A phishing email lands in an inbox on a Tuesday morning. The employee who opens it may have sat through a security briefing six months ago, a year ago, or never. How often you run employee cybersecurity training is the difference between a workforce that recognizes the pattern and one that learns it the hard way.
There is no single interval that fits every organization, and the published guidance from major security voices does not pretend otherwise. What the research describes is a structure: new hire training plus regularly scheduled refresher courses, built to establish a cybersecurity culture employees carry with them instead of forgetting after one session. The real question is how to fill the space between those two anchors.
Why a fixed calendar date is the wrong anchor
Security awareness training exists to teach workers about the threats they and their employers face. That threat set moves faster than most training calendars. Phishing campaigns change their lures, social engineering scripts adapt to whatever is in the news, and ransomware crews adjust their tactics. A schedule that only looks at the calendar, and never at what is happening around the business, will always lag behind.
Travelers, in its guidance for employers, recommends that new hire training and regularly scheduled refresher training courses be established in order to instill the cybersecurity culture of the organization. That is a two-part commitment, not a frequency. Your job is to decide how often the refresher happens based on your own exposure: how many people you employ, how much turnover you see, which systems hold sensitive data, and which obligations apply to your industry. Any regulatory or contractual training requirement should be confirmed with the relevant official source rather than assumed.
What the training should actually cover
Before debating frequency, it helps to be clear about content. If your sessions are the same three slides every time, running them more often will not help. Awareness material should cover the threats employees actually meet:
- Phishing, including suspicious emails, malicious links, and fake login pages
- Social engineering tactics that lean on trust, urgency, or authority
- Malware and ransomware, and how they typically arrive
- Insider threats, whether malicious or accidental
- Secure practices such as using secure connections like a VPN and avoiding public Wi-Fi for sensitive work
Broader programs can reach into cloud security, risk management, surveillance topics, and malware analysis, depending on whether you are training general staff or technical teams. Most organizations end up with two tracks: a short, repeated awareness track for everyone and a deeper track for IT and security staff.
A three-layer cadence that holds up
Layer one: new hire training
Every new employee should complete cybersecurity training during onboarding, before or very soon after they receive access to email and internal systems. This is when habits form and when the organization’s expectations are easiest to communicate. It is also when you explain what to do when something goes wrong: who to contact, how to report a suspicious message, and why reporting quickly matters more than being certain.
Layer two: scheduled refresher training
Refreshers keep the material alive after onboarding. The research is clear that these should be regularly scheduled rather than left to chance, but it does not fix an interval. A practical approach is to set a baseline and adjust it as evidence accumulates. If staff handle sensitive data, work with payment or health information, or deal with a high volume of external email, a tighter rhythm makes sense. If your environment is smaller and more contained, a longer interval may be defensible.
Layer three: event-driven training
Some of the most valuable sessions are not on the calendar at all. When a wave of phishing targets your sector, when an employee nearly falls for a convincing fake invoice, or when a peer company suffers a public breach, run a short focused session within days. Real events make abstract warnings concrete, and a fifteen minute briefing tied to something that just happened sticks far better than a generic slide deck about risks in general.
How to pick your refresher interval
Work backwards from how fast your risk changes. Ask questions like these:
- How many people joined since the last full session? Anyone hired since then has only had onboarding training.
- Has the way you work changed, through a new cloud platform, a new payment process, or a shift to remote work?
- What did the last phishing simulation show, and how many people reported the message rather than clicking it?
- Have you had an incident or a near miss? That is a signal to shorten the interval.
- What do your sector rules require? Verify with the regulator or authority that governs you.
A common failure mode is treating training as a compliance checkbox with one long session per cycle. Frequent short sessions tend to beat infrequent long ones, because both repetition and recency matter. Short formats are realistic: Amazon offers a 15-minute cybersecurity awareness training that covers identifying risks such as phishing and social engineering.
Free and low-cost resources worth using
Budget should not be the reason your cadence slips. Several well-known organizations publish usable material at no cost.
- CISA offers free online cybersecurity training covering topics such as cloud security, ethical hacking and surveillance, risk management, and malware analysis, along with training and exercise resources.
- Amazon’s security awareness training provides a short module on recognizing cybersecurity risks including phishing, social engineering, and data handling.
- CrowdStrike publishes a how-to guide aimed at small and mid-sized businesses that walks through building an employee training program with examples.
- Travelers offers guidance on empowering employees to recognize common threats and understand their responsibilities.
- Fortinet’s cybersecurity awareness guide and Augusta University’s online resource on employee cybersecurity awareness training cover secure practices and awareness fundamentals.
Combine these with your own internal examples. A generic module plus one real email your team actually received is far more effective than either one alone.
Signs your cadence is too loose or too tight
Too loose looks like this: people forward suspicious messages to colleagues asking “is this real?” instead of reporting them, staff cannot name the reporting channel, and the same mistakes repeat after each session. Too tight looks like this: employees click through modules without reading, treat the training as background noise, and retain nothing because each session arrives too soon to say anything new.
The healthiest signal is behavioral. Are reports of suspicious email arriving faster and in greater numbers? Do people hesitate before opening unexpected attachments? Do new hires know the process within their first week? Track those indicators alongside completion records, and adjust the interval based on what you observe rather than what the calendar says.
Documentation matters too. Keeping a simple record of who completed what, and when, supports internal reporting and any external requirements you face. Confirm the specifics of those requirements with your own advisers, insurer, or regulator, since they vary by jurisdiction and industry.
Frequently Asked Questions
Is annual cybersecurity training enough?
For many organizations, one session a year leaves long gaps in memory and awareness. The published guidance recommends new hire training plus regularly scheduled refreshers, which implies a shorter interval than a single annual event. Assess your risk, your turnover, and your sector requirements, and treat an annual session as a floor rather than a target.
Where can employees get free cybersecurity training?
CISA publishes free online cybersecurity training covering areas such as cloud security, risk management, malware analysis, and surveillance, along with exercise resources. Amazon also offers a short cybersecurity awareness module focused on identifying risks like phishing and social engineering. CrowdStrike, Travelers, and Fortinet publish free guidance that works well as supporting material for internal sessions.
What should new hires learn in their first training session?
New hires should learn how to spot suspicious emails, malicious links, fake login pages, and social engineering tactics, plus the basics of secure connections and safe handling of sensitive data. Just as important, they need to know exactly how and where to report anything suspicious, and that reporting early is valued rather than punished.
How long should each training session be?
Shorter sessions are easier to repeat and easier to absorb. Amazon’s awareness module runs about 15 minutes, which is a realistic length for a focused refresher. Long sessions have their place for technical staff, but general awareness works better as a series of brief, targeted modules spread across the year.
Should training differ between roles?
Yes. General staff need recurring awareness training on phishing, malware, ransomware, and social engineering delivered in short bursts. IT and security teams benefit from deeper material such as cloud security, risk management, and malware analysis. Executive and finance teams often need extra focus on social engineering, since they face targeted impersonation attempts.
