Quarterly phishing simulation is not enough on its own. Aggregated program data from security awareness vendors puts the average improvement in phishing resistance at 53% for organisations testing quarterly, against 73-74% for monthly testing and as high as 89% for weekly testing — while businesses testing less often than quarterly saw barely any improvement at all. Monthly is the realistic floor for most teams in 2026; quarterly is a starting point, not a destination, and the gap between the two cadences is large enough to matter at renewal time, at audit time, and every time a real phishing email lands.
TL;DR
- Quarterly-only phishing testing shows roughly a 53% average improvement in phishing resistance versus 73-74% for monthly testing, per aggregated 2026 program data.
- Weekly or fortnightly testing lifts improvement rates to 80-89%, but suits finance, HR and executive roles more than a whole-company rollout.
- Cyber Aware's monthly-cadence phishing programme reports an average 80% reduction in clicked links within eight months.
- Sending more than three simulated phishing emails a month tends to lower reporting rates as staff disengage.
Why this matters
Phishing is still one of the most common ways attackers get into a business, and a training session run once a year does nothing to change how someone reacts to an urgent-looking email six months later. Simulated phishing tests are the only way to measure whether staff actually apply what they learned, rather than just complete a module and forget it by lunchtime.
The debate is not whether to test — it's how often. Test too rarely and the skill decays between campaigns. Test too often with the same difficulty and staff start recognising the simulations rather than the underlying scam pattern, which is a different failure mode with the same result: a real phishing email gets through.
Is quarterly phishing simulation enough?
No — not as a standalone program. The clearest evidence comes from a large-scale analysis of phishing test frequency published by KnowBe4, which grouped organisations by how often they ran simulated phishing tests and measured the average improvement in phish-prone percentage over time.
| Testing cadence | Average improvement rate | Best suited to |
|---|---|---|
| Less than quarterly | ~39% | Not recommended for any team |
| Quarterly | 53% | A starting baseline, not an end state |
| Monthly | 73-74% | Most businesses in 2026 |
| Fortnightly | 80% | Finance, IT admin, high-risk roles |
| Weekly or more | 89% | Executives, finance approvers, incident-prone teams |
The same analysis found that groups running weekly-or-more tests reduced phishing risk 2.74 times more effectively than groups testing less than quarterly.
Verdict: quarterly testing is a reasonable place to start a brand-new program, but it should be treated as month one of a plan to reach monthly, not the permanent cadence.
Quarterly phishing simulation: a 53% improvement ceiling
A quarterly-only program sends staff a simulated phishing email roughly four times a year. That's enough to establish a baseline and get a first read on who clicks, but the six-to-twelve-week gap between tests gives skills time to fade — especially for staff who don't handle email-based decisions as part of their daily role.
Quarterly suits a business running its very first phishing program in 2026, where the goal is building acceptance of testing as normal practice before ramping frequency. It's a weak long-term choice for any business that has already run one or two campaigns and wants to see click rates actually fall.
Monthly phishing simulation: the 2026 practical floor
Monthly testing is where most security vendors and analysts converge as the realistic minimum. Hoxhunt's 2026 phishing simulation playbook states plainly that it recommends "minimum monthly" cadence to balance realism against simulation fatigue, and Brightside AI's guidance places monthly cadence as the standard for 80% of employees in a mature program.
Cyber Aware's own phishing simulation programme runs on a monthly cadence by default, generating a year of varied campaigns from one setup and reporting an average 80% reduction in clicked links within eight months of consistent testing. That outcome lines up with the third-party data above: monthly testing is the point where improvement rates cross from modest to substantial.
Verdict: monthly is the default cadence to run for the whole company in 2026, unless a role genuinely warrants more.
Weekly and fortnightly phishing simulation: for high-risk roles only
Weekly or fortnightly testing produces the strongest improvement rates in the data — 80-89% depending on the exact interval — but it isn't meant for every employee. A Gartner Peer Community discussion on simulation cadence recommends reserving higher frequency for departments with elevated risk, citing finance teams handling wire transfers and approvals as the clearest case. Brightside AI's guidance agrees, placing bi-weekly to weekly testing specifically for exposed roles in finance, healthcare or government rather than a blanket policy.
The reason is fatigue, not effort. SoSafe's own platform data found that sending more than three simulated phishing emails a month to the same person causes engagement and effectiveness to decline — people start recognising the test pattern rather than the scam pattern, and reporting rates drop.
Verdict: layer weekly or fortnightly testing on top of a monthly company-wide baseline for finance, HR and executive roles — don't apply it everywhere.
How to move from quarterly to monthly without overwhelming staff
- Ramp gradually. Add one extra simulation per quarter rather than jumping straight from four tests a year to twelve.
- Automate scheduling. A platform that pre-builds a year of campaigns removes the manual effort of building a new lure every month.
- Vary the template. Rotate through different scam formats — invoice fraud, credential resets, delivery notices — so staff learn to spot patterns, not specific emails.
- Escalate difficulty for repeat passers. Staff who consistently pass easy simulations should see harder ones, while staff who click stay on foundational content longer.
- Report the trend, not just the score. A single month's click rate means less than a falling trend across six months of testing.
Why phishing simulation frequency varies by business
- Program maturity. A first-year program benefits from a quarterly-to-monthly ramp; a three-year program should already be at monthly or better.
- Role-based risk. Finance and approval-chain roles face higher-value targeted scams than a general admin inbox.
- Fatigue tolerance. More than roughly three tests a month per person tends to reduce, not improve, reporting behaviour.
- Template variety. A library that recycles the same handful of templates loses its training value faster regardless of frequency.
- Reporting culture. Businesses that celebrate reporting rather than punishing clicks sustain higher-frequency testing without morale damage.
Does more frequent phishing testing always mean lower risk?
Not indefinitely. The data shows real, compounding gains from quarterly to monthly to weekly, but every source above also flags fatigue as the ceiling. The improvement curve is steep between quarterly and monthly, meaningfully positive between monthly and weekly for high-risk roles, and flat once testing volume exceeds roughly three emails a month for any one person.
FAQ
Is quarterly phishing simulation enough?
No, not as a permanent cadence. Quarterly testing shows roughly a 53% average improvement rate against 73-74% for monthly testing, according to aggregated 2026 program data, so it works as a starting baseline rather than an end state.
Is monthly phishing simulation better than quarterly?
Yes. Monthly testing produces a 73-74% average improvement rate in phishing resistance compared with 53% for quarterly-only programs, based on KnowBe4's phishing test frequency analysis.
How often should high-risk roles like finance be tested?
Weekly or fortnightly testing suits finance, HR and executive roles specifically, producing 80-89% average improvement rates, while the rest of the company runs on a monthly baseline.
Can phishing simulations be run too often?
Yes. Sending more than roughly three simulated phishing emails a month to the same person tends to lower reporting rates as people start recognising the test pattern instead of the scam pattern.
What cadence should a brand-new phishing program start with?
A new program can start quarterly to build staff acceptance of testing, then ramp to monthly within the first year as the baseline data comes in.
How much does phishing simulation cadence affect click rates in practice?
Cyber Aware's own monthly-cadence phishing programme reports an average 80% reduction in clicked links within eight months of consistent testing.
One last thing
The frequency debate misses the bigger lever: template variety. A monthly program that reuses the same five templates trains staff to recognise those five emails, not the underlying scam pattern — a fresh library matters as much as the calendar interval.