# Security Fatigue: A Case Study of Data Specialists

Anusha Bhana, Jacques Ophoff

► To cite this version:

Anusha Bhana, Jacques Ophoff. Security Fatigue: A Case Study of Data Specialists. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.275-284, 10.1007/978-3-031-12172-2_22. hal-05324944

HAL Id: hal-05324944

https://inria.hal.science/hal-05324944v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Security Fatigue: A Case Study of Data Specialists

Anusha Bhana<fnref n="1" /> and Jacques Ophoff<fnref n="1" />,<fnref n="2" />✉

**Abstract.** Due to the number of data breaches occurring worldwide there is increasing vigilance regarding information security. Organisations employ a variety of technical, formal, and informal security controls but also rely on employees to safeguard information assets. This relies heavily on compliance and constantly challenges employees with security-related tasks. Security compliance behaviour is a finite resource and when employees engage in cost-benefit analyses that extend tolerance thresholds, security fatigue may set in. Security fatigue has been described as a despondency and weariness to experience any further security tasks. This study used a case study approach to investigate employee security fatigue, focusing on data specialists. Primary data was collected through semi-structured interviews with 12 data specialists in a large financial services company. A thematic analysis of the data revealed several interlinked themes that evidence security fatigue. Awareness and understanding of these themes can help organisations to monitor for this and tailor security activities, such as security education, training, and awareness for increased effectiveness.

**Keywords:** Information security · Security fatigue · Data specialist

## 1 Introduction

Employees can be seen as barriers but also facilitators of information security. However, creating a security-minded workforce is a persistent challenge. When organisations place policies and procedures at the forefront of their security efforts this can have a negative impact on employees. In such environments employees often face an array of complex security requirements which are difficult to understand and satisfy [7]. Such potentially unrealistic demands may even lead to experienced employees, with good technical skills, struggling to keep up.

Confronted with security-related workload and cognitive demand an employee may experience increased psychological stress, leading to a chronic state of exhaustion [5]. Furthermore, this exhaustion is a core component of

<footnote n="1">¹ University of Cape Town, Cape Town, South Africa
BHNANU002@myuct.ac.za</footnote>

<footnote n="2">² Abertay University, Dundee, UK
j.ophoff@abertay.ac.uk</footnote>
fatigue. Faced with information security stress and fatigue, employees may start to use coping behaviours. These behaviours are often analysed in the context of behavioural frameworks [6,7].

It is also argued that fatigue can lead to employees constantly performing cost-benefit calculations, choosing to accept certain risks to achieve important work goals [15]. If countermeasures are implemented to reduce employees' risky behaviours this can lead to a vicious circle: security policies and procedures → employee fatigue → risky behaviour is displayed → additional policies and procedures, etc. [10]. Wilde [18] suggests employees will weigh the expected benefits of risky behaviour against the costs and determine the level of risk they are willing to accept.

This study explores how security fatigue manifests and affects employees with increased responsibility for sensitive information. In particular the focus is on data specialists, who transform raw data into information. Understanding these factors could assist organisations in creating ‘employee-friendly’ policies and procedures, choosing appropriate technical security solutions or tailoring security education, training, and awareness activities. This study follows a case study approach, focusing on data specialists in a large financial services company. Primary data is collected through semi-structured interviews with 12 participants and analysed using thematic analysis.

The rest of the paper is structured as follows. First, a literature review provides contextual background on security fatigue and related concepts. This is followed by a description of the research design, including the case organisation and participants. Thereafter the results of the thematic analysis and findings are presented. Finally, the paper concludes by discussing the limitations of this study, along with opportunities for further research.

## 2 Literature Review

Employees are regularly reminded about security, for example with daily messages to be cautious while performing any online activity. This hyper vigilance can have a potentially detrimental impact on the individual, resulting in a level of despondency. Over time this manifests as weariness and in this context is described as information security fatigue. According to Furnell [8, p. 1], “The term security fatigue recognizes the situation in which users of systems and staff in organizations can tire of dealing with security or encountering messages and warnings in relation to it.”

Although fatigue cannot be empirically measured it may be expressed through several factors, such as effort, difficulty, and importance. Effort is described as the energy spent to achieve compliance. Difficulty describes the quantity of energy expended to provide the required effort. Importance is the priority assigned to the compliance task [9]. While fatigue is not a new construct, the appearance of security fatigue has increased in prominence.

