You ran the training. Everyone sat through it, everyone passed the quiz, and you ticked the box for another year. Five months later someone in accounts clicks a link in a fake invoice and you’re wondering what the training was for.
That’s not a failure of the people or of the material. It’s a failure of the schedule. Annual cyber security training for employees expires long before the year does, and there’s research that puts a number on it.
How long does security awareness training actually last?
The most useful study on this was presented at the USENIX SOUPS conference in 2020. Reinheimer and colleagues ran an investigation of phishing awareness and education over time across 409 employees of a German public administration body, testing both the initial training and four different ways of reminding people afterwards.
Two findings matter for a small business:
- The effect of the initial training held up for about four months. By six months it had degraded significantly.
- Reminders built on videos and interactive examples worked best, and kept people sharp for at least another six months. Simple text reminders did much less.
So the honest answer to “how often” is: you have roughly a four month window before a single training session stops carrying its weight, and the fix isn’t another full session, it’s a short, interactive reminder.
The Australian Signals Directorate makes the same point without the numbers. Its guidance for small business says awareness and training need to be regular, because the threats keep changing, and describes employees as the first and last line of defence.
A schedule that works for a business of 10 to 50 people
Nobody in a small business is going to run four full training days a year. You don’t need to.
Once a year: the real session. Forty five minutes, everyone in the room or on the call, run by a person who can answer questions. Cover what’s actually happening to businesses like yours, not generic slides.
Every three to four months: a short reminder. Five minutes of video, or a walk through of a real phishing email that got through the filter, with the giveaways pointed out. This is the part the research says does the heavy lifting, and it’s the part most businesses skip.
Monthly: something small. A tip in the team channel, a two minute item in an existing staff meeting, a screenshot of a scam doing the rounds.
On day one: induction. New starters shouldn’t wait ten months for their first session. Put it in the onboarding checklist alongside the laptop and the logins.
Ongoing: simulated phishing. A test email sent to staff, with a short explainer for anyone who clicks. Used as a teaching tool, not as a way to catch people out. If people are frightened of being named, they’ll stop reporting, and reporting is the whole point.
What to cover, in rough priority order
Email fraud and invoice scams. This is where the money actually goes. Fake invoices, a supplier suddenly “changing bank details”, a request that appears to come from the boss. The rule to drill is one line: a change of bank details or an urgent payment request never gets actioned on email alone, no matter who it appears to come from. It gets a call back on a number you already had.
Passwords and the manager. ASD recommends passphrases of four or more random words, unique to each account, and a password manager to hold them. Teach the manager, not just the rule, or people will keep reusing the one they can remember.
Multi-factor authentication, and the fatigue attack. Everyone knows to turn MFA on. Fewer people know that approving a prompt you didn’t ask for is how accounts get taken. Teach staff to deny and report, not to tap approve to make it stop.
Phishing beyond email. Text messages and messaging apps are now a normal delivery route. Show examples of both.
What to do when it goes wrong. Who to ring, how fast, and the promise that nobody gets in trouble for reporting. This one line does more for your security than another slide about password complexity.
Does any of it work? Here is what we see
Over the twelve months to 18 August 2026, our service desk received six tickets from five client businesses where a staff member had spotted a suspicious or fraudulent email and sent it in rather than acting on it. One of those was a fake overdue invoice asking for payment to new bank details.
Six doesn’t sound like many. It’s six payments that didn’t get made and six inboxes we got to check while it was still fresh, and every one of them came from someone who had been told what to look for and who to send it to.
The same period gave us 68 password requests and resets across 44 businesses, which is the other half of the picture. People forget passwords constantly, and every reset is a moment where someone is deciding whether to ring their IT provider or just reuse the old one. Training is what makes them ring.
Why this is getting more urgent, not less
The Office of the Australian Information Commissioner reported 1,205 data breach notifications in 2025, an 8% increase on the 1,112 notified in 2024 and the highest year on record. Of those, 716 were attributed to malicious or criminal attack.
Those are notifications from organisations covered by the Privacy Act, so the real number across Australian business is larger. The trend is the point: this is not a problem that is quietly solving itself while your training sits in a folder from last year.
The one thing to change this month
Put a recurring calendar entry in, right now, for a fifteen minute security reminder every four months, and give it an owner. Not a training day. A reminder, with a real example in it.
If you’d like a look at what’s actually reaching your staff’s inboxes before you build the training around it, get in touch.