A qualitative case study of cybersecurity fatigue and human-centric vulnerabilities in the SaaS sector

In the current digital landscape, cybersecurity threats and data breaches have escalated significantly, prompting modern organisations to increase investments in cybersecurity systems and infrastructure (IBM, 2024). To defend sensitive assets against these threats, organisations typically deploy increasingly stringent and layered cybersecurity controls, ranging from complex multi-factor authentication (MFA) to continuous compliance monitoring and mandatory security training. While these security measures are technically sound, their cumulative effect on the workforce is often overlooked. Specifically, these requirements can inadvertently place substantial cognitive and psychological strain on employees, leading to a negative phenomenon known as cybersecurity fatigue (Furnell and Thomson, 2009).

Cybersecurity fatigue is characterised by a state of mental exhaustion, diminished attention and eventual disengagement from security practices (Cram et al., 2021). Far from being a minor inconvenience, cybersecurity fatigue poses a systemic risk to organisations. When employees reach their psychological limits, they experience a breakdown in security awareness, which directly undermines the effectiveness of technical security controls and introduces significant human-centric vulnerabilities (Hull, 2017). Investigating and mitigating this issue requires a nuanced exploration of the cognitive and behavioural dynamics of employees under security strain. Despite this need, existing cybersecurity literature has historically treated the human factor as a mechanical link, providing limited qualitative insights into the cognitive, emotional and situational dimensions of cybersecurity fatigue and its real-world implications for employee behaviour (Glaspie and Karwowski, 2018; Nobles, 2022).

While prior behavioural security research has investigated the consequences of cybersecurity fatigue (e.g. Cram et al., 2021; Reeves et al., 2023, 2025) and proposed general models, such as the well-known four-component model of cybersecurity fatigue (Reeves et al., 2021), there is little known regarding its operational manifestation in specific, highly demanding workplace environments. In particular, how cybersecurity fatigue develops and influences behaviour within highly fluid, cloud-centric Software-as-a-Service (SaaS) organisations. SaaS environments present a high-pressure operational context:

• They operate under a continuous, real-time access paradigm where providers bear direct responsibility for safeguarding large volumes of sensitive client data (Rath et al., 2019).

• Their employees must navigate a complex, highly integrated Web of SaaS platforms and third-party tools, which requires constant, repetitive verification (Humayun et al., 2022).

• They are characterised by fast-paced environments, where workflow disruptions can directly impede core job performance, creating a tension between operational productivity and security compliance. Such conditions may increase employees’ propensity to bypass security policies to complete tasks, while time pressure reduces security-compliant behaviour (Gerdenitsch et al., 2023; Jiang and Zhang, 2023).

Consequently, general models of cybersecurity fatigue fail to capture the specific operational triggers and behavioural coping mechanisms that occur in the SaaS sector. This study addresses this research gap by providing an in-depth qualitative examination of how cybersecurity fatigue is triggered, processed and manifested behaviourally within a SaaS provider. It focuses on the intersection of operational SaaS workflows and employee behavioural compliance, posing the following research questions:

This paper is an extended version of research originally presented at the 19th IFIP WG 11.12 International Symposium on Human Aspects of Information Security and Assurance (HAISA 2025) (Norton et al., 2026). This journal version expands upon the original paper by strengthening the theoretical foundation, providing a more detailed account of the research design and presenting an enriched qualitative analysis incorporating newly analysed empirical data and participant quotes. The findings provide dual contributions in the topic area:

1. Theoretical contributions: We advance behavioural theory by contextualising the four-component model (Reeves et al., 2021) within a SaaS environment. We provide empirical evidence showing how specific factors like workflow disruption and cybersecurity decision overload translate directly into three discrete behavioural outcomes: abandonment of cybersecurity tasks, neglect of proper protocol and disengagement from training. We also contribute to theoretical boundaries by discussing the absence of advice-related fatigue in this operational context.

2. Practical contributions: We offer actionable, evidence-based recommendations for SaaS managers and CISOs. Rather than recommending simple increases in training volume, we outline concrete strategies for contextualising training with role-specific, real-world examples and streamlining security processes (such as automating access ticketing systems) to reduce daily frustration, mitigate cognitive overload and ultimately foster a resilient security culture.

