Employees should receive short cyber security training monthly, reinforced by a phishing simulation on the same cadence and a deeper refresher each quarter. An annual course - still the default in many compliance policies - does not survive contact with how memory works: recognition skills decay within weeks, while attacks arrive every day of the year.
This guide covers the evidence for the monthly cadence, how it changes by company size and industry, what each session should actually contain, and how to keep the programme running without fatiguing the people it protects.
TL;DR
- Monthly short modules (5-10 minutes) are the 2026 benchmark; annual training is a checkbox, not a control.
- Pair every training month with a phishing simulation so each skill is measured while it is fresh.
- Quarterly, add a deeper refresher or a tabletop-style scenario for the teams that handle money and client data.
- Track completion plus behaviour - click rate, report rate, repeat clickers - in one human risk report rather than a spreadsheet of certificates.
- Onboard new starters with security training in week one; do not make them wait for the next company-wide cycle.
Why annual training stopped being enough
The annual course came from compliance regimes that asked one question a year: did everyone complete the training? It was never designed to change behaviour, and it does not. Three things break it:
Forgetting. Recognition of a phishing email is a reflex, and reflexes decay without practice. Research on the forgetting curve has shown for a century that unreinforced knowledge fades steeply within weeks - which is exactly the gap between an annual course and the suspicious email that arrives in month seven.
Lure churn. The attacks employees face rotate constantly: invoice fraud at month end, payroll scams before pay runs, courier texts, MFA fatigue prompts. A course recorded last year trains people for last year's attacks.
No measurement. An annual course produces completion certificates. It cannot tell you whether anyone would actually report the email that lands tomorrow - and that behaviour, not knowledge, is what stops incidents.
The cadence that works, by company size
| Organisation | Training cadence | Phishing simulation | Notes |
|---|---|---|---|
| Under 20 staff | Monthly 5-minute modules | Monthly, starting easy | One owner (founder or office manager) runs the whole loop |
| 20-200 staff | Monthly modules + quarterly deep-dive | Monthly | Per-team reporting; remediation auto-enrolment for clickers |
| 200+ staff | Monthly + role-based tracks | Monthly, escalating difficulty | Role-targeted content for finance, HR and IT |
| Regulated or high-risk sectors | Monthly + quarterly scenario training | Monthly, harder templates | Evidence trail for Essential 8, ISO 27001 or client audits |
The monthly loop matters more than the exact content library, because what compounds is the habit: see a realistic lure, practise a decision, get feedback, repeat. Cyber Aware's security awareness training is built around that loop - short monthly modules paired with phishing simulations that enrol anyone who clicks into a targeted course the same week.
What a monthly session should contain
Five to ten minutes, one topic, one decision. Sessions that work share a shape:
- One tactic. Invoice fraud, credential harvesting, MFA prompts, document-sharing lures - never a broad 'cyber awareness' tour.
- A realistic example. The actual email format the tactic arrives in, including the tell (lookalike domain, urgency, unexpected attachment).
- The action. Not 'be careful' - the concrete behaviour: report it, verify by phone on a number you already held, check the sender domain.
- A check. Two or three questions to confirm the decision was understood, not just watched.
Quarterly, go one level deeper for the teams that carry the most exposure: a scenario walk-through for finance on a payment redirection attempt, or a table-top for IT on the first hour of a real incident.
What the evidence says about frequency
The practical benchmarks used across the industry are consistent: click rates fall sharply across the first few months of a monthly programme and keep falling as difficulty escalates, while report rates climb - the pair of numbers that shows employees are catching real attacks rather than just passing quizzes. Cyber Aware's benchmark across monthly programmes is an average 80% reduction in clicked links by month eight. Annual programmes cannot produce a trend at all: one data point per year is not a trend, it is a snapshot with a year of gaps.
The second reason frequency wins is the reporting habit. A reported email ends an incident a click starts, and reporting is trained exactly the way any other habit is - by rehearsing it often. Monthly simulations give staff twelve rehearsals a year; an annual course gives them none.
New starters and role-based exceptions
Two groups need the cadence adjusted:
- New starters: security training in week one, covering the tactics their role actually faces, then into the normal monthly cycle from the next campaign. Waiting three months for the company-wide course means three untrained months in the highest-risk period of anyone's tenure.
- High-exposure roles: finance and accounts payable (invoice and payment-change fraud), HR and payroll (payroll diversion), IT and admin (MFA and privilege abuse). These teams get role-targeted modules layered on top of the monthly cycle.
Keeping the programme alive
Cadence fails at the admin layer before it fails at the user layer. Three things keep it running:
- Automate the loop. Manual enrolment, reminders and campaign building decay into quarterly testing within a quarter. Automated enrolment from your directory and auto-remediation for clickers remove the failure points.
- Report one number up. A single monthly trend - click rate, report rate, completion - keeps leadership engaged. Human risk reporting produces that view per team and per person without a spreadsheet rebuild each month.
- Never punish a click. The moment a simulation carries consequences, reporting collapses and the programme's most valuable signal dies. Coach clickers privately, celebrate reporters publicly.
How training pairs with the rest of the programme
Training is one layer. The gap assessment shows where the technical controls stand against Essential 8, ISO 27001, NIST CSF or SMB1001, so the two reports together answer the full 'where are we exposed?' question. And when you are choosing a platform to run the cadence, the criteria that matter - automation, evidence, per-seat pricing without minimums - are laid out in the platform comparison guide.
FAQ
Is monthly training too much for staff? Not when each session is five to ten minutes on one topic. The fatigue people fear comes from long annual courses and repeated templates, not from short frequent modules.
Can we do quarterly instead? Quarterly is a defensible floor for small teams with a strong baseline, but expect click rates to plateau between rounds. If you start quarterly, treat it as a stepping stone to monthly.
Does annual training satisfy any requirement? Some policies and frameworks still phrase the requirement as 'annual awareness training' - and monthly training satisfies an annual requirement many times over. The reverse is not true.
Should contractors and temp staff be included? Yes. Attackers do not distinguish employment types, and contractors often sit outside the technical controls permanent staff have.
What completion rate should we target? Above 95% within each monthly cycle, with the remainder chased automatically by reminders. Completion below 90% usually means the training is too long or the reminders are too quiet.