Furnell and Thomson [9] describe this as breaching a threshold; becoming weary and desensitised, where compliance becomes too difficult and burdensome. This is the point security fatigue sets in. Stanton et al. [16] describe fatigue as
a reluctance to see or experience any more of something. Security fatigue is one cost that users experience when facing constant security messages, advice, and demands for compliance. This cost often results in what security experts might consider less secure online behaviour. Hatashima et al. [10] describe fatigue as a human experience when faced with multiple external actions to mitigate security risk.

## 2.1 Security Complexity and Fatigue

Security fatigue may manifest in a number of ways. Frequent security decisions, information overload, complexity, and uncertainty may lead to employee stress and consequent information security policy violations [6]. Oto [13] proposes that employees will simply stop making unnecessary decisions. Should they choose to make a decision, it will be the simplest option driven by immediate needs. This irrational behaviour is driven by feeling a lack of control and general apathy, which potentially increases stress.

Internal and external stressors deplete cognitive resources triggering fatigue. Security-related stress includes innocuous and common stressors, such as repetitive security tasks, but also more serious events such as security breaches. Events particularly intensifying fatigue are unclear security tasks and requirements contrary to job expectations. Stress and emotional reactions have been shown as predictors of information security policy compliance [7]. Failure by employees to adhere to such policies can cause security risks to the organisation. It is argued that when employees are overwhelmed by security messages and exhausted with the effort required to keep information safe, they are likely to ignore concerns raised by the organisation [2].

## 2.2 Managing Security Fatigue

To protect information and systems organisations implement measures such as security policies and procedures, as well as security education, training, and awareness to encourage employees to adhere to security practices [14]. To understand the extent of adherence Beautement et al. [2] introduced the concept of a compliance budget, to be used as one would a financial budget. Here the costs and benefits of security compliance are managed and understood. This constant iterative process takes its toll on the user resulting in the depletion of their compliance budget and security fatigue setting in. However, it is likely that security compliance is a much more complicated phenomenon, stemming from the lived experiences of individuals [12]. Shared viewpoints about security compliance may exist amongst employees, which need to be understood to effectively manage security fatigue.

# 3 Research Design

The core of this study is to explore the human experience. The study of security fatigue and risk tolerance are human experiences and are therefore well-suited to
an interpretivist paradigm. Taylor et al. [17] state that an interpretivist paradigm aims to understand how the world is experienced through an individual's lens. This creates a personal reality, often driven by the desire to understand social phenomena through forming meaningful ideas, feelings, and emotions.

To develop a thorough understanding of the topic a case study approach was adopted. The case in this instance refers to a group of employees within an organisation where the topic was studied. Yin [19] advocates for this strategy when the researcher has no control over the behavioural events and the focus is contemporary.

## 3.1 Case Organisation and Participants

Alohali et al. [1] notes data management as a key component in information security. With the introduction of data protection legislation covering most countries across the world, there is an increased focus on ensuring information security and legal compliance. To comply with legislation organisations must adhere to strict security protocols and processes. This responsibility may weigh heavily on data specialists and increases the stress placed on those working with sensitive information.

The case organisation is a large financial services company based in South Africa, with a footprint in the rest of Africa. Leveraging information as an asset has increased in strategic importance for the organisation, and there is core team of dedicated specialists supporting the data function. Key positions were created to drive this initiative, such as Head of Data, Head of Data Governance, and Head of Data Acquisition. Another significant appointment was the first Chief Information Security Officer (CISO). Alongside this appointment the information security community in the organisation has grown, focusing efforts on ensuring information security compliance. This is a multi-faceted approach which include security awareness campaigns. With the increased pressure for organisational legislative compliance employees are fully aware of information security requirements. The organisation is thus relevant, both in terms of processing large volumes of sensitive information as well as implementing strict security protocols that could lead to employee security fatigue.

Participants in this study represented both technical and business roles, such as Database Administrator, IT Manager, Senior Analyst Programmer, Senior BI Developer, Data Engineer, (Senior) Business Analyst, and BI Manager. Participants included nine males and three females, and had extensive experience in mid- to senior-specialist roles.

## 3.2 Data Collection and Analysis

A purposive sampling technique was used to target employees in various data specialist roles with a propensity to experience security fatigue. This approach is often employed when working with a small sample (as in case study research) and allows the researcher to choose cases that are particularly interesting and informative. For this study semi-structured interviews were conducted with 12 par-
ticipants. Interviews followed a consistent format to ensure repeatability across
the study [19].

Thematic analysis was used to analyse the interview data. Prior to analysis the recorded interviews were transcribed and captured in the NVivo computer-assisted qualitative data analysis software. Care was taken to ensure the data was fully anonymised and appropriately stored for analysis. Thematic analysis followed the six-step approach recommended by Braun and Clarke [4], which allowed the discovery of themes and patterns in the data.