The remainder of this paper is organised to systematically address the research questions. Section 2 reviews existing human factors in cybersecurity and establishes Reeves et al.’s (2021) four-component model of cybersecurity fatigue as the theoretical foundation. Section 3 details our interpretivist qualitative case study methodology, the purposive sampling strategy within the SaaS sector and the thematic analysis approach used to analyse our interview data. Section 4 presents our empirical analysis and findings, illustrating how work-flow disruption, decision overload, work overload and poor understanding of risk manifest in the daily experiences of SaaS employees. Section 5 maps these empirical findings to our proposed conceptual model, discusses the pathways of employee fatigue and details strategic security recommendations for organisations. Finally, Section 6 summarises our key findings and outlines opportunities for future research.

To understand the complex interplay between organisational security demands and individual employee behaviour, this study examines how cybersecurity fatigue manifests as a psychological and operational risk. Rather than viewing compliance failures as isolated acts of employee negligence, contemporary human factors research increasingly conceptualises non-compliance as a systemic out-come of cognitive, emotional and physical exhaustion (Glaspie and Karwowski, 2018; Pham et al., 2019; Nobles, 2022). This literature review establishes the theoretical foundation of our study by introducing the four-component model of cybersecurity fatigue (Reeves et al., 2021) and organising the underlying literature around the task-level, organisational and educational antecedents that drive fatigue-induced behaviours.

Over the years, numerous technical solutions have been developed to address cybersecurity vulnerabilities within organisations. However, while these solutions can mitigate certain risks, they are insufficient for preventing all security incidents. Increasingly, research suggests that the effectiveness of cybersecurity relies as much, if not more, on human behaviour (Hughes-Lartey et al., 2021; Moustafa et al., 2021).

As security demands become more complex, employees experience negative psychological effects, giving rise to a phenomenon known as cybersecurity fatigue. This term has been defined in various ways. Early recognition of the phenomenon conceptualised it in terms of effort and difficulty of security requirements and priorities of the individual and organisation (Furnell and Thomson, 2009). It generally refers to a state of mental exhaustion or disengagement from security practices, often resulting in employees neglecting or bypassing security protocols (Stanton et al., 2016). More specifically, cybersecurity fatigue is described as a form of work-related disengagement that pertains uniquely to security responsibilities (Reeves et al., 2021). This issue poses a growing threat to organisations, given that employees are frequently regarded as the most vulnerable point in the security chain (Acuña, 2016; Johnston et al., 2019; Hughes-Lartey et al., 2021).

While previous studies have highlighted the stressful nature of security compliance (D’Arcy et al., 2014; Ament and Haag, 2016) the four-component model of cybersecurity fatigue proposed by Reeves et al. (2021) provides the first comprehensive framework to categorise the diverse dimensions of security-related exhaustion. The model is structured along two primary dimensions: the sources of fatigue (action vs advice) and the types of fatigue (cognitive vs attitudinal).

Action-related fatigue arises when employees are continually required to perform tasks or make decisions to secure their organisational environment. The cumulative burden of continuous MFA requests, password updates and data-handling permissions generates high friction, leading to frustration, mental weariness and eventual fatigue (Pham et al., 2019; Cram et al., 2021; Robinson, 2023; Hsu et al., 2024). Studies report that such pressures have contributed to elevated stress levels and mental health concerns (ISACA, 2020; Sheridan, 2020). Despite being a widespread issue, limited research has examined how action fatigue interacts with technical cybersecurity solutions (Dykstra and Paul, 2018). When security-related responsibilities become overwhelming, employees may deprioritise compliance in favour of completing their primary job functions, increasing the risk of breaches (Bhana and Ophoff, 2023).

In contrast, advice-related fatigue stems from excessive, inconsistent or overly complex security guidance. While cybersecurity awareness initiatives can improve compliance, when organisations inundate employees with frequent, dense or conflicting instructions the resulting ambiguity diminishes employees’ sense of agency, inducing anxiety and disengagement (Ogawa et al., 2020; Bhana and Ophoff, 2023). When advice is unclear or contradictory, it diminishes employees’ sense of control and increases the likelihood of poor security behaviours (Reeves et al., 2021). Even well-intentioned awareness campaigns can contribute to fatigue if not well-coordinated and clearly communicated (D’Arcy et al., 2014; Davis et al., 2023).

With cognitive resources being finite, there is a limit to how much information employees can absorb and retain. Cognitive fatigue occurs when employees are overwhelmed by the volume of security-related information they are expected to process (Robinson, 2023). In many organisations, the complexity and length of security policies contribute significantly to cognitive overload. Employees frequently report difficulty processing dense or excessive content, resulting in disengagement (Cram et al., 2021). Under cognitive fatigue, individuals struggle to process security-critical information, rendering them more vulnerable to social engineering and prone to overlooking critical security warnings (Montañez et al., 2020; Reeves et al., 2021).

