Figure 1.
The flow begins with security checks overload, repetitive access requests, lack of real-world examples, and generic training. Security checks overload leads to abandonment of cybersecurity tasks and neglect of protocol, while repetitive access requests also lead to neglect of protocol. Generic training leads to disengagement. Security checks overload then leads to workflow disruption, while repetitive access requests also contribute to workflow disruption. Lack of real-world examples and generic training lead to poor understanding of risk. Next, workflow disruption leads to action-related fatigue and attitudinal fatigue. Cybersecurity decision overload leads to action-related fatigue, attitudinal fatigue, and cognitive fatigue. Work overload leads to attitudinal fatigue and cognitive fatigue. Poor understanding of risk also leads to attitudinal fatigue and cognitive fatigue. Finally, action-related fatigue, attitudinal fatigue, and cognitive fatigue converge on cyber security fatigue.Conceptual model of cybersecurity fatigue
Source: Authors’ own work