Decision fatigue is the drop in judgment quality that happens after a person makes many repeated decisions or reviews. In cyber security, it matters because analysts, approvers, and incident responders often face long queues of alerts, access requests, and change approvals. As fatigue builds, people are more likely to accept a risky request, miss an unusual detail, or default to the system’s recommendation instead of challenging it.
Attackers benefit when defenders are overloaded. A flood of alerts can wear down a security team until important signals blend into routine noise. In AI-assisted workflows, repeated “approve” actions can also create habit and automation bias. Good defenses reduce this effect with prioritization, rotation of duties, clear escalation rules, breaks, and automation for low-risk tasks. The goal is to preserve independent judgment for the cases that actually need human attention.