Stressed employees twice as likely to ignore cybersecurity problems

A global study by Mindtools Kineo found that 17.7 per cent of stressed employees would continue working after discovering a cybersecurity problem because they expected somebody else to resolve it, compared with 8.2 per cent of employees who were not stressed.

Employees experiencing workplace stress are more than twice as likely to ignore cybersecurity problems, according to research suggesting that excessive workloads and psychological pressure could be putting organisations at greater risk of security breaches.The findings, published in the report Cybersecurity’s Tipping Point: What Makes People Act Securely, or Not at All, suggest that employee wellbeing, workload management and organisational culture should be considered alongside technology and training when managing cybersecurity risks.

For UK employers, the findings highlight a potential connection between workforce health and organisational resilience, with employees under sustained pressure potentially less able or willing to recognise, report and respond to security threats.

The study also examined the role of psychological safety, where employees feel comfortable admitting mistakes, asking questions and raising concerns without fear of blame or punishment.

Employees who reported greater psychological safety generally demonstrated better cybersecurity behaviours, including reporting suspicious activity, flagging potential errors and following security procedures.

However, the relationship weakened as workplace stress increased. At high stress levels, the association between psychological safety and better cybersecurity behaviour was no longer statistically significant.

The findings suggest that creating a supportive workplace culture may not be sufficient if employees are experiencing excessive workloads or lack the time and capacity to act on potential risks.

Dr Anastasia Voronkova, Insights Analyst at Mindtools Kineo, said: “Cybersecurity is usually discussed as a technology, policy or training problem. Our research shows that it is also a workload and management problem. An employee may know that they should report something suspicious and feel comfortable approaching their manager. But under sustained pressure, the immediate task can take priority, and the warning sign gets ignored.

“There is also a psychological safety matter, as people need to know they can admit a mistake without being blamed or punished. Yet, a speak-up culture may offer limited protection if employees are too stretched to stop working, investigate a concern or report a mistake. Managers need to recognise when pressure is beginning to affect judgement and everyday security habits.”

The research also identified a gap between employees’ understanding of the consequences of cyberattacks and their perception of their own vulnerability.

More than half of respondents (55 per cent) doubted that their workplace internet activity could expose confidential or work-related data, while one in five did not believe their device could realistically be targeted by a phishing attempt.

Almost a quarter (24 per cent) believed cybersecurity incidents were more likely to occur elsewhere in their organisation than in roles similar to their own.

Yet 86 per cent recognised that a security incident could seriously damage their professional reputation, while 84 per cent understood that it could result in significant financial costs for their employer.

Employees generally rated the potential severity of a cybersecurity incident at least 15 per cent higher than their own vulnerability to one.

The researchers found that feeling personally vulnerable to cyber threats was a stronger predictor of secure behaviour than understanding the potential consequences of an attack.

This suggests that awareness of cybersecurity risks does not necessarily translate into appropriate action, particularly when employees are managing competing demands and workplace pressures.

For HR and People leaders, the findings provide another reason to consider excessive workload and chronic stress as organisational risks rather than solely individual wellbeing concerns.

While stress and burnout are commonly discussed in relation to employee health, absence and productivity, the research suggests that their potential consequences may extend to operational decision-making, compliance and information security.

Dr Voronkova concluded: “HR, L&D, IT and compliance teams should examine the working conditions surrounding security behaviour, because another annual training course won’t solve the problem. Managers need the skills to control excessive pressure, treat overload as an early warning of security risk and respond well when somebody raises their hand.”

The study collected data between June and July 2026 from employees working across nine industries and organisations of different sizes in 33 countries.