Attitudinal fatigue represents a deeper, more permanent shift in an employee’s emotional and psychological stance towards security (Reeves et al., 2021). If employees view security protocols as burdensome or unnecessary, they are more likely to become disengaged and non-compliant (Alotaibi et al., 2016; Robinson, 2023). A negative outlook can breed resentment and apathy, leading to resistance against established procedures and greater exposure to risk (Rocha Flores et al., 2014; Davis et al., 2023). Employees suffering from attitudinal fatigue may come to regard security measures as pointless, further exacerbating non-compliance (Reeves et al., 2021).

In this study, the four-component model serves as the direct theoretical lens for our qualitative inquiry. It informs the thematic structure of the interview guide (see Table 1) and provides the analytical categories for our thematic coding, enabling us to trace how real-world SaaS operational pressures map onto specific forms of employee exhaustion.

Organisational security measures are often designed under the assumption of perfect compliance, ignoring the operational environments in which employees operate. When security controls are overly intrusive, they disrupt natural work-flows and generate significant compliance friction (Herley, 2009; Stanton et al., 2016).

Modern security frameworks, such as zero-trust architectures, mandate continuous verification through repetitive access requests and rigid authorisation protocols. While technically sound, these measures introduce operational delays that slow business workflows. When compliance is perceived as excessive or unmanageable, employees are more likely to prioritise routine work tasks over security obligations – the resulting friction acts as a major driver of action-related and attitudinal fatigue (Bhana and Ophoff, 2023). This disruption creates a psychological trade-off, forcing employees to choose between strict security adherence and timely task execution (Stanton et al., 2016).

Continuous security interruptions, such as frequent MFA prompts, degrade employee focus and break cognitive flow. This may lead to sensory and behavioural desensitisation, whereby employees become less attentive to security threats and the behaviours intended to mitigate them (De Vos et al., 2017; Johnston et al., 2019). Over time, employees suffer from “habituation” where security alerts and authentication checks are processed less thoughtfully (Vance et al., 2018).

An employee’s cognitive and emotional capacity is not dedicated solely to security compliance but must be shared with their work obligations. Cybersecurity fatigue is therefore fundamentally compounded by broader organisational pressures and work overload.

Human cognitive resources are strictly finite. Within modern, high-pressure environments, employees experience a persistent dual-task conflict between their primary job duties (which carry clear performance incentives) and security compliance (which is often perceived as non-productive overhead) (Ament and Haag, 2016). When work-related deadlines and cognitive demands escalate, employees experience a divided attention effect. Under intense task pressure, cognitive capacity is entirely consumed by core operations, forcing employees to cognitively withdraw from security compliance to conserve mental bandwidth (Pfleeger and Caputo, 2012; Montañez et al., 2020).

Chronic work overload, characterised by excessive volumes of data processing, emails and meetings, depletes executive functioning and drives broader work-related burnout. When combined with rigid security compliance protocols, this dual burden can diminish work quality (Posey et al., 2011) and accelerates the onset of security burnout (Pham et al., 2019). This state of exhaustion results in perceived “laziness” or “workarounds”, where employees actively compromise security standards. Examples include using weak or slightly modified, passwords to reduce the mental effort required to navigate frequent system-enforced security demands (Bhana and Ophoff, 2023).

Non-compliant behaviour may arise from insufficient employee awareness of security requirements. While security education, training and awareness (SETA) programs are designed to mitigate human risk, poorly designed educational initiatives can inadvertently worsen security fatigue.

SETA programs are a primary tool for cultivating a security culture (Safa et al., 2016). However, many organisations deploy one-size-fits-all training that is overly generic, highly repetitive and disconnected from employees’ daily operational realities. Generic training programs frequently focus on compliance checklists rather than contextualised threat scenarios. Rather than enhancing competence, repetitive and non-relevant training imposes an unproductive cognitive load (Bhana and Ophoff, 2023). Employees quickly recognise that the training does not add value to their specific roles, prompting them to disengage (Reeves et al., 2023).

During training, employees are required to devote time and cognitive effort to understanding and applying the organisation’s information security measures (D’Arcy et al., 2014). These measures frequently involve complex technical terminology, which can be difficult to interpret (Hsu et al., 2024). Complexity may lead to confusion and increased stress (Tarafdar et al., 2007), and may contribute to cybersecurity fatigue and subsequent disengagement from learning activities.