# 4 Analysis and Findings

This section presents four general themes that emerged from the thematic analysis, which include: awareness of risks to sensitive information; the influence of compliance effort with security requirements; the influence of psychological stress; and, the adequacy of knowledge.

## 4.1 Awareness of Risks

The participants have access to highly confidential information, including customer banking details, income details, medical history, and contact information. When asked about the level of comfort they have with access to such information, the general feeling is one of ease. Participants appeared desensitised to the highly sensitive nature of the information they have access to. They are familiar with the information and do not perceive any risks in having access to it.

A level of unease sets in when participants are called upon to share this information with other parties. Being unfamiliar with the recipient and process increases tension and stress. When asked about sharing information participants do not display a similar confidence as when the information is within their domain of control. Concerning any new situation which is unfamiliar, P4 stated: "*But something new, I don't know how to handle it or the polices and controls around it, then may be I would panic...*"

The severity of any data breach originating in the area where these participants work is extremely high. While participants take on the responsibility to secure information there is a growing concern about data breaches. P12 stated: "*We deal with data, the value of data, we know what happens if a data breach happens. So here it's me who really understands what happens if we have a data breech. It's my responsibility to make sure that the organisation has proper standards and ensure execution to make sure the data is secure.*" Most participants had an opinion on how information security should be managed, because while policies are in place, there is no clear guidance on how to execute this, which leads to frustration. P6 explained: "*In terms of actually securing data they haven't specifically given us tools to do so.*" Data specialists often created awareness themselves, as P2 explained: "*... we try to enforce and create awareness in our team because we are the ones sitting with most of the data in the organisation.*"
**Summary of the Awareness of Risks to Sensitive Information.** While the task of managing information should be routine to the participants, the increased security consciousness in the organisation has left participants fearful and unsure whether security processes are sufficiently followed. Participants value security and want to do the right thing but perceived a lack of clear guidance, standards, and tools, which increased security fatigue.

## 4.2 Influence of Compliance Effort

Compliance effort is the energy spent in fulfilling security requirements. This is associated with a cost-benefit analysis, where employees will weigh up the benefits of complying versus the costs of non-compliance. Participants' compliance effort were viewed in the context of: decisions driven by immediate necessity, the use of practical password practices, and choosing the user-friendly option.

**Decisions Driven by Necessity.** All participants displayed a high commitment to complying with security protocols. As custodians of information, they are fully aware of the need for compliance, but when security related tasks become burdensome and a barrier to their productivity, participants will forego compliance in favour of progressing efforts to achieve goals. For example, P1 admitted to making use of another employee's account to gain access to systems. The security process to get access in the organisation is not efficient, requiring layers of paperwork and approvals. P3 explained that tasks are often abandoned after attempting to log into a system "... because it is such a mission to go and email them [IT] and wait for it."

While access can be circumvented, or in some cases abandoned, the sharing of sensitive information via email is a decision taken regardless of the punitive measures the employee is likely to face if there is a data breach. P2 explained: "We still had reports with ID numbers ... emailing data is part of the norm, however password protecting it is something that we changed." Participants are aware of information security compliance regulation and agreed knowing the POPIA regulation to some degree. However, they often choose to share unsecured sensitive information to ensure business continuity.

**Practical Password Practices and Choosing the User-Friendly Option.** It was noted that the organization has multiple layers of security. Employees must navigate both physical security measures and systems with multi-factor authentication and other security measures. When questioned about password creation and management participants revealed a few mechanisms employed to reduce cognitive demand. This includes repeating passwords, keeping password creation to the minimum system requirement and keeping a written copy of passwords. For example, P5 used the minimum system requirements to create passwords, with the rationale that the administrators believe this is as stringent as they require the password to be to access the system. P11 provided insight into the rationale as to why keeping simple password algorithms work: "Having a
login profile and a password for so many devices and applications is very painful
and to remember all of them is a nightmare ... that's why I keep it simple and
I do remember." When questioned about the use of biometrics all participants
agreed it would be a welcome and safer alternative, despite representing yet
another technology solution.

**Summary of the Influence of Compliance Effort with Security Requirements.** Compliance is a choice and organisational security goals are secondary when employees primary focus is their delivery of tasks and responsibilities [2]. In the participant group of data specialists, who have the responsibility to manage information assets in the organisation, the effort required to comply with secu- rity requirements can become unmanageable. Participants are driven by need and will forego tasks impeding their work. Employees are inadvertently worn down by the energy spent in constant cost-benefit analysis. Compliance is tax- ing and users become weary, resulting in them choosing less secure behaviour to reduce cognitive overload. Thus there is a strong preference for security solutions which would reduce effort on their part.

