Annual security awareness training is a floor, not a plan
Once a year is a floor, not a plan. New York's rule asks for training that is periodic, but at a minimum annual. In a German field study of 409 employees, the measured improvement was present at four months and gone by six. Plan a short reinforcement every six months.
- Every US rule that names a training interval calls it a minimum. New York's says periodic, but at a minimum annual.
- The FTC Safeguards Rule sets annual penetration testing and six-monthly vulnerability assessments, then sets no interval at all for training.
- In a field study of 409 employees, the measured gain was present at four months and gone after six.
- A five-minute video still showed an effect five months later, so short and repeated beats long and yearly.
- The UK's National Cyber Security Centre states that no training package can teach users to spot every phishing attempt.
How often should security awareness training happen?
Once before access and at least once a year is the published floor. Every US rule that names a number calls it a minimum, two of the main four name no number at all, and none of them describes a yearly module as a finished program.
This post is about cadence and format. A companion post covers who to train first when the budget only buys a handful of seats, so the ordering question is not repeated here. Read the two together.
New York's financial regulator is the most specific. It requires covered entities to provide periodic, but at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel. Read the first three words again. Periodic comes first. Annual is the floor underneath it.
CISA sets two triggers rather than one. New employees should receive initial cybersecurity training prior to accessing computer systems, and you should provide at least annual cybersecurity training for all organizational users covering social engineering, reporting attacks, complying with acceptable use policies and basic hygiene. At least, again.
HIPAA is vaguer than most buyers assume. The Security Rule tells a covered entity to implement a security awareness and training program for all members of its workforce and names no interval anywhere. Its one nod to reinforcement is called Security reminders, which says only Periodic security updates and carries the label Addressable. Addressable means you assess it and keep a documented decision, not that you must do it.
| Rule | Who it binds | What it says about frequency |
|---|---|---|
| 23 NYCRR 500.14 (New York DFS) | Covered entities under New York financial regulation | Periodic, but at a minimum annual, for all personnel |
| CISA CPG goal 3.J | Voluntary, all sectors | Before access to systems, then at least annual |
| HIPAA Security Rule 164.308(a)(5) | Covered entities and business associates | No interval. Security reminders are Addressable and say only Periodic security updates |
| FTC Safeguards Rule 314.4(e) | Financial institutions as the FTC defines them | No interval. Updated as necessary to reflect risks identified by the risk assessment |
Most small firms have not reached the floor yet
The cadence argument assumes you train at all. In the UK government's 2025 survey, around a fifth of businesses (19%) had provided some form of staff training in the previous 12 months, against three-quarters of large businesses (76%). Its Figure 3.9 breaks that down by size, putting micro businesses at 15 percent and small businesses at 34 percent. If you deliver nothing today, an annual module is progress. If you already run one, the rest of this is for you.
One rule dates the scans and refuses to date the training
The FTC Safeguards Rule puts a clock on technical testing and no clock on training. That contrast sits inside one rule, two paragraphs apart, and it is the clearest published hint that training is meant to track events rather than dates.
On testing the rule is exact. Absent effective continuous monitoring, it requires annual penetration testing of your information systems and vulnerability assessments at least every six months, plus a fresh assessment whenever there are material changes to your operations or business arrangements.
On training the same rule names no interval. The obligation is providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment. No month, no quarter, no year.
That reading is ours rather than the FTC's words, and it is the useful one. A regulator that writes six months in one paragraph did not run out of numbers in the next. It picked a different trigger. New York lands in the same place, requiring content updated to reflect risks identified by the covered entity in its risk assessment.
The published trigger is your risk assessment, not your renewal date.
So the question to put to whoever runs your training is not when it last ran. It is what changed in the content the last time your risks changed, and who signed that off. The rule reaches further than banks, so check whether it binds you before deciding it does not. Either way the structure is free to copy.
Why the annual module stops working before the year ends
The measured gain from an awareness program faded inside six months in the field study that tested its duration most carefully. Annual delivery leaves the back half of the year with nothing measurable in it.
Researchers ran a field investigation in a German organisation from the public administration sector with overall 409 employees. They measured the same thing four times, before the program, right after it, at four months and at six. Performance at correctly identifying phishing and legitimate emails was significantly improved directly after and four months after the programme's deployment. Then it went. This was not the case anymore after six months, indicating that reminding users after half a year is recommended.
A second team at the Karlsruhe Institute of Technology tested the short version. Almost 200 people watched a five-minute video, almost 80 came back for the follow-up, and the authors concluded that short videos can indeed still exert a positive influence five months later.
Scope both studies before you build a policy on them. Both ran in Germany, one of them inside a public administration body, with samples in the hundreds rather than the thousands. They are the best published measurements of how long awareness lasts, not a law of nature. What they agree on is the shape. Months, not a year.
Whether a mandatory module changes behaviour at all is a separate argument. A UC San Diego Health study found no significant relationship between whether users had recently completed an annual, mandated course and falling for phishing. Our post on who gets trained first covers that evidence and what it means for a small budget.
What does a national cyber authority say about the limits of training?
The UK's National Cyber Security Centre states the ceiling of this product in its own guidance. That is a national body conceding that training cannot carry the risk alone, which is not a sentence any vendor will put in a brochure.