A critical gap exists between basic security awareness (i.e. knowing a rule exists) and deep risk understanding with comprehension of the practical impact of a security failure (Nurse et al., 2025). Without a clear understanding of the underlying risk and practical, real-world consequences, employees perceive security measures as arbitrary, bureaucratic constraints (Bhana and Ophoff, 2023). Cultivating deep risk perception requires dynamic adaptation, real-world examples and interactive learning formats (such as simulated exercises or security workshops) that demonstrate how individual actions directly influence organisational and client information security (Hatzivasilis et al., 2020).

This study adopts an interpretivist research philosophy, reflecting its focus on the subjective experiences and perceptions of individuals. Aligned with a qualitative research strategy, the research is exploratory in nature, aiming to investigate cybersecurity fatigue among employees. Rather than seeking definitive conclusions, the study seeks to identify emergent ideas, patterns and themes.

The case organisation operates within the SaaS sector, a cloud computing model where service providers manage infrastructure and deliver software access via Web browsers (Palos-Sanchez et al., 2017). SaaS adoption has expanded rapidly, with approximately 70% of businesses currently using such platforms, and this figure is expected to reach 85% in 2025 (Howarth, 2024). Given the critical responsibility SaaS providers have in protecting client data, understanding employee cybersecurity behaviour within these environments is essential (Arce, 2020; Rahman and Pribadi Subriadi, 2022).

The data collected in this study reflects individual employees’ experiences and perceptions of cybersecurity fatigue and is therefore qualitative in nature. To elicit this subjective data, semi-structured interviews were used. The use of open-ended questions enabled participants to describe their experiences in their own words, while the semi-structured format allowed the interviewer to pursue emergent topics beyond the predefined research questions. This flexibility supported the identification of unanticipated themes relevant to cybersecurity fatigue.

An interview guide was used to ensure consistency across interviews. This was informed by the four-component model of cybersecurity fatigue and is described in Table 1. Each interview began with the interviewer introducing themselves, confirming that informed consent had been obtained and requesting permission to audio record the session. The interviewer then explained the purpose of the study, which was to examine the prevalence of cybersecurity fatigue within the organisation, the factors contributing to it, and its influence on employee behaviour and attitudes towards cybersecurity. The interview then proceeded with the guided questions.

The study used a purposive sampling strategy, which involves the deliberate selection of participants based on predefined characteristics relevant to the research objectives. Participants were selected from different departments within the case organisation to capture a range of experiences and perspectives related to cybersecurity fatigue. To protect participant anonymity, departmental affiliations are not disclosed, in accordance with employee requests.

Sampling across multiple departments was intended to enhance the diversity of experiences represented in the data, as employees within the same department may share similar cybersecurity responsibilities and regulatory requirements. Ethical approval for the study was granted by the educational institution of the researchers, prior to data collection. In addition, approval to recruit participants was obtained from the organisation’s managing director. Following this authorisation, employees were invited to participate in the study on a voluntary basis.

Data collection took place across a period of roughly ten weeks in mid-2024. The study involved eight participants selected from a range of departments to capture diverse perspectives. Participant experience at the organisation ranged from one to almost eight years, with an average of about three years. All participants held a tertiary qualification. The participants are summarised in Table 2.

Data analysis involves the systematic examination of collected data to identify patterns, relationships and underlying meanings relevant to the research objectives. In this study, thematic analysis was used to analyse the qualitative interview data. Thematic analysis is a widely used qualitative analytic method that focuses on identifying, analysing and reporting recurring themes within a data set (Braun and Clarke, 2006).

Thematic analysis is particularly well suited to qualitative studies that seek to explore participants’ experiences and perceptions, as it enables the researcher to capture both explicit and implicit meanings in the data (Clarke and Braun, 2017; Braun et al., 2019). Its flexibility allows it to be applied across a range of theoretical frameworks without requiring adherence to a specific epistemological stance, making it appropriate for exploratory research in applied domains such as cybersecurity. By enabling the identification of common and divergent experiences of cybersecurity fatigue, thematic analysis provides a robust framework for interpreting how organisational and individual factors influence employee attitudes and behaviours. Its transparency and structured phases of analysis also contribute to methodological rigour and trustworthiness in qualitative re-search (Nowell et al., 2017). The NVivo ^[1] Computer-Assisted Qualitative Data Analysis Software supported the coding and organisation of themes.

