How often should security awareness training be done?

Baseline: annual formal training at minimum. This establishes foundation and satisfies compliance requirements. Once yearly alone is insufficient for behavior change.

Ongoing reinforcement: monthly or quarterly simulations, regular reminders about current threats, and just-in-time training when threats are relevant. Continuous awareness maintains vigilance.

Triggered training: additional training after security incidents, when threats targeting your organization emerge, and for employees in high-risk roles. Responsive training addresses specific risks.