TL;DR: People are surrounded by competing demands for their attention, and when cyber security advice arrives as another interruption in an already crowded working day, even sensible guidance can become background noise.
Cyber Security Advice Fatigue: Why People Stop Listening
There are few people in modern working life who need reminding that cyber security exists. They’ve received the emails, worked through the training and heard about phishing, passwords, MFA, suspicious links, data handling and software updates, with reminders to remain vigilant arriving often enough to become part of the rhythm of working life.
Meanwhile, there’s a presentation to finish, a customer to answer, a deadline approaching and a project that needs moving along. People are continually being pulled between competing demands, with every application, notification and meeting asking for another fragment of their attention. Cyber security enters that crowded environment carrying its own set of instructions, cautions and things to remember.
This is where the idea of cyber security advice fatigue becomes useful. A 2023 study published in Computers & Securitydeveloped a measure of cybersecurity advice fatigue and found that the content, style and design of security advice influenced how employees responded to it. Their perceptions of why an organisation was providing that advice also shaped their receptiveness.
The uncomfortable part of the problem is that security advice can be perfectly sensible and still struggle to get through. People encounter it while they’re working, making decisions and trying to maintain momentum, so the question becomes less about whether they’ve been told what to do and more about whether the guidance has any chance of influencing what they do next.
When security competes with getting the job done
Attention is already under pressure. People move between email, instant messaging, meetings, customers, colleagues and a growing collection of digital tools, continually deciding what deserves their attention now and what can wait until later.
A security warning might ask someone to stop and check something carefully while their calendar is already running behind, a customer is waiting for an answer and a deadline is closing in. Every part of that situation carries a legitimate demand, which is why secure behaviour can become difficult when it’s presented as another task to fit into an already crowded day.
Research has found that work pressure can influence employees’ willingness to violate information security policies when they believe doing so will help them complete their responsibilities. The behaviour can carry genuine security risk while the motivation remains remarkably ordinary: someone is trying to get their work finished.
This creates a useful distinction for security teams. People aren’t making decisions in a laboratory where security is the only variable; they’re making them in the middle of their working lives, with productivity, relationships, deadlines and expectations shaping what seems practical in the moment.
When security starts to feel like friction
There are plenty of situations where security needs to slow things down. Checking an unusual payment, investigating a suspicious message or seeking approval for sensitive activity can all be appropriate responses, particularly when the consequences of getting the decision wrong are significant.
The difficulty comes when every security interaction carries the feeling of another hurdle. The UK Government’s cyber security research has identified tensions between security requirements and wider business priorities, while the National Cyber Security Centre has emphasised understanding how people actually work and designing security approaches around that context.
People will continue to have deadlines, customers and responsibilities while security policies are being applied. They’ll make decisions under pressure, often with incomplete information and limited time, which means security has a much better chance of influencing behaviour when it fits the conditions in which that behaviour takes place.
More advice can become less useful
The instinct to respond to risk with education is understandable. A new threat appears and an email goes out; a new phishing technique emerges and the training is updated; someone makes a mistake and a reminder reaches the wider organisation.
Each message can make sense individually. The difficulty appears over time, as sensible guidance accumulates alongside everything else competing for attention. The inbox becomes a record of good intentions, with one warning sitting alongside another until even useful messages begin to resemble workplace wallpaper.
Research into cyber security advice fatigue has found that confusing, contradictory and overly complicated guidance can contribute to negative perceptions of security programmes. Other research has suggested that information security ignorance can sometimes emerge as a response to feeling overwhelmed by the volume of information available.
That leaves security teams with a more interesting problem than simply producing better advice. They have to consider the conditions under which people are expected to receive it, remember it and eventually act on it.
People are trying to make progress
Most people are thinking about the task in front of them while they’re trying to close a deal, resolve a customer problem, finish a report or move a project forward. Progress is tangible; it has a deadline, an owner and usually someone waiting for the outcome.
Security can feel more distant from that immediate sense of progress. If the secure route takes several minutes while the convenient route takes thirty seconds, the decision can look very different to someone working under pressure, particularly when the person believes they understand the risk well enough to make a quick judgement.
Research into security behaviour repeatedly points towards the importance of context. Employees make decisions within systems, relationships and working environments, with security advice competing against the demands already present in those environments.
The person at the keyboard is therefore dealing with several priorities at once. Effective security awareness has to meet people within that reality, giving them something useful at the point where a decision is actually being made.
The value of saying something at the right moment
Consider the difference between receiving a general warning about invoice fraud on a Monday morning and receiving a short piece of guidance while you’re about to approve an unfamiliar invoice.
The information could be almost identical, yet its usefulness could be dramatically different. In the second situation, the person is already considering the relevant decision, their attention is directed towards the problem and the guidance has an immediate purpose. It can help them interpret what they’re seeing while there’s still time to change course.
That’s the strength of contextual learning. It connects the lesson with the behaviour, giving people a reason to engage with the information because it relates directly to something they’re doing.
The NCSC’s work on cyber security culture similarly emphasises understanding how people interact with security in practice and adapting interventions to the context of the organisation and its people.
This is where the shape of security awareness starts to change. Instead of continually asking people to step away from their work to learn about security, the learning can begin to appear within the work itself, at the moments when it has the greatest relevance.
A more human way to think about awareness
This is the thinking behind Redflags, where learning in context, microlearning and real-time intervention are brought together around the decisions people are already making.
If someone encounters a suspicious message, the useful moment for learning is often right there. If a risky action is about to happen, guidance delivered at that point has a natural connection to the behaviour. If someone makes a mistake, the experience can become an opportunity to build understanding while the circumstances are still fresh.
That approach also gives security teams a richer picture of where people need support. Awareness becomes connected to behaviour, rather than existing primarily as a collection of modules completed at predetermined intervals.
There is something more ambitious in that shift than simply making training shorter. It changes the role security plays in the working day, moving it closer to the decisions people make and the pressures that shape those decisions.
People will continue to work quickly, juggle competing priorities and make judgement calls with imperfect information. Security has a better chance of becoming part of that environment when its guidance arrives with context, relevance and enough restraint to earn attention.
The future of security awareness may therefore have less to do with finding new ways to tell people more, and more to do with understanding when people are most able to hear, absorb and use what they already need to know.
Key takeaways
-
Attention is finite. Cyber security competes with the wider demands of modern working life.
-
Security can create friction. Repeated interruptions can influence how people experience security during their working day.
-
Advice fatigue is real. Confusing, repetitive or poorly designed guidance can reduce receptiveness to security messages.
-
Context changes the value of information. Guidance delivered alongside a real decision can be easier to understand and apply.
-
Timing can shape behaviour. Advice has greater practical value when it reaches people while they can still act on it.
-
Security awareness can live within the work itself. People-centred approaches such as contextual learning, microlearning and real-time intervention can bring security closer to everyday decision-making.