Security fatigue is defined as a specific form of work disengagement related to cybersecurity responsibilities (Reeves et al., 2021). This section presents the key themes identified in the study and their influence on cybersecurity fatigue among employees in the case organisation’s cloud computing environment. The primary contributing factors include workflow disruption, cybersecurity decision overload, work overload and poor understanding of risk. These were associated with secondary elements such as repetitive access requests, security checks overload, a lack of real-world examples and generic training. The study also examined how these factors impact employee behaviour, revealing that fatigue often leads to disengagement, neglect of protocol and abandonment of cybersecurity tasks, especially training.

Cybersecurity practices, while essential, can significantly disrupt employee work-flows. Repetitive access requests and frequent security checks were identified as key drivers of frustration and action fatigue, which is a form of exhaustion caused by repetitive or demanding actions (Pham et al., 2019; Cram et al., 2021; Reeves et al., 2021).

Security protocols requiring formal access requests, while effective in safeguarding sensitive data, often delay workflows. An example from the case organisation is that employees must submit formal access request tickets for sensitive information, replacing the informal, immediate approval process previously handled by managers. This system was introduced to reduce the risk of data breaches by ensuring that access is carefully reviewed and approved by the appropriate team. The process requires the employee to submit a formal access request or “ticket”, detailing the specific permissions needed. Once submitted, the ticket is assigned to the appropriate individual or team for review and placed in a queue. The request is then assessed and either approved or denied based on established criteria. While it enhances security by limiting access to authorised personnel, the process can take up to three days, causing delays for employees. Participants described these procedures as frustrating, particularly when approval took several days. One participant stated:

In this context, tickets refer to routine work tasks assigned to employees. Although the system may be effective in strengthening security, it can also have unintended negative effects on employee behaviour. This finding aligns with the concept of regulation and compliance overload identified in the literature, where mandatory security requirements contribute to frustration and cybersecurity fatigue. Such fatigue can lead to disengagement and encourage employees to seek ways to bypass established regulations (Bhana and Ophoff, 2023).

The requirement to submit access requests and wait for approval, as reported by employees in this study, reflects the characteristics of action fatigue. In some cases, this fatigue prompts employees to bypass regulatory and compliance procedures in an effort to complete their work more efficiently, as illustrated by another participant:

This example demonstrates how cybersecurity fatigue can lead employees to neglect established protocols. Within the proposed model, neglect of protocol is identified as a behavioural outcome of workflow disruption. Such behaviour increases organisational vulnerability to cyber-attacks and data breaches. Consistent with existing research, frequent interruptions caused by security measures can result in employee disengagement from cybersecurity practices (Glaspie and Karwowski, 2018), thereby heightening the organisation’s overall security risk.

In addition to submitting access requests, employees must complete various security checks during their workday, such as two-factor authentication (2FA).

While these measures are essential for safeguarding sensitive information, they can disrupt workflow, contribute to frustration and ultimately lead to fatigue. Participants explained how:

These disruptions contribute to cognitive fatigue, which occurs when employees reach the limits of their mental capacity to engage with security tasks (Reeves et al., 2021; Cram et al., 2021). This cognitive strain can lead to disengagement and decreased vigilance. Cognitive fatigue has been identified as a significant contributor to overall cybersecurity fatigue (Pham et al., 2019; Bhana and Ophoff, 2023). Similar to repetitive access requests, this links to regulation and compliance overload. An excessive number of security checks can not only intensify fatigue but also overwhelm employees, leading them to abandon tasks entirely. As a result, employees may begin to perceive cybersecurity requirements as obstacles to productivity rather than as protective measures.

Another source of fatigue stems from the burden of making constant security-related decisions. Some employees expressed anxiety and uncertainty, particularly around the fear of making a critical mistake:

Research shows that increasing the number of options, and having limited time, make decisions more difficult and frustrating (Haynes, 2009). This phenomenon has received little attention in security research, but is closely associated with uncertainty. Employees may be unsure about regulations they are expected to follow, which can contribute to increased stress and anxiety. This uncertainty is intensified by the awareness that mistakes can have serious con-sequences. Such conditions can lead to decision paralysis, where anxiety and hesitation result in poor or suboptimal decision-making (Yang et al., 2015). Consequently, employees may make incorrect security-related decisions, potentially exposing the organisation to an increased risk of cyber-attacks.

This pressure can result in minimal compliance. For example:

Such behaviour reflects attitudinal and action fatigue. When employees start to perceive security-related tasks, such as regularly updating passwords, as inconvinient or onerous, they may become less motivated to fully comply. Employees may do the bare minimum, for example by making only minor changes to an existing password, increasing the likelihood of security vulnerabilities and potential cyber breaches.

