Workplace pressure may be doing more than affecting employee health, wellbeing and productivity. It could also be making organisations more vulnerable to cybersecurity threats, according to new global research from Mindtools Kineo.
The study, Cybersecurity’s Tipping Point: What makes people act securely, or not at all, found that employees experiencing stress were more than twice as likely as those who were not stressed to ignore a cybersecurity problem, assuming somebody else would deal with it.
Some 17.7% of stressed employees said they would continue working after discovering a security problem, compared with 8.2% of those who were not stressed.
The research, which involved 296 participants across 33 countries, also found that higher stress was associated with poorer password habits and lower online vigilance. It suggests that workload and job pressure need to be considered alongside technology, policies and training when organisations assess their cyber risks.
Psychological safety is not enough on its own
The findings also highlight the importance of psychological safety. Employees who felt able to admit mistakes, ask questions and raise concerns generally demonstrated better cybersecurity behaviours, including reporting suspicious activity and flagging potential errors.
However, the protective effect of a supportive team environment weakened as stress increased. At high stress levels, the relationship between psychological safety and better security behaviour was no longer statistically significant.
Dr Anastasia Voronkova, Insights Analyst at Mindtools Kineo, said: “Cybersecurity is usually discussed as a technology, policy or training problem. Our research shows that it is also a workload and management problem.”
She explained that employees may know they should report something suspicious and feel comfortable approaching their manager, but sustained pressure can mean immediate tasks take priority and warning signs are ignored.
The research also identified a gap between employees’ understanding of cyber threats and their perception of personal risk. More than half (55%) doubted that their workplace internet activity could expose confidential or work-related data, while one in five did not believe their device could realistically be targeted by a phishing attempt.
Managers have a role to play
For employers, the findings point to a need to look beyond annual cybersecurity training and consider the working conditions that influence everyday behaviour.
Mindtools Kineo recommends that managers are equipped to recognise when pressure is affecting judgement and security habits, assess team capacity before introducing additional demands, and identify unsustainable workloads.
Managers can also help make secure behaviour part of everyday working life by following procedures themselves, demonstrating how to respond to problems and creating an environment in which employees feel able to speak up.
As Dr Voronkova concludes, organisations need to treat overload as an early warning of security risk, not simply an issue for employee wellbeing.
The message is clear: protecting an organisation’s people and data means creating the conditions in which employees have the time, confidence and support to do the right thing.
You might also like:
