How to De-CyFa the actor-observer bias in cybersecurity fatigue: Building the CyFa measure of attribution styles and mitigation strategies

Cybersecurity fatigue and burnout, driven by an overload of security demands, are pressing concerns in the industry. Research increasingly shows that fatigued employees are more likely to engage in unsafe cyber behaviours, making it essential for cybersecurity leaders to implement targeted mitigation strategies. However, the extent to which these leaders understand the causes of cybersecurity fatigue and can identify effective solutions remains unclear. There is concern that cybersecurity professionals and non-cyber employees may view each other as distinct groups, potentially leading to biased decision-making, where each group recommends different interventions for themselves versus others. This actor-observer bias could have significant implications for leadership decisions, yet it remains underexplored in this context. This study examines what cybersecurity professionals believe are the causes of cybersecurity fatigue in their workplaces and the strategies they would adopt to mitigate it. It compares these views with those of non-cybersecurity managers and regular employees. Using attribution theory, we developed a novel measure, CyFa (pronounced “cipher”), to assess mitigation strategy preferences and attribution styles. Data from 506 participants across these groups were analysed. The findings suggest that actor-observer bias is present in all groups, with cybersecurity professionals and managers being no better at avoiding this bias than others. Differences between the groups often reflected a tendency to avoid responsibility rather than superior decision-making. Additionally, cybersecurity professionals were found to rely heavily on certain strategies, like employee awareness training, while neglecting others, such as organisational system changes.