Work overload was another contributor to fatigue, leading to the dual-task conflict between operational productivity and security compliance (Ament and Haag, 2016). Employees reflected the need to prioritise job-related tasks over security obligations:

This quote illustrates that work overload does not only affect an employee’s attitude towards compliance but also drains their cognitive focus (“Where’s my attention?”), making genuine engagement with security training intellectually impossible under deadline pressure. Because organisations actively reward productivity and penalise missed deadlines, employees must divide their finite cognitive resources between these competing demands. Under high-pressure deadlines, an employee’s cognitive capacity is consumed by their primary work tasks, inducing cognitive fatigue and leaving little remaining mental capacity for secondary security compliance (Pfleeger and Caputo, 2012; Montañez et al., 2020).

This cognitive exhaustion may translate into attitudinal fatigue, where security training is resented as an obstructive, non-productive overhead. Consequently, employees abandon security training because the organisational incentives heavily favour operational output over security box-checking. This perceived work versus security trade-off increases the risk of oversight and reduces engagement with cybersecurity training and tasks (Pfleeger and Caputo, 2012). The example highlights the influence of top management in shaping employee attitudes towards security. Top management should use mechanisms such as perceived legitimacy, visible commitment and fairness to foster a strong security culture and guide appropriate behaviours (Hu et al., 2012).

A key insight from the research was the significant role that risk perception plays in employee engagement with cybersecurity. Without a clear understanding of the implications, employees are less likely to comply with protocols:

Research indicates that employees often show little concern about cyber-attacks or how to respond to them until they have personally experienced such an incident (Sun and Lee, 2016). This limited awareness is largely shaped by generic cybersecurity training and a lack of real-world examples that illustrate actual risks.

In the absence of concrete, sector-specific examples demonstrating how a single error can compromise sensitive data, employees may perceive security controls as arbitrary administrative barriers rather than essential safeguards for organisational and client security (Bhana and Ophoff, 2023; Nurse et al., 2025). Participants stressed the value of contextualising cybersecurity risks:

The incorporation of real-world examples enables employees to better appreciate the consequences of their actions and, in turn, encourages more meaningful engagement with organisational cybersecurity practices. However, example empirical data on cyber risks remains limited (Cremer et al., 2022). This is partly because many organisations that experience cyber incidents choose not to publicly disclose them (Eling and Schnell, 2016; Thomas, 2018). As a result, areas such as cybersecurity risk management are constrained by this lack of available data.

Despite these limitations, existing literature suggests that integrating real-world examples into cybersecurity training can significantly enhance organisational protection against cyber-attacks. Simulations and scenario-based exercises grounded in real incidents provide employees with practical, hands-on experience, which improves their understanding of cybersecurity risks and responses (Hatzivasilis et al., 2020). In contrast, the absence of such examples not only reduces employees’ comprehension of cybersecurity risks but also weakens their awareness of the potential consequences of non-compliant or insecure behaviour.

During the interviews, participants consistently reported that the cybersecurity training they receive is overly generic, which leads to disengagement with the material. Rather than providing meaningful, role-specific guidance, this training focuses on repetitive “common-sense” topics. A lack of context and explanation behind the training requirements were highlighted:

Much of the training focuses on topics such as identifying phishing emails — content many employees perceive as basic or already well understood, resulting in the belief that it adds little value. It appeared that employees do not perceive the training as excessive or overly complex, but rather as lacking relevance to their role:

Because this training fails to stimulate genuine cognitive engagement or offer new insights, it imposes an unproductive cognitive load on employees, who must dedicate time and effort to processing redundant information. This leads to cognitive fatigue, as employees find the repetitive material mentally draining (Reeves et al., 2023). Simultaneously, it fosters attitudinal fatigue by convincing employees that security training holds no practical value for their daily operational roles.

This perceived irrelevance contributes to low engagement, with some employees admitting to accelerating training videos simply to complete them. This was achieved by increasing playback speed or using browser extensions to speed up training content. Disinterest in training is a phenomenon existing literature links to repetition and lack of relevance (De Vos et al., 2017; Johnston et al., 2019) and may lead to potential negligence (Pham et al., 2019). While generic training may not directly cause fatigue, it does undermine engagement, reinforcing the argument that cybersecurity training cannot adopt a one-size-fits-all approach (Reeves et al., 2023).

