GoKawiilA UAlbany-led research team found that repeated exposure to security requirements can lead to “security fatigue,” a state in which employees become mentally exhausted and disengaged from security practices. (Photo by Patrick Dodson)
By Michael Parker
ALBANY, N.Y. (March 18, 2026) — From password resets and software updates to phishing alerts and cybersecurity trainings, today’s workplace is filled with constant reminders about digital security. But new research led by the University at Albany’s Massry School of Business suggests those well-intentioned safeguards may be having an unintended effect.
A recent study, “Security Fatigue: Manifestation of Emotional Exhaustion and Cynicism by Depletion of Self-Regulation Capacity,” published in the European Journal of Information Systems, examines how growing cybersecurity demands are impacting employee behavior. The research finds that repeated exposure to security requirements can lead to “security fatigue,” a state in which employees become mentally exhausted and disengaged from security practices.
“Security requirements are designed to protect organizations, but they also create additional demands on employees that build over time,” said Sanjay Goel, Morris Massry Endowed Professor and chair of Information Security and Digital Forensics. “When those demands outpace an individual’s capacity to manage them, it becomes harder to maintain consistent security behavior.”
Goel conducted the research with co-authors Akanksha Malik of the Guildhall School of Business and Law at London Metropolitan University (UK) and Shuchi Sinha of the Indian Institute of Technology Delhi (India).
The human side of cybersecurity
While cybersecurity is often framed as a technical challenge, the study highlights the growing strain placed on employees who must carry out security practices in real time.
Morris Massry Endowed Professor and Chair, Information Security and Digital Forensics Sanjay Goel speaks to students in the UAlbany AI for Business Lab. (Photo by Patrick Dodson)
Employees are routinely expected to manage a range of security-related tasks, from maintaining complex passwords to identifying phishing attempts and adapting to frequently updated policies. While each task is manageable on its own, the cumulative effect can create a sustained cognitive burden that interferes with employees’ primary responsibilities.
... continue reading