How often should employees do security training?
See who on your team would click, for free Request a free baseline phishing test for up to 25 staff, or start a free trial of the training platform. Request the free test → Everyone asks this. “Do we just do it once a year?”
So, how often should employees do security awareness training? The honest answer: no official source we found gives one magic number. But they all point the same way. Train at the start, then keep going.
What do the official sources say about training frequency?
They say to train regularly, not once. Three sources:
- CISA says to make training a regular part of staff onboarding and ongoing development, and to evaluate it by tracking incidents and phishing report rates.
- NIST says to train employees regularly to keep their awareness of phishing threats current.
- The FTC Safeguards Rule guide says to provide security awareness training and schedule regular refreshers.
Is once a year enough?
For most teams, no. People forget. New scams show up. New staff join. A once-a-year video is easy to click through and forget.
A yearly session can still be one part of the plan, like a review day. It should not be the whole plan.
What is a good training schedule for a small team?
Use a simple rhythm you can keep: a core lesson at hire, a short lesson each month, and a practice phishing email each month or quarter.
| When | What | Time |
|---|---|---|
| First week | Core lesson: phishing, passwords, reporting | 30 min |
| Every month | One short lesson on one topic | 5 min |
| Every month or quarter | A safe practice phishing email | 0 min of staff time |
| Twice a year | A 15-minute team talk on real stories | 15 min |
| When a new scam hits | A same-week note to everyone | 2 min |
| Once a year | Review numbers and update the plan | 1 hour for the lead |
Who needs training more often?
Some roles face more risk, so give them extra lessons.
- Finance and payments staff. They are the target of fake invoices and fake bosses. See business email compromise and deepfake CEO fraud.
- Managers and executives. They are the people criminals pretend to be.
- New hires and seasonal staff. Train them in week one.
- Anyone who just clicked. Use the moment, kindly. See what to do after a phishing click.
- Regulated teams. Health and tax teams may have rules that ask for ongoing training. See HIPAA training and FTC Safeguards for tax preparers.
What is a 12-month training calendar I can copy?
One topic a month keeps it light. Copy this list.
- January: Spot phishing
- February: Passwords and MFA
- March: Fake invoices and bank changes
- April: Texts, calls and QR codes
- May: Safe use of AI tools
- June: Working away from the office
- July: Reporting without blame
- August: Social media and oversharing
- September: Ransomware basics
- October: Cybersecurity Awareness Month refresher
- November: Holiday and shopping scams
- December: Year review and one quiz
How do I know it is working?
Look at three numbers every quarter:
- Report rate (should go up).
- Click rate on practice emails (should go down).
- Time to report (should get shorter).
If you do not track these, you are guessing. See How to train employees to spot phishing for how to measure.
Common mistakes
- One long session once a year, and nothing else.
- Practice emails with no follow-up lesson.
- Blaming the people who click. Thank the people who report.
- No records. Keep a list of who finished what, and when. See what auditors ask for.
- Starting too big. A 5-minute lesson that happens beats an hour that does not.
A worked example
A 10-person office starts in January. The owner assigns the core lesson to everyone in week one. Each month a 5-minute lesson goes out on the first Monday. In March the owner sends a safe practice email about a fake invoice. Four people click. A short lesson follows the next day. In June another practice email goes out, and two people click. The owner writes the numbers down and shares the good news with the team.
Can we do this with a small team?
Yes. Short lessons fit between tasks. Our curriculum has short lessons across tracks for all staff, finance, IT, managers and remote workers. See the course list and pricing. To see where you stand now, request a free phishing risk test.
Also read the security awareness checklist, or see how insurers think about it in does cyber insurance require training?
Questions people ask
Is annual security awareness training enough?
For most teams, once a year is a weak habit. CISA advises making training a regular, ongoing part of staff development, and NIST says to train regularly to keep awareness current.
How long should each lesson be?
Short. Five minutes is easier to finish than one long hour. Our lessons are 3 to 7 minutes.
How often should we run phishing tests?
Many teams do one a month or one a quarter. Pick a rhythm and track the report rate over time. Do not test so often that people stop caring.
Do regulations say how often?
Some rules ask for ongoing or regular training without a fixed number. The FTC Safeguards Rule guide says to provide security awareness training and schedule regular refreshers. HIPAA asks for periodic security updates. Check your own rule or ask your adviser.
How often should new employees be trained?
In their first week, before they get access to client or payment data if you can. Then they join the regular monthly rhythm.
What is the best way to track if training works?
Track three numbers each quarter: report rate, click rate on practice emails, and time to report. CISA also suggests tracking incidents and phishing report rates.