MeaningFuel
Sign in
← Articles

Employer News · 2 days ago

Stressed employees more than twice as likely to ignore cybersecurity problems

Reported by Employer News. The analysis below is ours.

An empty desk by a curtained window in low light, with a laptop, a pen pot and a desk calendar
Photo: Marcel R on Unsplash

17.7%

of stressed employees would keep working past a security problem, expecting someone else to fix it

296 people in 33 countries, assessed and surveyed by Mindtools Kineo in June and July 2026; 8.2% of those not stressed said the same. The figures are from Mindtools Kineo's release, as its full report is gated

The finding is not that stressed people know less. It is that they leave the problem for somebody else, and that the safety to speak up which helps a calm team stopped making a measurable difference at high stress. A small sample from a training company, so read it as direction, but the direction is uncomfortable.

What did the Mindtools Kineo study find?

Mindtools Kineo, a workplace learning company, published "Cybersecurity's Tipping Point: What makes people act securely, or not at all" on 10 November 2026, written by its insights team, Dr Anastasia Voronkova and Dr Anna Barnett. Its own page says the report draws on 296 participants across 33 countries. The company's release, carried by Employer News on 12 November, gives the numbers the report page does not print.

The headline one is about a moment every office has. Somebody finds a security problem, a link that looks wrong or a login that should not have worked, and has to decide whether to stop and report it or carry on. Among employees who were stressed, 17.7% said they would carry on working because they expected someone else to fix it. Among those who were not stressed, 8.2% said the same. That is the "more than twice as likely" in the headline.

Two further findings matter more for a manager than the security ones. The release says greater stress went with poorer password habits and lower vigilance online. And it says people who felt safe to admit mistakes, ask questions and raise concerns generally behaved more securely, but that this benefit weakened as stress rose, until at high stress the link was no longer statistically significant. Read plainly: a team that feels safe to speak up is better protected, until the workload gets heavy enough, and then the safety stops showing up in what people do.

The release also reports that 24% believed an incident was more likely to happen somewhere else in the organisation than in a role like theirs, and that knowing the consequences predicted secure behaviour far less well than feeling personally exposed did.

How much weight can a study of 296 people carry?

Some, not a lot. 296 people spread over 33 countries and nine industries is a small sample, and once it is split into stressed and not stressed, each group is smaller still. The participants took Mindtools Kineo's own Cybersecurity Skills Assessment first and then answered a survey, so they are people who did a security assessment with a training company rather than a random slice of the workforce. The analysis, by the release's account, used standard tests (t-tests, analysis of variance, regression and moderation) with results judged significant at p<.05 and adjusted for multiple comparisons.

Two cautions follow. The full report sits behind a sign-up form, so the 17.7% and 8.2% are traced here to the company's own release rather than to a table in the report. And the answers are what people said they would do, not what they were seen to do. Treat the size of the gap as direction rather than precision. The direction is the useful part.

Why does stress make people leave it for someone else?

Because "someone else will deal with it" is the cheapest decision available to a person with no spare minutes. In the late 1960s Bibb Latané and John Darley ran experiments on why bystanders fail to act, and found that people who believed others had also noticed a problem were slower to step in. They called it diffusion of responsibility: the more people who could act, the less each one feels it is theirs.

An office is that experiment run every day. Everybody receives the same odd email. Everybody can see the shared drive is open. And the release's own figure, that a quarter of people think incidents happen in other parts of the business, is the same instinct in a different form. Stress tightens it. When the deadline is at four and the report is half written, stopping to report something that "IT probably already knows about" costs real time now, and the benefit is shared, delayed and invisible. Voronkova puts it in the release as the immediate task taking priority while the warning sign gets ignored.

That is why a policy that says "report anything suspicious" can be perfectly clear and still lose. Nobody forgot the policy. The workload simply outbid it.

Picture Sana in finance at quarter end. An invoice email asks her to confirm new bank details, and it feels slightly off. Sana is three reconciliations behind. She assumes the payments team checks every change anyway, closes the email and gets on with it. She is not careless and she has done the training. She made the trade her week asked her to make.

How can a manager tell it is happening?

The pattern leaves traces, mostly as things that go unsaid:

  • Near misses never reach you. You hear about the phishing email after it worked, not when the first person spotted it.
  • "I assumed IT knew" or "I thought someone had already reported it" comes up after an incident.
  • Reports arrive in batches after a deadline, if at all, because nobody had time during it.
  • The same small fault lingers for weeks because each person who meets it works around it.
  • The one person who always reports things is also the one person with spare capacity.

What can a manager do this week?

Make reporting take seconds

If reporting a problem means finding a form, a ticket category and a description, a stressed person will not do it. One button, one address or one message in the team channel. The test is whether someone could do it in the middle of a deadline.

Thank the reporter, every time

Including when it was nothing. The person who flags a false alarm is the person you need on the day it is real, and how the first report is met decides whether there is a second.

Name who owns it

Diffusion of responsibility shrinks when it is clear whose job a thing is. Say it out loud: if you see it, it is yours to report, even if ten other people saw it too.

Cut the load, not just the training

Voronkova's own advice in the release is that managers should check a team's capacity before adding new security demands. If the team is stretched, another awareness module adds a task to the pile it is already losing to. Take something off first.

For the wider pattern of people staying quiet when speaking feels costly, see what the cost of workplace silence looks like.

Questions managers ask

Is this a cybersecurity problem or a people problem?

Both, and the people half is the one a manager can change this week. The release itself calls it a workload and management problem. Better tools reduce how often a person has to judge; they do not change what a stretched person does when they do.

We already run security training. Is it wasted?

No, but the study suggests it is not the limiting factor. People knew the consequences; what predicted behaviour was whether they felt it could happen to them, and whether they had the room to act. Training that ignores the room is fighting the wrong constraint.

How do I find out whether my team is too stretched to report things?

Count the near misses you hear about. A team that reports none is rarely a team where nothing happens. Then ask, in a meeting rather than a survey, what the last thing was that somebody noticed and did not mention because there was no time.

What MeaningFuel does about it

Before it happensWhat the daily ritual works on, every working day
Courage and Accountability every working morning, for the whole company on the same two-minute question. Saying "that looks wrong, I'll flag it" is a habit, and a habit practised on small things in a calm week is the one still there in a busy one.
After it hasThe module prescribed to the team that has this
Book Energy That Lasts for the team where the load has outrun the people: ten short daily lessons over two working weeks, one of them aimed at the load itself rather than the person carrying it, with two ten-minute debriefs its lead runs from a written guide. Each person chooses whether to take part, and the lead never sees what anybody writes.
What management seesThe reading that makes either one provable
Engagement by team and by theme, so the team where fewer people answer each week shows before the near misses stop arriving. What anybody chose waits until enough have answered to hide each choice, and no screen shows an individual's. It is a reading of engagement, not a diagnosis: the judgement about causes and actions stays the employer's.

The offsite worked. That was never the problem.

Week six is the problem. The person who ran it has moved teams, the thing everyone agreed has quietly stopped happening, and nobody can name the day it stopped. A poster on the wall or a values page on your website never asks anyone a question.

MeaningFuel keeps it going: one short insight each working day on the values you chose, and a two-week micro-training for any team that falls behind. You see which teams carry them, pooled, with nobody named.

Start 14 days freeNot convinced? Read the long version

Already have an account? Sign in

Also on the wire