Skip to content
English - United States
Schedule Consultation
  • There are no suggestions because the search field is empty.

What Is Security Awareness Training and How Often Should We Do It?

Teaching staff to spot phishing and scams, then testing them. What good programs include.

Security awareness training teaches employees to recognize phishing, social engineering and unsafe habits, and pairs that instruction with simulated phishing tests to measure whether it is working. Since most breaches begin with a person clicking, replying or approving something, trained staff are one of the highest-return security controls available.

What a good program includes

  • Short, recurring lessons. A few minutes a month beats an annual hour nobody remembers. Topics: phishing, business email compromise, password hygiene, MFA prompts, safe file sharing, physical security, reporting.
  • Simulated phishing. Realistic test emails sent on a schedule. Anyone who clicks gets immediate, non-punitive coaching.
  • Role-based content. Finance and HR see invoice-fraud and payroll-diversion scenarios; executives see whaling attempts.
  • A reporting path. A report button or address, and quick feedback so people keep using it.
  • Metrics. Click rate, report rate and repeat-clicker follow-up, reviewed quarterly.
  • Onboarding. Training in the first week, because new hires are targeted specifically.

How often

Monthly micro-training with monthly or quarterly phishing simulations is the common cadence. Annual-only training satisfies a checkbox and little else.

What it is not

A substitute for technical controls. Filtering, MFA and endpoint detection catch what training misses; training catches what technology misses. See how employees spot phishing and what is social engineering for the content people need most, and how human error leads to breaches for why it matters.

Compliance and insurance

Recurring training is expected by cyber insurers, PCI DSS, CMMC, HIPAA and most customer security questionnaires.

Recurring security awareness training and phish testing are included in every Mentis Group Fully Managed IT plan and in Enhanced Cybersecurity.

Have a question about your own environment? Schedule a consultation with Mentis Group or call (866) 901-7808.