Push notification fatigue is the repeated prompting of a user until they approve an authentication request without careful review. Attackers use it to exploit distraction, urgency, or annoyance. It becomes especially dangerous when push approval is treated as a strong second factor without additional phishing-resistant protections.
Expanded Definition
Push notification fatigue is an authentication attack pattern, not a user experience annoyance in isolation. It appears when repeated mobile approvals, often delivered by an identity provider or MFA app, condition a person to accept requests reflexively. In NHI and IAM operations, it is closely related to multi-factor prompting abuse, social engineering, and MFA bypass attempts. The risk is highest when organisations treat push approval as sufficient proof of intent rather than one signal among several, especially where phishing-resistant controls are absent. Guidance varies across vendors on whether fatigue is a standalone attack class or a subset of MFA bombing, but the operational concern is the same: a human is worn down into granting access. NIST’s NIST Cybersecurity Framework 2.0 frames this as an access governance and detection problem, where repeated authentication anomalies should trigger response rather than continued prompting. The most common misapplication is assuming any approved push equals legitimate authentication, which occurs when approval workflows lack number matching, device binding, or step-up verification.
Examples and Use Cases
Implementing push-based authentication rigorously often introduces friction for users and support teams, requiring organisations to weigh convenience against the cost of stronger verification.
- An attacker triggers dozens of login prompts after obtaining a username, hoping the target approves one out of annoyance or confusion.
- A help desk agent sees a sudden burst of approvals and denies access, then escalates the event as a possible account takeover indicator.
- An organisation moves from simple push approval to phishing-resistant methods after reviewing the patterns described in the Schneider Electric credentials breach.
- A cloud admin console requires number matching and device context before approval, reducing the chance that repeated prompts will succeed.
- Security teams correlate repeated push requests with impossible travel, new device enrollment, or unusual sign-in time windows to separate fatigue from legitimate access.
In practice, the term often overlaps with broader MFA abuse, so teams should distinguish between accidental over-prompting and deliberate coercion. For identity programs built around strong assurance, phishing-resistant methods such as those discussed in NIST-aligned guidance are preferred when approval prompts are easy to exhaust. One useful benchmark from NHI Mgmt Group is that 97% of NHIs carry excessive privileges, which matters because fatigue-driven account compromise often turns a single user prompt into broad downstream access.
Why It Matters in NHI Security
Push notification fatigue matters because it undermines trust in the very control meant to stop credential replay and session hijacking. When a user approves under pressure, the attacker may gain access to systems that hold secrets, service account credentials, or orchestration privileges that support agentic workflows. That makes the incident far more than a one-time login failure: it can become an NHI exposure event if the compromised session is used to retrieve API keys, alter automation, or impersonate trusted workflows. NHI Mgmt Group notes that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage, which shows how quickly an access lapse can escalate into operational compromise. The issue also ties to governance: repeated prompts are a signal that authentication policy, alerting, and step-up controls are not aligned. Organisations typically encounter the real cost only after a user approves the wrong prompt and an intruder begins abusing the session, at which point push notification fatigue becomes operationally unavoidable to address.
For deeper context on how access failures become identity incidents, see the NHI Mgmt Group guidance on the Schneider Electric credentials breach and the broader Ultimate Guide to NHIs.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | AAL2 | Push approvals alone are weaker than phishing-resistant authenticator guidance. |
| NIST CSF 2.0 | PR.AA-1 | Repeated MFA prompts are an identity assurance and access validation problem. |
| NIST Zero Trust (SP 800-207) | Zero Trust assumes continuous verification, not blind trust in a push approval. | |
| OWASP Agentic AI Top 10 | A2 | Prompt abuse and approval coercion mirror social engineering against agentic workflows. |
| OWASP Non-Human Identity Top 10 | NHI-06 | Compromised access from fatigue can expose secrets and privileged NHI paths. |
Treat repeated approval events as a precursor to secret exposure and privilege abuse.
