How Often Should Security Awareness Training be Conducted?

As cybercriminals become increasingly sophisticated in their nefarious methods, it is crucial for organisations to invest in security awareness training for their employees. But how often should this training be conducted to ensure its effectiveness?

In this blog post, we will explore the science of security awareness training and offer a guide to best practices regarding the frequency of training programs.

Start trial icon

Looking for the right training schedule?

Talk to one of our experts about optimising your employee training now.

Book a Meeting

Ongoing Security Training

When learning a new skill, consistent practice adds up. Well, as many studies have found, the same is true for employees and information security awareness training.

While providing employees with a single, or even annual training session may have some level of effect, put simply, a one-time or infrequent training approach is insufficient.

To ensure that the information security awareness-based knowledge is retained, many researchers (e.g., Caputo, et al.Kumaraguru, et al., and Jampen, et al.) have concluded that an information security program needs to be designed as an ongoing process - ideally one which is integrated into users' daily workflow.

Furthermore, knowledge gained from information security awareness training needs to be put into continual practice, in a way which allows individuals to retain this information and adopt these new behaviours into routine.

Persistent Training

Termed by some as 'Persistent Training', there is still some level of discussion about optimal regularity.

In the 2020 study, An Investigation of Phishing Awareness and Education Over Time: When and How to Best Remind Users, researchers found that users' ability to correctly identify phishing emails significantly improved directly after and four months after the deployment of training programme; though these anti-phishing skills were not, unfortunately, present six months after the educational intervention.

"Training should be designed... as an ongoing process within an organisation... Each user should be exposed to such training at least once every 5 months."

Reinheimer, B. et al.

Although biannual training may sound frequent, techniques such as embedded training, which includes simulated phishing attacks linked to resources, means relevant training can be conducted while minimising potential disruption or annoyance.

A further bonus of this form of training being that organisations can gather ongoing information and metrics as to how well their staff can identify and avoid various information security threats, while also steadily and deliberately increasing the breadth of users' knowledge.

Start trial icon

Try our Training for Free!

Start Now

Key Factors Influencing Training Frequency

While multiple studies indicate that a twice-yearly approach to information security awareness training would likely be best in most scenarios, there are some further considerations that come into play when determining the optimal frequency of security awareness training for employees:

  1. Cyber Threat Landscape: The current threat landscape plays a significant role in determining training frequency. If there is a surge in phishing attacks or other cybersecurity threats, it may warrant more frequent training sessions to ensure that employees are adequately prepared. Specially, in this case, simulated phishing campaigns.
  2. Regulatory Requirements: Certain industries and regions have specific regulatory requirements that mandate regular security awareness training (e.g., GDPR, ISO 27001). Compliance with these regulations often dictates the frequency of training sessions.
  3. Employee Turnover: High turnover rates within an organisation can necessitate more frequent training to ensure that new employees are quickly brought up to speed on security protocols.
  4. Emerging Threats: The emergence of new threats or attack vectors should trigger immediate training updates. For example, if a novel form of phishing attack becomes prevalent, organisations should respond promptly with targeted training sessions.
  5. Technological Changes: Advances in technology can introduce new security challenges. Whenever an organisation implements significant technological changes or upgrades, it's essential to provide training to address potential security implications.
  6. Feedback and Assessment: Regular assessments and feedback from employees can help gauge their awareness levels and identify areas where additional training is required. This feedback-driven approach can inform the timing and content of training sessions.

The frequency of security awareness training should be tailored to an organisation's unique needs, considering the factors mentioned above. While annual training is a baseline requirement, it's essential to remain flexible and responsive to changing threats and circumstances.

Ultimately, a proactive and adaptive approach to security awareness training is the key to ensuring that employees are well-equipped to protect against evolving cyber threats. By staying vigilant and informed, organisations can significantly enhance their cybersecurity posture and reduce the risk of falling victim to information security attacks.

Hut Six Training

Any organisation can fall victim to an information security incident. Despite technical precautions that help mitigate this risk, your employees are the most immediate and vulnerable target for malicious actors - and your first line of defence.

Now more than ever, you rely on your people making the correct choices in the face of security decisions. Thankfully, with the right knowledge, many of these human vulnerabilities can be easily addressed.

Hut Six's Security Awareness Training solution reduces the risk of a successful cyber-attack. Preventing financial losses, damage to reputation, potential fines, and litigation, robust and engaging information security training is an essential for any organisation looking to improve their information security culture.

Security Awareness for your Organisation

Enjoyed our blog? Learn more about how Hut Six can help improve you security awareness with training and simulated phishing. Start a free trial now, or book a meeting with one of our experts.


What is the Impact of Security Awareness Training?

What is the Impact of Security Awareness Training? - Hut Six

Discover the Impact of Security Awareness Training: Prevent breaches, foster culture, & build trust.

What is Personal Data? Definition & Types

What is Personal Data?

Learn about personal data, its types, and significance in data protection. Explore general and special category data, as well as pseudonymised and anonymised data under the GDPR.

GDPR Applications

Who Does GDPR Apply To?

Who Does GDPR Apply To? And Other Data Protection Questions/ Information Security blog by Information security awareness provider Hut Six Security.

Do AI Chatbots like ChatGPT Pose a Cybersecurity Risk?

Does ChatGPT Pose a Cybersecurity Risk

In this blog post, we explore whether AI chatbots like ChatGPT pose a cybersecurity risk. We delve into the potential vulnerabilities and threats posed by chatbots, and discuss measures that can be taken to mitigate these risks. Read on to discover how you can ensure the security of your organisation's chatbot interactions.

How to get Cyber Essentials Certification

How Do I Get Cyber Essentials Certified?

Learn how to obtain Cyber Essentials certification and enhance your organization's cybersecurity posture with our comprehensive guide. Our expert insights will help you navigate the certification process to meet the requirements for Cyber Essentials.

5 Essential Steps for Security Awareness Training

Essential Steps for Security Awareness Training

Starting a security awareness training campaign? Here are 5 essential steps to help ensure information security success.

Malicious Insider Threats

Malicious Insider Threats - Meaning & Examples

Malicious insider threats can cause massive problems. Here we examine some of the motivations behind attacks and methods of detection organisations can use to reduce risk.

What are the Biggest Breaches of 2022 (So Far)

5 Biggest Breaches of 2022 (So Far)

Five of the biggest and most significant data breaches, hacks, and information security attacks of 2022 (so far).

How to Audit for GDPR Compliance?

Auditing for GDPR Compliance

Questions to consider when auditing your business or SME for General Data Protection Regulation (GDPR) compliance.

Ideas to Improve Employee Cyber Security?

Improving Employee Cyber Security

With human error responsible for many breaches and attacks, we offer some helpful areas for improving employee security compliance.

Speak to us about your Cyber Awareness