Concept: Security Fatigue
Security Fatigue is a cognitive and operational phenomenon—defined by the National Institute of Standards and Technology (NIST)—wherein users overwhelmed by continuous, friction-heavy security checks and complex compliance rules default to the easiest available option to complete their work.
Overview in the AI Era
In the context of generative AI adoption, Security Fatigue manifests when organizations issue vague, restrictive directives (e.g., “never paste sensitive data into LLMs”) without providing ergonomic tools to perform necessary work safely.
As workplace pressure to deliver faster increases, employees face a friction differential:
- The Approved Path: Complex, manual document sanitization, multi-layered approval queues, or abstaining from AI tools entirely.
- The Unapproved Path: Direct upload of raw files to commercial AI chatbots via personal, unmonitored accounts.
Because the benefit of using AI is immediate while the risk of policy violation is delayed and abstract, Security Fatigue guarantees that the unapproved, frictionless route wins over time.
Empirical Telemetry & Shadow IT
As highlighted by nate-b-jones from 2026 Verizon enterprise telemetry:
- Rapid Adoption: Corporate device employee AI usage rose from 15% to 45% within a single year.
- Shadow IT Dominance: Two-thirds (66%) of active enterprise AI users accessed models through non-company personal accounts.
- Source Code Exposure: Proprietary source code emerged as the single most common material involved in corporate data policy events, driven by developers seeking rapid debugging assistance.
Designing Around Security Fatigue
Modern software architecture addresses Security Fatigue by embedding security checks directly into normal user interaction flows—similar to how mobile operating systems request camera permissions or web browsers perform SSL certificate checks automatically.
In AI workflows, tools like airlock mitigate Security Fatigue by embedding context-minimization into document preparation. By making data sanitization convenient and automated, organizations align security compliance with employee productivity.