Most people don’t ignore cyber security because they do not care. They ignore it because they are tired.
Tired of warnings. Tired of pop-ups. Tired of mandatory training. Tired of being told not to click, not to reuse passwords, not to trust emails, not to open attachments, not to use personal devices, not to do the thing that would make their job quicker.
In many workplaces, cyber security has become another voice in an already noisy day. Staff are trying to teach lessons, care for people, process invoices, answer calls, support customers, deal with suppliers, manage parents, chase paperwork and keep services running. Then cyber security appears with another rule, another alert, another course, another acronym or another message that feels like it was written for someone else.
At first, people may listen. Over time, they can start to switch off.
That is security fatigue.
It does not mean people are lazy. It does not mean they are reckless. It often means the organisation has asked people to carry too many security decisions, with too little clarity and too much pressure.
A school member of staff might be told to watch out for phishing emails, but also receives dozens of real links every week from systems, parents, suppliers, training platforms and colleagues. A care worker might be reminded not to share passwords, but the systems they use are awkward, slow and needed during a busy shift. A finance assistant might be told to check invoice changes carefully, but is also under pressure to keep payments moving. A small business owner might know multi-factor authentication matters, but does not have the time or headspace to work out which settings are correct.
This is where cyber advice can start to become background noise. Not because the advice is wrong, but because it is not being delivered in a way people can act on.
There is a useful point in Cybersecurity ABCs: awareness is not automatically good. The way awareness is delivered matters. If people are given too many messages, too often, without clear actions, it can create noise rather than better behaviour. The book also points to research where people described security fatigue as a sense of resignation, lack of control, fatalism, risk minimisation and decision avoidance. In plain English, people can start to think, “There are too many threats. I cannot keep up. So I’ll just do what I normally do.”
That is the opposite of what good cyber security should achieve.
The answer is not to shout louder. It is not to add more scare stories. It is not to send more posters, longer policies or another annual training module that everyone clicks through as quickly as possible. More noise will not fix security fatigue. It usually makes it worse.
Better cyber security communication is shorter, clearer and more relevant.
Instead of saying “be vigilant”, tell people what to do when something looks wrong. Instead of saying “do not click suspicious links”, show them how to report one. Instead of saying “use strong passwords”, give them a password manager and explain how it helps. Instead of warning staff about ransomware in the abstract, explain why tested backups, updates and endpoint protection reduce the damage if something goes wrong.
People need to know what action to take. They also need to believe the action is possible.
That belief matters. If staff feel the threat is huge but their ability to respond is small, they are more likely to avoid the issue. If they feel the process is simple, supported and normal, they are more likely to act.
A good example is phishing. Telling staff “don’t get caught” can create anxiety. Telling them “if something feels wrong, report it here and we’ll check it” creates confidence. One message makes the person feel exposed. The other gives them a route to safety.
The same applies to invoice fraud. A vague warning about fake payment requests is easy to ignore. A simple rule is easier to follow: any change of bank details must be checked using a known phone number, not the details in the email. That is practical. It reduces the number of judgement calls staff have to make under pressure.
The best cyber security controls remove unnecessary decisions.
That is one of the strongest lessons for small organisations. Staff should not have to inspect every link, analyse every email header, assess every login prompt and decide whether every attachment is safe. Some of that work should be handled by email security, endpoint protection, multi-factor authentication, password managers, patching, safer defaults and clear internal processes.
Security fatigue often grows when people are asked to compensate for weak systems.
If email protection is poor, staff have to judge more dangerous emails. If MFA is missing, one password mistake matters more. If password rules are unrealistic, people create shortcuts. If payment processes are informal, staff have to make awkward decisions. If reporting routes are unclear, people hesitate. If training is too generic, it does not feel connected to their day.
That is why cyber security culture is not built by awareness alone. Culture is built through repeated, practical, visible habits. It is built when leaders follow the same rules as everyone else. It is built when someone can report a suspicious email without being made to feel silly. It is built when a finance assistant can challenge a payment request from someone senior. It is built when staff see cyber security as part of looking after the organisation, not as another compliance burden dumped on them.
For schools, this matters because staff already carry a huge amount of responsibility. Safeguarding, teaching, administration, parents, governors, inspections, tight budgets and constant change all compete for attention. Cyber security advice has to respect that reality. It needs to be practical, calm and linked to the risks schools actually face: phishing, account compromise, ransomware, data loss, weak backups and systems being unavailable when they are needed.
For care providers, the same is true. Staff are focused on people, not passwords. Any cyber security process that ignores the pace and pressure of care work will struggle. Security has to support the job, not make it harder.
For office teams and small businesses, the issue is often time. Nobody has spare hours to decode jargon or manage another dashboard. Advice needs to be plain, prioritised and proportionate. What matters first? What reduces the biggest risk? What can be made easier?
Good cyber security should reduce pressure, not add to it.
That might mean fewer, better messages. It might mean bite-sized training instead of one long annual session. It might mean examples that match the organisation’s real world. It might mean replacing vague warnings with simple processes. It might mean giving staff one clear reporting route. It might mean using technology to remove risky decisions from people altogether.
There is still a place for awareness training. Staff need to understand the risks they face and the part they play in reducing them. But awareness should lead somewhere. It should help people act. It should connect to behaviour and culture, not sit in isolation as an annual tick-box exercise.
The aim is not to turn everyone into a cyber security expert. It is to make safer behaviour easier.
At Black Swan Cyber Security Solutions, we help smaller organisations make cyber guidance easier to understand and act on. That can include staff awareness training, phishing guidance, password manager rollout, multi-factor authentication, email security, managed detection and response, backup reviews and plain-English cyber reviews for leaders.
We do not believe people are the weakest link. We believe people are often under-supported.
If your staff are switching off from cyber advice, the answer may not be more training. It may be better communication, simpler processes and stronger protection around them.
Cyber security should not feel like a constant telling-off.
Done properly, it should help people feel clearer, calmer and more confident about what to do next.
