Cyber Fatigue Defined in Plain Terms
Cyber fatigue is the weariness that sets in when the demands of staying secure outpace a person’s capacity to meet them. In staff it shows as security fatigue, the point where people stop reading warnings, reuse passwords and approve prompts without thinking. In security teams it shows as alert fatigue, a numbness to the flood of alarms they face.
Cyber fatigue is a predictable response to overload and attackers rely on it. About 60 percent of breaches involve a human element, according to Verizon’s 2025 Data Breach Investigations Report and fatigue is one of the quiet reasons that human link keeps failing.
Every new tool, policy and multi-factor prompt adds to the load. When the load passes what a person or a team can carry, the secure choice becomes the one nobody has energy left to make.
How Cyber Fatigue Builds
Cyber fatigue is rooted in decision fatigue. In 2016 researchers at the National Institute of Standards and Technology interviewed around 40 ordinary computer users and found an overwhelming sense of weariness toward security. Asked to make more security decisions than they could manage, people slid into resignation, loss of control, fatalism and decision avoidance.
The result is risky behaviour that feels rational in the moment. People reuse a password, pick the easiest option, click through a warning or approve a prompt to make it stop. NIST called this security fatigue and pointed to a simple cause, too many decisions and too little feedback when people get them right.
Security teams reach the same wall from the other side. Tool sprawl generates far more alerts than any team can read. In a 2022 University of Oxford study, SOC analysts described the overwhelming majority of their alarms as false positives which is how the paper earned its title, “99% False Positives”. After enough false alarms, analysts stop trusting the alerts.
The load has grown. More cloud apps, remote work, stricter rules and more multi-factor prompts all add decisions for staff while thinly staffed security teams face rising alert volumes. The demands went up faster than anyone’s capacity to absorb them.
The Two Faces of Cyber Fatigue
Cyber fatigue wears two faces, one in the people using your systems and one in the people defending them. They feed each other and a single attack technique sits in the middle.
- Security fatigue: Staff grow weary of passwords, updates and warnings so they reuse credentials, delay patches and click through prompts to move on.
- MFA fatigue, also called push bombing: An attacker who already has a password floods a user with multi-factor approval prompts until one is approved. CISA describes it as bombarding a user until they approve by accident or annoyance.
- Alert fatigue: Analysts face more alerts than they can investigate so they deprioritise, mute or dismiss them and real threats slip through the noise.
- Update and patch fatigue: Constant update prompts get postponed leaving known vulnerabilities open for longer.
- Training fatigue: Generic, repetitive awareness modules stop landing so staff click through them without learning anything.
The Business Impact of Cyber Fatigue
Fatigue rarely appears on an incident report by name but it shapes the outcome. Its costs fall into a few clear buckets.
The first is missed detection. When analysts are numb to alarms, a real alert can sit unread while an attacker moves. The Target breach in 2013 is the textbook case, covered below, where the warnings fired and nobody acted.
The second is account takeover. MFA fatigue turns a stolen password into a full compromise as it did at Uber in 2022 because one worn-down approval is all an attacker needs.
The third is slower response and burnout. Teams drowning in false positives take longer to find the real thing and the churn is real. Replacing a trained analyst is expensive and every departure takes hard-won context out of the door.
The fourth is wasted investment. Target had spent 1.6 million dollars on the system that caught the attack and then did not act on what it reported. A tool nobody has the capacity to act on still has to be paid for and so does the cleanup when its warnings are missed.
The last is regulatory exposure. If fatigue slows detection, the clocks in NIS2 and GDPR start running on a breach you have not noticed yet.
Real-World Cases
Two breaches show the two faces of fatigue, one in a user and one in a security team.
Uber, 2022: One Approved Prompt
In September 2022 an attacker logged in to Uber using an external contractor’s stolen corporate password likely bought on the dark web after malware infected the contractor’s personal device. Each attempt sent a multi-factor approval prompt to the contractor’s phone.
The contractor denied them at first. The attacker kept the prompts coming and then messaged the contractor on WhatsApp posing as Uber IT and claiming that approving one would make them stop. Worn down, the contractor approved a request and the attacker was in. Uber said the intruder reached internal systems including Slack and a finance tool and linked the activity to the Lapsus$ group.