## 4.3 Influence of Psychological Stress

Employees are constantly faced with messages to be safe online and be vigilant about potential cyber attacks. Participants noted how this leads to increased anxiety and a sense of resignation.

**Increased Anxiety.** Participants expressed feelings of panic, fear of getting into trouble, and fear of being hacked when faced with complex security requirements. The demographic of participants who displayed a high degree of stress are those that are older or experienced security incidents. This led to participants expressing frustration at the organisation. For example, P11 believed the organisation should deal with security related issues and stated: "*So I try my best to keep myself secured but I don't feel like I should be the one to make it secure. I feel that the system or the application should have enough security built in to keep me secure. Why must I do that effort? I feel like the company that created the thing should build in security for my purpose.*"

**Sense of Resignation.** The IT security division in the organisation applies strict user access protocols which can be cumbersome to navigate. Failing a security check sometimes led to the abandonment of tasks, as P3 illustrated: "*I put in my details, well the password, incorrect firstly. Then I tried to reset it and it said to contact the system administrator or something like that. And that was at the first try. It wasn't like we give you a temp password or whatever.*" Thus a general sense of resigned frustration could be perceived. While P11 expressed frustration, there is an understanding that the process is in place to mitigate risk: "*I locked myself out of my machine and I couldn't get in ... I will sort
*it out because it will bother me.*" Thus employees nevertheless seem to take
responsibility for security.

**Summary of the Influence of Psychological Stress.** The organisation has elevated security to its highest priority and in doing so created a sense of earnestness among the participants. As a result they displayed increased anxiety. As reported in literature, employees are overwhelmed with security requirements and are often not allowed to assimilate these highly complex processes into their frame of reference and work routines [7]. There has not been any clear guidelines from notable authorities on how employees should deal with security-related matters and in the face of the insurmountable effort required on their part, the employee simply gives up. This sense of resignation created a feeling among employees that security is enforced using a dictatorial approach.

## 4.4 Adequacy of Knowledge

Since the appointment of the CISO the organisation has radically increased security awareness drives. The awareness activities are designed to improve security consciousness across the organisation. Participants highlighted several issues with ineffective security awareness activities, as well as the adoption of new technologies.

**Ineffective Security Awareness Activities.** Participants claimed to be overwhelmed with the frequency and duration of awareness activities. For example, P9 believed there were too many phishing exercises trying to catch out employees. The time to complete awareness activities could take up to six hours every month, which involved completing online courses and questionnaires. The organisation has been quite unforgiving when it comes to completing these courses, with P7 explaining that access would be removed if employees had not completed security awareness assessments by a stated date. In an environment driven by deadlines this becomes an overload on the employee.

The effectiveness of these activities were questioned by several participants. For example, P11 stated that the activities failed to communicate details on material changes to effectively ease security concerns and "it doesn't make you want to be more secure ... they [IT] just say you need to do this and the onus is on you only, they just put all the load on the user." From the perspective of P12 all the activities were grounded in theory but do not offer any substantial guidance to execute on them. The consensus was that awareness activities were often no more than an academic exercise, with P3 summarising: "Yes we have all the IT security modules but are we just ticking boxes?"

**New Technology Concerns.** When questioned about new technologies, and specifically cloud-based technologies, participants perceived security risks. P11 voiced reservations and questioned how secure it would be: "I would be very
worried because I don't know how secure that is and how easy that would be for someone to hack." Participants welcomed and accepted the use of cloud-based technologies, provided the information stored is not sensitive. Regarding sensitive information all participants expressed concerns. Based on their experience participants foresee potential risks they are exposed to in the cloud. P2 worried about placing information in the cloud: "I worry who is going to be able to access it. What is their intent ... at the end of the day I am not able to control that information." The perceived risks and lack of control inherent in cloud computing is a concern among the participants. However, P12 believed that conducting adequate risk assessments would be vital for storing information in the cloud.

**Summary of the Adequacy of Knowledge.** The level of an individual's awareness and knowledge influences behaviour [11]. When organisational security awareness activities do not have the desired effect, employees are not empowered with the necessary skills to perform their tasks. Gaining compliance through awareness activities demand effort and skill, but it left the participants despondent with no desire to comply. In addition, the adoption of new technologies challenge employees to willfully increase their level of knowledge to avert security incidents. This requires considerable effort which can lead to security fatigue.