It names the error first. Phishing mitigations often place too much emphasis on users being able to spot phishing emails. Then the ceiling. No training package, including phishing simulations, can teach users to spot every phishing attempt. Then the arithmetic most policies ignore. Asking users to examine, in depth, every email they receive will not leave enough hours in the day for work tasks.
Its own technical staff went further in a post that is still live. We know that telling users not to click on bad links just isn't working, it says, and attackers only need one person to fall for a ruse.
The spending conclusion follows. In Verizon's 2026 breach dataset, exploitation of vulnerabilities is now the most common initial access vector for breaches, risen to 31% in this year's reporting dataset, while credential abuse, the previous leader, is down to 13%. Read that narrowly. It ranks the doors attackers came through in one dataset and does not rank human error against technical failure. The useful part is that the largest single door in it is a patching job.
So price the training line as one layer and ask what the other layers in the same quote cost. The research above gives training a shelf life. Multi-factor authentication does not have one.
What to buy instead of a yearly event
Buy a life cycle rather than an event. That is what the current federal guidance describes, and you can read it before anybody quotes you a price.
NIST SP 800-50r1 sets out a life cycle approach to building a cybersecurity and privacy learning program. It states the outcome it expects, that the program should encourage behavior change as part of risk management, and it includes suggested metrics and evaluation methods to regularly improve and update the program as needs evolve. Nothing in that describes a slide deck in March.
Four things come out of it that a small firm can actually schedule.
- Refresh the content when your risk assessment changes, and record the date you changed it.
- Schedule a short, practical refresher training session at or before month six to reinforce the first one.
- Measure a behaviour rather than a completion rate.
- Name one person who owns the ongoing program and the training records.
On format the evidence points the same way twice. The German team reported that measures based on videos and interactive examples perform best, lasting for at least another six months, and the Karlsruhe study got five months out of five minutes. Five minutes twice a year is a smaller purchase than an hour once a year, and it is the version with published duration behind it.
On a phishing simulation, take the method and leave the scoring. NIST advises telling staff that the organization is conducting phishing exercises on a random basis and that the results will be used to guide future learning activities. It also puts the design past a lawyer, advising that the organization's legal team should be included in the design and review of planned phishing exercises rather than borrowing a real brand for the bait.
The NCSC adds one format that training vendors rarely sell. It tells organizations to ensure staff are familiar with the normal ways of working for key tasks. Teach the normal process and an abnormal request stands out on its own, which is a cheaper skill to maintain than inspecting a message. People then report the odd request instead of inspecting every message.
What to ask your provider for, in writing
Ask for five things and keep the answers on file. Each one is a sentence your provider can answer in an email, and together they describe a program rather than a purchase.
- Cadence. The dates of every session in the next 12 months, including the one near month six.
- Format. How long each session runs, and whether it is video, interactive or a slide deck.
- Coverage. Who is enrolled, including everybody who joined since the last session.
- Trigger. What updates the content when your risk assessment changes, and who signs it off.
- Measure. One behaviour number, plus the date the content last changed.
Two of the five you can verify yourself without asking anyone. If the only report you get back is a completion rate, you are buying attendance. If nobody can name the trigger that updates the content, the content runs on a renewal schedule rather than a risk schedule.
Higher-exposure jobs need more than the shared cadence. Role-based training for finance, administrators and leadership is a separate decision with its own published shortlist, and the companion post sets out the order. The point here is that those people need their extra session on the same six-month clock, not once at onboarding and never again.
None of this makes a business safe, and no provider can promise that. What it buys is a cadence with dates on it, a format with published duration behind it, and a written record of the decision for whoever asks next year.
FAQ
How often should security awareness training be done?
Once before access and at least once a year is the published floor. New York's rule asks for training that is periodic, but at a minimum annual. A German field study of 409 employees found the measured gain gone after six months, so schedule a short refresher around month six.
Does annual security awareness training actually work?
As a floor, not as a program. A UC San Diego Health study found no significant relationship between whether users had recently completed an annual, mandated course and falling for phishing. The NCSC states that no training package, including phishing simulations, can teach users to spot every phishing attempt.
Is there a legal requirement for how often to train staff?
It depends which rule binds you. CISA asks for at least annual cybersecurity training for all organizational users. HIPAA names no interval and calls its reminder specification Periodic security updates. The FTC Safeguards Rule names no interval either, only training updated as necessary to reflect risks identified by the risk assessment.
What format of security awareness training lasts longest?
Short video and interactive formats, on the only evidence that measures duration. Researchers reported that measures based on videos and interactive examples perform best, lasting for at least another six months. A Karlsruhe study found short videos can indeed still exert a positive influence five months later after a five-minute video.
Why is training completion rate a weak measure?
Completion records attendance, not behaviour. CISA's stated outcome for its training goal is that organizational users learn and perform more secure behaviors, and NIST says the program should encourage behavior change as part of risk management. Ask instead for one behaviour number and the date the content last changed.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on verified rating and firmographic data, paid placement is always labelled, and we do not sell IT services. Take the five questions above to merit-ranked firms in your city and compare the answers.