building stronger organizational resilience against emerging threats.