People & Cyber Awareness
How often should employees complete cybersecurity awareness training?
Inxtinct Editorial Team · Sep 14, 2026 · 5 min read
A business can report that every employee completed annual cybersecurity awareness training and still struggle when a supplier emails new bank details to the finance team. The completion rate answers whether a course was finished. It doesn't tell you whether the employee knows which number to call, who can approve an exception or how to report a concern without feeling foolish.
That doesn't make annual training worthless. It means frequency should follow the decisions people need to make, rather than an arbitrary calendar rule.
There isn't one universal UK rule requiring every business to run a cybersecurity course every twelve months. Sector rules, contractual commitments and specific frameworks may impose expectations. For everyone else, the right schedule should reflect risk, roles and how quickly the organisation changes.
A workable rhythm for a small business
Start with four layers rather than twelve near-identical courses.
At joining: cover the basics before an employee gets broad access. Explain how to protect accounts and devices, where company information may be stored, how to recognise suspicious requests and how to report something unusual. The NCSC's free Top Tips for Staff package is a good example of accessible foundational content.
Every quarter: run a short exercise linked to an actual workplace decision. Finance might examine a supplier payment request. Sales might consider a file-sharing invitation from a prospect. Developers might review a generated code suggestion. Ten to twenty minutes is often enough for a focused discussion.
After significant change: update training when you introduce a new AI assistant, file-sharing tool, sign-in process, payment approval workflow or policy. Waiting until next year's course means employees work under the new conditions without guidance.
At least annually as an internal review point: assess what people learned, which incidents were reported, what controls changed and which roles need more attention. This is a review cadence, not a claim that one annual presentation is sufficient.
Not everybody needs the same training
A receptionist, developer and finance manager face different requests. Give everybody a common reporting process, then build role-based material around the choices they actually encounter.
For example, finance training should cover invoice changes, approval bypass and independent verification. Developers need practical checks around dependencies, secrets, access control and AI-assisted code. Senior leaders need to understand impersonation, escalation and their responsibility for creating exceptions under pressure.
A generic thirty-minute course can establish shared vocabulary. It usually cannot give each role enough realistic practice by itself.
What should a phishing exercise measure?
Click-through rate is easy to report and easy to misinterpret. A click may tell you something about message design, timing or how the exercise was run; it doesn't automatically measure overall security awareness.
A better exercise asks several questions: Did staff recognise that something was unusual? Did they check through a separate channel? Was the report easy to submit? Did the team know what to do if somebody had already replied or entered information?
Use the exercise to improve the workflow, not publicly embarrass an employee. If reporting requires locating an obscure mailbox, the training has exposed a process problem as much as a knowledge problem.
The NCSC's Exercise in a Box includes a suspected-phishing exercise that can be run with a small group in roughly 15–30 minutes. It's a useful model: no one taking part needs to be a cybersecurity expert.
A sample twelve-month schedule
| Time | Activity | Outcome to check |
|---|---|---|
| Month 1 | Foundation course plus reporting walkthrough | Staff know where to ask for help |
| Month 2 | Five-minute suspicious-email discussion | Staff explain their verification step |
| Month 3 | Finance or customer-service scenario | Escalation route works in practice |
| Month 4 | Short device and account refresher | People know the secure sign-in process |
| Month 5 | Spot the Phish exercise | Reports and discussion improve |
| Month 6 | Tabletop on an account compromise | Team understands roles and handoffs |
| Month 7 | AI data-sharing decision exercise | Staff know approved tools and data limits |
| Month 8 | One-minute microlearning reinforcement | Common mistakes are revisited |
| Month 9 | Supplier payment-change scenario | Independent callback is routine |
| Month 10 | Cloud-sharing permissions exercise | Owners can review access |
| Month 11 | Short phishing and impersonation refresher | Staff recognise non-link-based scams |
| Month 12 | Programme review and updated content | Training follows new risks and tools |
This is a suggested programme, not a regulatory checklist. A small team can combine sessions, while high-risk roles may need more frequent practice.
Keep it short when the topic is short
Microlearning works well for one decision: who to call, what not to paste into an AI tool or how to check a sharing setting. It isn't a replacement for a complete course on a complex subject. Neither should every topic become a sixty-minute video simply because that is how the organisation has always delivered training.
Mix full-length courses, short videos, interactive phishing checks and scenario-based drills. Give employees a way to learn on their phones and return to material when they need it, but don't measure effectiveness solely by minutes watched.
The manager's role matters more than the reminder email
If someone says “the supplier has changed their account; should I verify?”, the manager's response teaches the team whether verification is valued. A manager who says “just get it paid” can undo a well-written course in five seconds.
Train managers to welcome reports and follow the agreed process themselves. When a simulation uncovers a confusing approval workflow, fix the workflow. Education cannot reliably compensate for controls that reward unsafe shortcuts.
How Inxtinct approaches this
Inxtinct's live cyber awareness workshops give teams space to practise realistic requests and discuss the answer together. Inxtinct Learning provides ongoing courses, short lessons and interactive exercises between sessions. They solve different parts of the same problem: understanding the rules and being ready to use them.
