Process engineers learned long ago that an operator buried in alarms is not a safety layer. Alarm management became a discipline, and ISA-18.2 a standard, because floods of low-value alarms turned the person at the console into the weakest part of the system.
Operational technology (OT) security is repeating the early version of that mistake. The engineer who wakes at 3:00 a.m. already replaying an alert queue is not undisciplined. Work-stress insomnia is a recognized clinical pattern, and therapy for work-stress insomnia treats it as a condition rather than a character flaw. But the better fix starts upstream in how industrial organizations design the load they place on a small number of security people.
Why OT alerting wears people down differently
In most information technology (IT) environments, the instinctive response to a suspicious event is containment: isolate the host, block the address, and reset the account. In a plant, that same reflex can trip a process, stop a line, or create a safety condition. Every OT security alert therefore carries two questions at once: Is this an attack, and what does responding to it do to production and safety? That is a heavier judgment than most IT alerts demand, and it is usually made by fewer people.
Industrial security teams are often small, cover several sites, and share on-call duty among a handful of engineers. Vendor remote-access windows, maintenance outages, and turnarounds cluster at nights and weekends, exactly when the people with the deepest knowledge of the control network are expected to be reachable. The pager does not have to go off to cost a night. Anticipating it is enough to keep the nervous system on watch.
Over months, that pattern produces a recognizable kind of sleep loss. People fall asleep from exhaustion and then wake in the second half of the night with the day’s open decisions already running. The arousal that started with the job becomes self-sustaining, and it continues after the busy quarter ends.
Judgment degrades before output does
The most dangerous part is that performance often looks fine. A 2026 CEREVITY report, 62% of High-Achievers Report Worse Decisions While Hiding Strain, reviewed 261 high achievers who sought therapy through the CEREVITY network; 62 percent said their decision quality noticeably dropped during stretches when they were hiding strain from the people around them.
In an OT security role, decision quality is the job. Deciding at 2:00 a.m. whether to isolate a network segment, wake an operations manager, or let a vendor session continue is exactly the kind of call that suffers when someone is short on sleep and carrying strain they have not told anyone about. Metrics such as tickets closed and response times will not show it because the person keeps producing.
Why plant security staff rarely asks for help
People who work in critical infrastructure have reasons to keep strain to themselves. Small sites mean everyone knows everyone. Fitness-for-duty processes exist for good reasons, but they leave many workers unsure as to whether admitting to poor sleep or anxiety will cost them a shift, a qualification, or a promotion. Nuclear facilities already manage worker fatigue as a regulated safety issue under the Nuclear Regulatory Commission’s fitness-for-duty rules, which tells you how seriously the consequences are taken in at least one sector.
Security engineers add a professional layer to that caution. They know how much data an employer collects, and many assume, sometimes correctly, that anything routed through a company system can be seen by someone. So they wait, and the sleep problem that would respond well to early treatment becomes a long-running one.
What plant and security leaders can change
- Rationalize security alerts the way you rationalize process alarms. Every alert that reaches a person should have a defined response. If no one can say what action an alert requires, tune it, aggregate it, or remove it.
- Design on-call like shift work. Limit consecutive weeks on call, build structured handovers, and give recovery time after a night with real pages rather than expecting a normal day.
- Separate fatigue reporting from discipline. An engineer who says “I am not fit to make this call tonight” should be routed to a backup, not questioned about commitment.
- Make confidential support genuinely confidential. Tell staff plainly what any assistance program reports back to the company, and make sure they can get care that never touches a supervisor or a company system.
- Model it from the top. When a site or security leader openly protects their own sleep and recovery, the team learns that doing so is part of the job.
Industrial organizations already accept that human performance is a design variable in process safety. The people defending the control network deserve the same engineering attention. Treat their load like an alarm system, and fewer of them will be awake at 3:00 a.m. wondering what they missed.
