Monthly is the cadence that works for most organisations in 2026: one short session of 10 to 15 minutes, paired with a monthly phishing simulation. Annual training still ticks the compliance box on most checklists, but the recognition skills it teaches fade between sessions — Cyber Aware's benchmark for monthly programmes is an average 80% reduction in clicked phishing links by month eight, and that benchmark assumes the repeats actually happen. Cyber Aware's monthly-cadence training is built around exactly that rhythm.
How often should you do security awareness training?
The three cadences organisations actually run, side by side:
| Cadence | Sessions per year | What it gets you | Where it falls short |
|---|---|---|---|
| Annual | 1 | Meets most written compliance minimums at the lowest cost | Skills decay between sessions; nothing to measure between December meetings |
| Quarterly | 4 | Better retention than annual; fits tight budgets and rosters | Still leaves three-month gaps where habits slip |
| Monthly | 12 | Behaviour change you can measure month over month | Needs short, well-made sessions or it becomes wallpaper |
Monthly wins in 2026 because it is the only cadence that produces a number every month you can act on — who is overdue, who clicked, who reported. Quarterly and annual programmes measure a moment, not a behaviour. This page explains why the monthly rhythm matters and when the other two cadences are good enough.
Annual training: the compliance minimum
One long session, once a year — usually a video or a slide deck, usually completed in a rush by December. It satisfies a checklist. It does not build a reflex: staff who saw one phishing email twelve months ago are being tested against tactics that have moved on, and there is no measurement between sessions to tell you whether anyone changed.
Use annual only when the risk is genuinely low and a contract requires it. Even then, add phishing simulations, because an unmeasured programme is a hope, not a control.
Quarterly training: the middle ground
Four sessions a year of 20 to 30 minutes each. Better retention than annual, easier to roster than monthly, and a sensible fit for very small teams with low turnover. Pair it with quarterly phishing simulations so the training has something to prove.
The gap is still three months long. Habits — verifying a bank-detail change, hovering over a link — need repetition to survive contact with a busy inbox.
Monthly training: the cadence that changes behaviour
Twelve short sessions, 10 to 15 minutes each — under three hours a year, total. The format is microlearning: one topic, one scenario, one quiz. Pair it with a monthly phishing simulation and the two reinforce each other — the simulation tests what the session taught.
The measurable part matters as much as the cadence. On monthly programmes, Cyber Aware's published benchmark is an average 80% reduction in clicked links by month eight, with the steepest drop in the first 90 days. You only see that curve if you are running the cadence that produces data points every month.
Why the right cadence varies
- Turnover — high-churn teams (retail, hospitality, franchise networks) are onboarding someone new every month; annual training never touches most of the current staff.
- Framework and insurance pressure — the Essential Eight, published by the Australian Signals Directorate as a baseline set of mitigation strategies, is framed as an ongoing programme rather than an annual exam; insurers increasingly ask for documented, recurring training at renewal.
- Programme maturity — a first-year programme needs more contact to establish habits; a mature team can stretch to six-weekly without losing much.
- Budget — monthly microlearning costs less per session than an annual workshop, but the platform and content still need to exist.
Related questions
How long should each training session be?
10 to 15 minutes on a monthly cadence. Short sessions finished are worth more than long sessions skipped.
How often should phishing simulations run?
Monthly, on the same rhythm as the training. Cyber Aware's guide to phishing simulations covers what a monthly campaign measures and what happens when someone clicks.
Is annual training enough for compliance?
Sometimes, for frameworks that only ask for evidence that training occurred. Questionnaires that ask for recurring, documented training — common in cyber insurance underwriting — are not satisfied by a single annual session.
FAQ
How often should security awareness training run in 2026? Monthly for most organisations: a 10-15 minute session plus a phishing simulation each month. Annual training is the compliance floor, not the plan.
Is monthly training overkill for a small team? No. Twelve 15-minute sessions is about three hours a year — less than most teams spend in one annual compliance workshop, and it produces twelve data points instead of one.
What about new starters? Train them in their first week. A starter who joins in March and misses the January annual session goes ten months untrained; a monthly programme catches them at the next cycle.
Can we run monthly training ourselves? The content is findable; the hard parts are cadence discipline and measurement. That is the problem a platform like Cyber Aware solves — monthly courses plus Auto Phish, which schedules a full year of varied phishing campaigns from one setup.
Does a monthly cadence actually reduce phishing clicks? On Cyber Aware's benchmark, yes: an average 80% reduction in clicked links by month eight on monthly-cadence programmes, with most of the improvement inside the first 90 days.