Number matching would have broken it. Forcing the contractor to type a number shown on the login screen means a blind tap cannot approve anything, and phishing-resistant keys remove the prompt altogether. Alerting on a burst of denied prompts would have flagged the attack while it was still failing.
Target, 2013: The Alerts Nobody Acted On
Before the 2013 holiday season Target had installed a 1.6 million dollar malware-detection system. When attackers planted their code in late November, the system did its job and raised alerts which the monitoring team in Bangalore escalated to the security operations centre in Minneapolis.
Then the alarms sat. A US Senate Commerce Committee analysis later found Target failed to respond to multiple automated warnings and missed several chances to stop the attack. Around 40 million payment-card records and about 70 million other customer records were taken. A separate retailer, Neiman Marcus was reported to have generated roughly 60,000 alerts of its own during a breach the same year.
The lesson is not more alerts. It is fewer, higher-quality ones with the tuning and staffing needed to act on the few that matter. An alarm that no one can answer is the same as no alarm at all.
Cyber Fatigue and Compliance
Fatigue is not only an operational risk. Several regimes now expect the monitoring, reporting and training that fatigue quietly erodes.
NIS2 and Cybersäkerhetslagen: Sweden’s NIS2 law, Cybersäkerhetslagen (SFS 2025:1506), has been in force since 15 January 2026. It requires incident handling under Article 21.2b and security awareness training under 21.2g alongside the continuous monitoring these measures depend on with incident reporting to MCF (formerly MSB) under Article 23 on a 24-hour, 72-hour and one-month cascade. Under Article 20 the board is accountable so a missed alert is a governance problem as well as a technical one. See our guide to NIS2.
DORA: For financial entities, the Digital Operational Resilience Act requires ICT incident management and timely reporting under Article 17 supervised by Finansinspektionen. Detection has to work even on a tired Tuesday. Read our DORA compliance overview.
GDPR: Article 33 gives you 72 hours to report a personal-data breach to IMY. Fatigue-driven delay in noticing a breach eats into a clock that is already short. See GDPR compliance.
ISO 27001: The standard expects a managed information security system and ongoing awareness, both of which depend on people and teams who are not running on empty. See ISO 27001.
How to Spot Cyber Fatigue
You can see fatigue before it causes a breach, if you know the tells. They show up in staff and in the security team.
In your people, watch for:
- Passwords reused across systems or written down to avoid remembering them.
- Warnings and consent prompts clicked through without being read.
- Multi-factor prompts approved reflexively even unexpected ones.
- Workarounds and shadow tools that skip a step people find tiring.
In your security team, watch for:
- A growing backlog of alerts that no one has investigated.
- Detection rules muted or switched off to quiet the noise.
- Rising time to acknowledge and triage a new alert.
- Analyst absence, disengagement and turnover.
Spotting fatigue is not the same as fixing it. If the honest answer is that people are overloaded, the fix is to cut the load, not to ask them to try harder.
How to Reduce Cyber Fatigue
Reducing fatigue means building a system that asks less of people and surfaces only what matters. Work across people, process and technology.
Start with your people:
- Cut the number of security decisions staff face, the single fix NIST recommended.
- Deploy phishing-resistant multi-factor authentication such as FIDO2 keys or passkeys so a person is not the last line of defence.
- Replace generic training with short, role-based security awareness training that fits the real job.
Fix the process:
- Tune detections and cut false positives so the alerts that remain are worth reading.
- Automate triage for low-value alerts and reserve people for real decisions.
- Alert on a burst of denied multi-factor prompts, a reliable sign of push bombing.
- Where in-house capacity runs out, use managed detection and response so analysts are not drowning.
Set up the technology:
- Turn on number matching wherever push-based multi-factor stays in place as CISA advises.
- Consolidate overlapping tools to shrink the alert firehose at the source.
- Move high-value accounts to passkeys and remove the approval prompt entirely.
Pick the change that removes the most decisions for the most people and start there.
