Cybersecurity is Stressful: The Impact of Stress on Identifying Phishing Attacks

Phishing remains one of the most pervasive cybersecurity threats, causing billions in annual damages. Despite advances in technical defenses, attackers exploit the human element, often leveraging urgency, authority, and fear to provoke hurried responses. While stress is frequently cited as a factor in phishing susceptibility, empirical evidence has been limited. This study experimentally examined the relationship between stress and phishing detection. Using an online adaptation of the Trier Social Stress Test (TSST), 150 participants recruited via Amazon Mechanical Turk (MTurk) completed a phishing identification task under time pressure, evaluative observation cues, and monetary incentives. Stress levels were assessed pre- and post-task using the State-Trait Anxiety Inventory (STAI). Although overall stress levels remained stable across the full sample, a subset of participants exhibited measurable increases. Within this subgroup, higher stress was significantly correlated with reduced phishing detection accuracy. These results suggest that acute stress impairs cognitive resources required for careful evaluation, increasing vulnerability to phishing. The study makes three contributions: (1) providing empirical evidence that acute stress can compromise phishing detection, (2) demonstrating the feasibility and challenges of applying controlled stress-induction methods in online experiments, and (3) raising critical implications for organizations that rely on employees as a frontline defense. The findings highlight the importance of stress-aware security training, workplace reforms to reduce cognitive burden, and future research integrating physiological and behavioral measures to better understand the role of stress in cybersecurity.