## 5 Conclusion

Employees experience higher levels of frustration and fatigue as demands are placed on them to maintain secure environments and to guard against security breaches. Understanding such phenomena provide important insight into the context within which employees operate, providing opportunities to improve human-centred security. This study looked at an emerging construct, namely security fatigue. Security compliant behaviour is a multi-faceted and complex construct, and this research argues that fatigue is an important consideration. This is especially true for roles that deal with sensitive information and a low tolerance for risk. While security fatigue is not readily recognisable, this study identified several themes that contribute to the phenomena. Despite having an awareness of risks to sensitive information, employees can face challenges such as compliance effort with security requirements, increased psychological stress, and doubts of the adequacy of their knowledge. While these are not new concepts, there are behavioural characteristics within these concepts that describe patterns of security fatigue. This study highlights the need to understand the role security fatigue plays in security compliance and in harmonising risk.

This study focused on a very specific population and not all participants showed acute signs of security fatigue. This can be seen as a possible limitation but also an opportunity for further research. This study focuses on the experience of data specialists within a specific organisation, but it is likely that their experiences are mirrored in other roles and organisations.

**Acknowledgements.** This work is based on the research supported wholly/in part by the National Research Foundation of South Africa (Grant Numbers 114838) [3].
References

1. Alohali, M., Clarke, N., Li, F., Furnell, S.: Identifying and predicting the factors affecting end-users' risk-taking behavior. Inf. Comput. Secur. 26(3), 306–326 (2018)

2. Beautement, A., Sasse, A., Wonham, M.: The compliance budget: managing security behaviour in organisations. In: Proceedings of the 2008 New Security Paradigms Workshop, pp. 47–58 (2008)

3. Bhana, A.: Security fatigue factors influencing risk tolerance among data specialists [Unpublished manuscript]. Department of Information Systems, University of Cape Town, South Africa (2019)

4. Braun, V., Clarke, V.: Using thematic analysis in psychology. Qual. Res. Psychol. 3(2), 77–101 (2006)

5. Choi, H., Park, J., Jung, Y.: The role of privacy fatigue in online privacy behavior. Comput. Hum. Behav. 81, 42–51 (2018)

6. D'Arcy, J., Herath, T., Shoss, M.: Understanding employee responses to stressful information security requirements: a coping perspective. J. Manag. Inf. Syst. 31(2), 285–318 (2014)

7. D'Arcy, J., Teh, P.L.: Predicting employee information security policy compliance on a daily basis: the interplay of security-related stress, emotions, and neutralization. Inf. Manag. 56(7), 103–151 (2019)

8. Furnell, S.: Security fatigue. In: Jajodia, S., Samarati, P., Yung, M. (eds.) Encyclopaedia of Cryptography, Security and Privacy, pp. 1–5. Springer, Heidelberg (2019). https://doi.org/10.1007/978-3-642-27739-9_1591-1

9. Furnell, S., Thomson, K.L.: Recognising and addressing ‘security fatigue’. Comput. Fraud Secur. 2009(11), 7–11 (2009)

10. Hatashima, T., et al.: Evaluation of the effectiveness of risk assessment and security fatigue visualization model for internal E-crime. In: 2018 IEEE 42nd Annual Computer Software and Applications Conference, vol. 2, pp. 707–712 (2018)

11. Ogutcu, G., Testik, O.M., Chouseinoglou, O.: Analysis of personal information security behavior and awareness. Comput. Secur. 56, 83–93 (2016)

12. Ophoff, J., Renaud, K.: Revealing the cyber security non-compliance “Attribution Gulf”. In: Proceedings of the 54th Hawaii International Conference on System Sciences, pp. 4557–4566 (2021)

13. Oto, B.: When thinking is hard: managing decision fatigue. EMS World 41(5), 46–50 (2012). https://www.hmpgloballearningnetwork.com/site/emsworld/article/10687160/when-thinking-hard-managing-decision-fatigue

14. Pham, H., Brennan, L., Furnell, S.: Information security burnout: identification of sources and mitigating factors from security demands and resources. J. Inf. Secur. Appl. 46, 96–107 (2019)

15. Sasse, A.: Scaring and bullying people into security won't work. IEEE Secur. Priv. 13(3), 80–83 (2015)

16. Stanton, B., Theofanos, M., Prettyman, S., Furman, S.: Security fatigue. IT Prof. 18(5), 26–32 (2016)

17. Taylor, S., Bogdan, R., DeVault, M.: Introduction to Qualitative Research Methods: A Guidebook and Resource, 4th edn. Wiley, Hoboken (2016)

18. Wilde, G.: Risk homeostasis theory: an overview. Inj. Prev. 4(2), 89–91 (1998)

19. Yin, R.: Case Study Research and Applications: Design and Methods, 6th edn. SAGE Publications Inc. (2018)