Risk homeostasis and security fatigue: a case study of data specialists

Purpose Organisations use a variety of technical, formal and informal security controls but also rely on employees to safeguard information assets. This relies heavily compliance constantly challenges manage security-related risks. The purpose this research is explore the homeostatic mechanism proposed by risk homeostasis theory (RHT), as well fatigue, in an organisational context. Design/methodology/approach A case study approach was used investigate topic, focusing data specialists who regularly work with sensitive Primary collected through semi-structured interviews 12 large financial services company. Findings thematic analysis revealed perceptions, behavioural adjustments indicators fatigue. findings provide examples how these concepts manifest practice confirm relevance RHT domain. Originality/value illuminates mechanisms It illustrates links fatigue could further impact risk. Examples can assist organisations management, creating “employee-friendly” policies procedures, choosing appropriate technical solutions tailoring education, training awareness activities.