How Often Should Staff Complete Cyber Security Training?

Here’s an uncomfortable truth we tell clients fairly often: the weak point in most cyber attacks isn’t a firewall or a server, it’s someone clicking a link they shouldn’t have on a Tuesday afternoon. That’s not a dig at anyone, it happens to good, careful people all the time. It’s just how these attacks are designed to work.

Staff should go through formal cyber security training at least once a year, with shorter refreshers, like phishing simulations, every 1 to 3 months. One session a year sounds like a lot until you realise most people forget the bulk of it within a few weeks.

Why Once a Year Isn’t Really Enough on Its Own

A good annual session covers the essentials: spotting a dodgy email and knowing who to tell if something feels off. The trouble is that knowledge fades fast when the team is busy. It’s not a failing on anyone’s part, it’s just how memory works. Without something to keep it topped up, most of what people learn in a single training session has faded within a few months.

That’s where the shorter, more regular stuff earns its keep. A phishing simulation every month or two, a quick reminder email, a five minute refresher here and there, none of it takes much time but it keeps people alert. It also gives you a genuinely useful read on how your team is doing, because you can see exactly who clicked the test email and quietly check in with them rather than guessing.

New starters need this from day one, not whenever the next annual session happens to fall. Someone joining your business in March shouldn’t be waiting until November to learn what a phishing email looks like. The same goes for moments like a new system going live, or a big attack making the news, both are good excuses for a quick top-up.

A Sensible Training Rhythm

Activity	How Often	What It’s For
Full security awareness training	Once a year	Covers the core ground properly: phishing, passwords, data handling, device security
Phishing simulations	Every 1 to 3 months	Shows you how people actually respond, not just what they remember in theory
New starter training	Within the first week	No gaps in awareness just because someone’s new
Refresher emails or short modules	Monthly, or after a notable incident	Keeps it front of mind between the bigger sessions
Role-specific training	As needed	Extra depth for anyone handling sensitive data, finance, or admin access

FAQs

Is this actually a legal requirement? Not in the sense of a specific UK law setting a fixed frequency, but GDPR does require “appropriate” measures to protect data, and regular training is widely treated as part of that. Some insurers and industries set their own expectations too, so it’s worth checking your policy.

What actually works best, formal training or the quick stuff? Honestly, both, used together. The annual session builds understanding, the regular phishing tests and reminders build habits. Too rare and it’s forgotten, too frequent and people start tuning it out.

Does training actually make a difference, or is it just box-ticking? It genuinely helps. Businesses running regular simulations see click rates on test emails drop steadily over time, and staff get quicker at flagging suspicious messages rather than ignoring them.

Does everyone need the same training? The basics, yes, everyone. But anyone with access to finance systems or admin privileges is a bigger target if their account gets compromised, so it’s worth giving that group a bit more depth.

Someone on our team failed a phishing test, what now? Keep it light. A friendly “here’s what to look out for next time” gets a far better response than treating it like a telling off, and it means people are more likely to come to you when something genuinely looks suspicious, rather than hiding it out of embarrassment.