Are employees tuning out? The hidden cost of cybersecurity fatigue

By David C. Howell, regional sales director at ManageEngine South Africa

Cybersecurity Awareness Month reminds us that employees are central to an organisation’s defence. Yet when do password rules, multi-factor authentication (MFA) requests, phishing warnings, software updates, and AI policies stop building awareness and become background noise?

This is a pressing concern for South African businesses pursuing cyber resilience amid skills shortages, constrained resources, and increasingly complex hybrid environments. PwC’s Digital Trust Insights 2026 Survey, found that 63% of the country’s business and technology leaders include cyber risk investment among their top strategic priorities. Yet more controls do not automatically produce safer behaviour. Instead, they can contribute to cybersecurity fatigue.

What is cybersecurity fatigue?

Cybersecurity fatigue is the mental exhaustion and reluctance that can develop when employees face repeated security demands, frequent prompts, and generic warnings. Over time, this fatigue can lead employees to approve MFA requests on autopilot, click through updates, reuse passwords, or bypass security controls to complete tasks more quickly. As a result, important security guidance can become workplace wallpaper, leaving employees less alert to potential threats and creating opportunities for social engineering attacks.

The distinction between awareness and overload matters

Effective awareness involves building practical habits and risk judgement through clear guidance linked to real work. Overload involves flooding employees with generic modules, pop-ups, and competing priorities until cautious attention gives way to frustration, disengagement, and shortcuts. The objective should be behavioural change, not merely proof that another compliance box was checked.

The goal shouldn’t be to place the burden of cybersecurity entirely on employees. Within businesses, security teams should make the safe choice the easiest default by simplifying access through single sign-on or password managers, using adaptive MFA when the risk warrants it, automating routine patching, and filtering out low-value alerts. Contextual guidance at the point a decision is made is more useful than a long annual module detached from daily tasks.

This is also where technology architecture matters. ManageEngine’s work across identity and access management, unified endpoint management and security, and security information and event management highlights a broader principle: Integrated visibility and automation can move routine protection into the background, reduce fragmented tooling, and reserve human attention for meaningful risks. The lesson is not to add another product or prompt for employees but to design controls that support the way they work.

Security measures require a change in how businesses measure success

Measures of success should evolve. Failed phishing tests and policy violations reveal only part of the challenge and, when used punitively, can discourage employees from reporting genuine mistakes.

Businesses should consistently track how often suspicious messages or emails are reported, how quickly concerns are raised, whether approved tools and secure habits are adopted, and where controls repeatedly result in workarounds or shortcuts. Errors are valuable diagnostic feedback when they lead to private coaching and better programme design.

The rise of AI adds another layer of complexity

Employees must use approved AI tools, recognise when prompts contain customer or proprietary data, and verify that outputs are accurate and secure. Meanwhile, polished phishing messages and synthetic media make identity checks more difficult. Repeated shadow AI warnings certainly add to the noise, too.

According to Mimecast’s The State of Human Risk 2026 report, 69% of security leaders believe AI-powered attacks are inevitable within the next year, yet many businesses still lack comprehensive strategies to address these risks. The response should be better guardrails rather than more rules: for example, protected enterprise AI environments, automated checks for insecure code or questionable outputs, training on safe prompting, and contextual anomaly detection to flag unusual activity and trigger proportionate responses, such as additional verification, access restrictions, or human approval. Businesses should focus on consolidating alerts and only interrupt employees when human judgement is genuinely required.

Building cyber resilience without creating fatigue

Cybersecurity awareness remains essential, but its effectiveness depends on more than how often employees are reminded of potential threats. South African businesses need to move beyond a compliance-driven approach and focus on building sustainable security habits. This means simplifying security processes, automating routine controls, providing relevant guidance where it is needed, and creating an environment where employees feel comfortable reporting mistakes and suspicious activity without fear of blame.

Ultimately, reducing cybersecurity fatigue is a shared responsibility. Security teams must ensure that controls are practical, leadership must reinforce a culture of accountability, and employees must understand how their everyday decisions contribute to organisational resilience. By measuring meaningful behavioural change rather than simply counting completed training modules, businesses can strengthen their defences while keeping employees engaged. The goal is not to demand constant vigilance but to build a security-conscious culture where the safest choice is also the easiest choice.