Change fatigue is the reduced organizational capacity that develops when people face too many overlapping changes, tools, policies, migrations, and training demands. In cyber security, it matters because security programs depend on attention and consistent follow-through: if staff are overwhelmed, they are more likely to ignore alerts, skip updates, reuse weak workflows, or approve exceptions without review.
Attackers can benefit when defenders are tired of constant disruption. For example, repeated password resets, MFA rollouts, cloud control changes, or AI policy updates can create frustration that pushes users toward shadow tools or unsafe shortcuts. Defenders use pacing, staged rollouts, clear communication, and measurable checkpoints to reduce the load. Good security change management is not just about introducing controls; it is about making sure the organization can absorb them without losing visibility, trust, or compliance.