The narrative of cybersecurity risk often revolves around sophisticated hacking tools or zero-day vulnerabilities. Yet, the most significant threat to South Africans isn’t a technical flaw – it’s an emotional vulnerability rooted in a national financial crisis.
The approaching high-expenditure festive season together with the persistent cost-of-living squeeze are creating a widespread state of financial anxiety in an already difficult economy, and cybercriminals are actively exploiting the resulting desperation.
For individuals facing debt, job insecurity, or mounting household expenses, the promise of a quick financial solution – be it a “too good to be true” deal, a competition win, or an unsolicited income opportunity – becomes psychologically compelling.
This situation elevates the risk from a matter of basic security training to a critical vulnerability in overall human risk management.
When the brain goes into survival mode
The physiological effect of sustained stress and financial anxiety is a profound reduction in cognitive capacity. When the brain is under pressure, it shifts from thoughtful, logical processing to reactive, impulsive decision-making, a mode intended for physical survival but catastrophic for digital security.
“When people are under stress or mentally exhausted, their brains literally go into survival mode,” says Anna Collard, senior vice-president of content strategy and CISO advisor at KnowBe4 Africa. “The prefrontal cortex – the part responsible for logical thinking and self-control – takes a back seat.
“That’s when we’re more likely to make impulsive decisions or fall for a well-crafted phishing email. Cybercriminals know this and often exploit people during exactly these windows of opportunity.”
The key insight is that financial pressure doesn’t just distract; it actively degrades our ability to apply critical thinking and self-control. This state of cognitive overload, caused by the constant worry over money, is the perfect precondition for a successful social engineering attack. Studies show that cognitive strain increases reliance on mental shortcuts, making people more susceptible to error.
For example, when a South African is desperately searching for extra income, an email offering a high-paying, remote “data entry” job that requires a small up-front payment can bypass their normal scepticism. The anxiety overrides the logic that would normally spot the red flags.
On the buying front, the issue isn’t much different, Collard explains. “Many people are quick to confidently say they wouldn’t be tempted by a ‘too-good-to-be-true’-deal that ends up being a scam.
“The fact is, the numbers tell a worryingly different story, and a large amount of people do fall victim. A large part of this sad reality is that the scams are designed to catch people who, for instance, rely on special deals to make ends meet, and are actually trying to be budget-conscious.”
Scammers prey on the vulnerable state
A massive 63% of South African workers have reported excessive workplace-related stress, which now transcends the workplace, directly affecting mental health long after the commute home.
These days the cybersecurity element of mental-health is less about an overworked employee making a mistake on a tight deadline. It’s about a parent, anxious about their child’s school fees, being more easily manipulated by a WhatsApp message promising a 40% return on an investment platform.
“Mental fatigue reduces attention, impairs critical thinking and makes individuals more likely to operate on autopilot,” states Collard. “Even more dangerous is long-term stress, which can lead to burnout, depression and a reduced sense of accomplishment, which can be debilitating.”
In terms of direct threat exposure, the type of fatigue financially anxious individuals experience means they are more prone to taking shortcuts, like reusing passwords, ignoring security updates, or approving an MFA request without verifying its source.
Indirectly, though, employees who fall victim to scams in personal capacities bring compromised accounts and/or devices closer to organisations’ networks.
Catering to vulnerabilities
Effective and sustainable human risk management comes down to really grasping what it means to have a human-centric perspective on processes and contextual realities.
“Holidays, school years kicking off, and many other important events are always going to be present, and many massively increase financial strain. But how many decision-makers in organisations recognise the important context these periods represent for their employees, both as people and cybersecurity elements within the organisation?” asks Collard.
“A religious holiday, for instance, often means financial strain increases, and if leaders are aware that such periods are important to some of their employees, only then can steps be taken to support their people and to guard against the unique threats that will crop up during that time.”
Organisations can’t directly address individual employees’ varying levels of financial strain, but there are two avenues that can be used to approach the issue that both supports and uplifts affected people.
During known financially tight periods, such as the days before payday, the December holidays, Diwali, or tax season, for instance, exposing employees to less stress or administrative burdens can be a large boon to organisations’ security posture.
Through preparing in advance or automating error-prone or high-risk processes, this can become a very achievable goal that minimises risk-exposure when employees are most likely to experience strain and fatigue that can be exploited by bad actors.
Awareness training, too, must evolve to coach emotional resilience. Individuals need to be trained on how to slow down when they sense urgency or desperation – and how to identify when it is likely to be happening. They need to learn to recognise when their emotional state makes them vulnerable – the moment they feel rushed, scared, or desperate.
“The thing is, none of this is possible if there isn’t a culture within which understanding employees’ realities becomes both an incentivised expression of compassion as well as a business imperative,” says Collard.
Ultimately, healthy employees are engaged and motivated, which is conducive to greater organisational productivity and security. “Mental health is a fundamental human and business priority that, when taken seriously, strengthens both people and performance.”