Given the rapidly evolving nature of cybersecurity threats, disengagement with training risks creating knowledge and skill gaps that could expose organisations to cyber-attacks. Participants emphasised the need for contextualised, role-specific training supported by real-world examples to help employees better understand both the risks and consequences of their actions, e.g.:

The examples identified through the analysis illustrate the operational demands and workflow characteristics that contribute to cybersecurity fatigue among employees within the case study organisation. These findings address the first research question and are synthesised in a conceptual model presented in Figure 1. The model draws on elements from the four-component model by Reeves et al. (2021), specifically incorporating action-related fatigue, cognitive fatigue and attitudinal fatigue, which emerged as the primary contributors to cybersecurity fatigue among employees:

1. A key driver identified in the research was cybersecurity decision over-load, which was found to influence all three types of fatigue. The constant need to make security-related decisions led to mental exhaustion (cognitive fatigue), frustration with repetitive security actions (action-related fatigue) and the development of negative attitudes towards cybersecurity (attitudinal fatigue).

2. Workflow disruption also emerged as a significant factor, stemming from repetitive access requests and an overload of security checks. These frequent interruptions hindered productivity, manifesting action-related fatigue and resulting in attitudinal fatigue as employees grew increasingly frustrated with the intrusiveness of cybersecurity protocols.

3. Another contributing factor was work overload, which influenced cognitive and attitudinal fatigue. Within the SaaS organisation, employees frequently operate under dual-task conflict. Their cognitive capacity must be divided between primary, incentivised professional duties and other requirements. Employees often prioritised core work responsibilities over security-related tasks, perceiving cybersecurity measures as secondary or even obstructive, which negatively affected their cognitive focus and attitude.

4. The final factor identified was a poor understanding of risk, largely attributed to generic cybersecurity training and a lack of real-world examples. Without a clear grasp of the potential consequences of cyber threats, employees failed to see the value of security protocols. This lack of understanding contributed to a perception of cybersecurity as burdensome, reinforcing cognitive and attitudinal fatigue.

Our thematic analysis did not show evidence indicative of advice-related fatigue and thus this construct is not included in the proposed conceptual model. Prior literature attributes such fatigue to excessive, inconsistent or overly complex security guidance, resulting in confusion, anxiety and eventual disengagement (Ogawa et al., 2020; Reeves et al., 2021; Bhana and Ophoff, 2023). These dynamics were not evident in the context of our case organisation. Instead, the challenges identified were primarily linked to the generic nature of the training provided and the absence of real-world examples. Rather than experiencing fatigue, participants appeared disengaged due to a perceived lack of relevance to their specific roles and a limited understanding of the practical consequences of security failures.

The model also addresses the second research question, proposing how cybersecurity fatigue manifests in observable, non-compliant workplace behaviours. Three behavioural outcomes were observed:

1. Employees were found to abandon tasks due to security checks overload. For example, the frustration of repetitive authentication is connected to abandonment of the HR platform (“I have to do the whole 2FA. I’m like, stuff this, I do not need this information”).

2. Employees frequently deviated from established security protocols when these were perceived as impeding their work. For example, prolonged ticketing approval delays encouraged deliberate workarounds (“In practice, I tend to just bug people […] I need to do this to work, fix it”). Similarly, the requirement to change passwords every 30 days often resulted in superficial modifications, such as minor punctuation changes, rather than the adoption of substantially new passwords.

3. There was a clear disengagement from cybersecurity training, primarily resulting from training that was perceived as repetitive, generic and lacking relevance to employees’ specific roles (“I don’t think it adds much value, at least not for me”).

These fatigue-induced behaviours have significant implications for organisational security. By relying on unauthorised workarounds and disengaging from security training activities, employees inadvertently create human-centred vulnerabilities. This behavioural drift can undermine the effectiveness of otherwise robust security controls, generating knowledge gaps and procedural bypasses that increase the organisation’s exposure to accidental data breaches and external cyber threats.

By reinforcing the personal and organisational relevance of cybersecurity risks, companies can strengthen compliance and reduce the likelihood of fatigue-driven errors or negligence. A clear understanding of risk emerged as a potential solution to cybersecurity fatigue:

The more important a user perceives a security task to be, the less likely they are to succumb to fatigue, even if the task requires significant effort (Furnell and Thomson, 2009). A limited understanding of risk contributes to cybersecurity fatigue by leading employees to perceive security measures as unnecessary burdens rather than essential safeguards. When employees are unaware of the potential consequences of security breaches, they are less likely to recognise the value of complying with requirements such as security checks, access requests and training initiatives.

