App fatigue is the tired, tuned-out state people reach when they juggle too many apps, logins and notifications. The security problem is what it does to reflexes. When everything pings, people click past pings, including the sign-in prompt and the warning that actually mattered.
The volume is real. Microsoft looked at anonymized Microsoft 365 activity and found that during core work hours, employees are interrupted about every two minutes by meetings, emails or chats.
275
Interruptions per day from meetings, emails and chats for the average worker during core hours (Microsoft Work Trend Index, 2025)
The same report found the average worker receives 117 emails and 153 Teams messages on a weekday. That is before update reminders, security pop-ups and phone notifications, and every new app adds another login and another stream of alerts.
In short
- App fatigue leads people to tune out alerts, and the habit carries over to real security warnings.
- The most dangerous version hits sign-in approval prompts (MFA). A tired user approves a sign-in they never started.
- Number matching and phishing-resistant sign-in mean a reflex tap can’t approve anything.
- Cut the number of apps, use one login across apps (single sign-on), update automatically and set notifications centrally. That removes most of the decisions staff get wrong.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
Why app fatigue becomes a security problem
Security depends on people noticing the one alert that matters. Researchers at Brigham Young University tested whether fatigue gets in the way and found that “habituation to a frequent non-security-related notification does carry over to a one-time security warning.” The more routine pop-ups people click past, the more likely they are to click past a real warning that looks similar.
MFA prompt fatigue: where it gets dangerous
The most direct link between app fatigue and a breach is the sign-in prompt. An attacker who already has a password triggers approval request after approval request and waits for a tired tap on Approve. The attack is called push bombing, and it works because approving prompts has become a reflex for many people.
We have seen push bombing at our clients. Two settings take most of the risk away. Number matching makes the user type a number shown on the sign-in screen, so a reflexive tap does nothing. Phishing-resistant sign-in, such as security keys or passkeys, removes the prompt altogether. For our clients, admin accounts use phishing-resistant sign-in and everyone else approves with number matching. Our post on push bombing covers the attack and the fixes in detail.
Fewer prompts help as well. When staff see a sign-in request only when they actually sign in somewhere new, an unexpected one stands out.
Other ways notification fatigue weakens security
Updates get postponed
An update prompt in the middle of a busy morning gets dismissed, then dismissed again the next day. Many updates fix security holes attackers already know about, so every postponed update leaves a door open a little longer.
Passwords get reused
Each new app means a new password. People who are tired of creating them reuse the same one or a small variation, and when one site is breached, attackers try that password everywhere else. Our guide to strong passwords covers the fix.
Security alerts get muted
At some point people mute everything they can. Turning off group chat notifications is fine. Turning off the alert from your security software is a problem, and most users can’t tell the two apart.
How to reduce app fatigue
- Cut the number of apps. List every app your organization pays for or uses for free, then look for overlap, such as two file sharing services, separate chat and meeting apps, or several ways to sign documents. Microsoft 365 covers email, files, chat and meetings under one login.
- Put logins behind single sign-on where apps support it, so staff sign in once with MFA. For everything else, give people a business password manager.
- Take updates out of users’ hands. Patch operating systems, browsers and common apps automatically with a deadline, scheduled outside business hours, so updates install whether or not someone clicks the reminder. This is standard work in managed IT services.
- Set notifications centrally. Configure sensible defaults for Teams, Outlook and security tools, so routine noise drops and real warnings are distinct and rare enough to notice.
- Talk to your team. Tell them which alerts must never be ignored (security warnings, unexpected MFA prompts and messages from IT), which are fine to mute or batch, and who to ask when they aren’t sure.
The alerts IT is drowning in
Firewalls, antivirus, backup software and cloud services all send alerts to whoever manages them. In a small organization that is often one busy person who handles IT on the side. When most of those emails are routine, the one that says a server is being encrypted can sit unread until morning.
Every one of our clients has a 24/7 security operations center watching security alerts, so they go to people whose job is to act on them. That is part of our cybersecurity services. For healthcare practices, accounting firms, law offices and nonprofits, it matters twice: a missed alert can turn a contained incident into a reportable breach, and “nobody was reading those emails” is a hard answer to give a regulator, an insurer or a client.
Try counting how many sign-in prompts and pop-ups your staff click through in a week. Then book a 15-minute call and we’ll work out which of them can go.
Related reading
Frequently asked questions
What is app fatigue?
App fatigue is the tired, tuned-out state people reach when they juggle too many apps, logins and notifications. It’s a security problem because people who click past routine pings also click past the sign-in prompt or warning that mattered.
Is app fatigue the same as alert fatigue?
They overlap. App fatigue usually describes end users overwhelmed by apps, logins and notifications, while alert fatigue usually refers to IT and security staff overwhelmed by system alerts from firewalls, backups and security tools. Both lead to important warnings being missed, which is why routine alerts should be cut back and security alerts sent to people whose job is to act on them.
What is notification fatigue?
Notification fatigue is what happens when constant pings from email, chat, meetings and pop-ups train people to dismiss alerts without reading them. Microsoft found workers are interrupted about every two minutes during core hours. The habit carries over to security: researchers found that tuning out a frequent routine notification makes people more likely to click past a one-time security warning.
What is MFA fatigue?
MFA fatigue, also called push bombing, is an attack where someone who already has a password sends approval request after approval request until a tired user taps Approve. Number matching stops a reflex tap from approving anything, and phishing-resistant sign-in removes the prompt altogether. Our post on push bombing covers the attack in detail.
Sources
Next step
Let us handle this for you.
Help desk, monitoring, updates, approved programs and backup on every computer, run for you.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
