A qualitative case study of cybersecurity fatigue and human-centric vulnerabilities in the SaaS sector

Purpose Cybersecurity fatigue is an important organisational issue, especially in high-pressure operational contexts such as Software-as-a-Service environments. As organisations implement stricter security controls and mandatory training, this can inadvertently place psychological strain on employees. This study/paper aims to identify specific operational demands and workflow characteristics contributing to employee cybersecurity fatigue and analyse the subsequent behavioural implications. Design/methodology/approach This study adopted an interpretivist, qualitative approach, using semi-structured interviews with employees from various departments to explore the causes and behavioural impacts of cybersecurity fatigue. A single organisation was used as case study. Findings The findings identified several key contributors: workflow disruption, cybersecurity decision overload, work overload and poor understanding of risk. These were associated with secondary elements such as repetitive access requests, security checks overload, a lack of real-world examples and generic training. The study also examined how these factors impact employee behaviour, revealing that fatigue often leads to disengagement, neglect of protocol and abandonment of cybersecurity tasks, especially training. Originality/value Attitudinal fatigue, employees’ negative perceptions of cybersecurity, emerged as a critical influence on compliance and overall cyber resilience. A conceptual model is proposed by integrating the study’s findings with the four-component model of cybersecurity fatigue, offering a foundation for future research. This model may be useful for examining cybersecurity fatigue and developing targeted interventions to reduce its impact. The authors recommend implementing contextualised training with real-world examples and streamlining security processes to reduce workflow disruption and frustration.