Bridging the gap between awareness and understanding, especially through real-world examples, can shift employee attitudes, foster a positive security culture and mitigate fatigue. One participant reflected:

Employees who understand the direct impact of their actions on organisational security, and their own responsibilities, are more likely to appreciate and comply with security protocols.

The findings suggest that enhancing employees’ understanding of cybersecurity risks is a key factor in fostering meaningful engagement with cybersecurity practices. One accessible and impactful strategy is to improve the quality and relevance of SETA. The research revealed that a major reason employees disengage from cybersecurity training is its overly generic nature. Therefore, tailoring SETA to specific roles is a critical first step in strengthening employees’ risk perception.

Further investigation is needed to determine which training elements should be adapted to increase relevance and engagement. A promising approach is the integration of real-world examples directly aligned with employees’ roles. This would make potential threats more tangible and relevant, thereby increasing the perceived value of cybersecurity protocols.

In addition, alternative delivery formats may enhance engagement. For ex-ample, in-person workshops, as suggested by one participant, could replace passive video-based training. Activities such as cybersecurity “war games” may encourage active participation by creating interactive learning environments that simulate real incidents. The social and collaborative nature of such workshops, especially when attended by peers and supervisors, can further boost motivation and accountability. Other innovative tools include the use of card games to raise awareness of social engineering attacks (Shostack, 2014; Beckers and Pape, 2016). These interactive methods not only improve knowledge retention and decision-making skills but also promote collaboration and a culture of shared responsibility (Aldawood and Skinner, 2019).

Another key recommendation is the simplification and acceleration of security processes. In our case organisation this can be tied to access request tickets. Delays in access approval, sometimes extending over several days, were shown to be a source of frustration, contributing to attitudinal fatigue and encouraging employees to bypass formal procedures.

Reducing the wait time for access requests could mitigate this frustration and increase adherence to protocol. When employees perceive security processes as efficient and reasonable, they are more likely to comply rather than seek informal workarounds, such as requesting favours from colleagues. This shift in behaviour would strengthen organisational security and reduce the risk of unauthorised access, ultimately supporting a more resilient cybersecurity culture.

This study explored the factors contributing to cybersecurity fatigue among employees in a cloud computing organisation and examined how these factors influence employee behaviour. However, several limitations must be acknowledged. The research was conducted over a short timeframe and focused on a single case study. The concepts of generalisability and saturation are frequently debated in interpretivist qualitative research and are not the aims of our study. Accordingly, we do not claim to have achieved them. Braun et al. (2019) suggested that a small, focused study involving a relatively homogenous sample may be appropriately conducted with as few as five or six interviews. Although eight participants were interviewed a larger sample size could provide deeper insight into the phenomenon. Future research could expand the scope by including multiple organisations across different industries and adopting a longitudinal design to enhance data quality and capture changes in employee experiences over time. Using a quantitative approach in these investigations would support broader generalisability and comparative analysis.

This study investigated the causes and behavioural impacts of cybersecurity fatigue among employees of a cloud computing provider, an area that has received limited attention despite the increasing reliance on SaaS operations. The findings identified four main contributors to cybersecurity fatigue: cybersecurity decision overload, workflow disruption, work overload and a poor understanding of risk. Frequent and critical security decision-making, repetitive processes (such as access requests and 2FA), and the prioritisation of work deadlines over security tasks all contributed to fatigue and frustration. In addition, generic training and a lack of real-world context diminished employees’ understanding of cybersecurity risks, reinforcing negative attitudes towards security protocols.

The study also uncovered three key behavioural outcomes: abandonment of security tasks, neglect of proper protocol and disengagement from training. These behaviours increase organisational vulnerability to cyber threats. In response, we recommend two strategies: implementing contextualised, role-specific training using real-world examples and streamlining security processes to reduce delays and workflow disruption.

Future research should further investigate attitudinal fatigue, a key contributor to cybersecurity fatigue identified in this study. When employees perceive cybersecurity measures as irrelevant or burdensome, their negative attitudes can lead to disengagement and non-compliance, increasing organisational vulnerability to cyber-attacks. The conceptual model offers a foundation for exploring how to design more engaging, role-relevant training programs that promote positive employee attitudes towards cybersecurity. In addition, the model could be integrated into behavioural analytic systems to monitor employee engagement and identify points where disengagement occurs, guiding targeted interventions.

The authors thank the case organisation and its employees for their participation in this study. This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.