How Often Should You Be Training Your Employees?

You’ve completed your phishing training for the year. Your employees have now learned the best ways to spot and respond to phishing emails. You’re feeling relatively confident about your company’s IT security! 

That is, until roughly six months later, your business suffers from an unexpected costly ransomware attack. One of your employees accidentally infected your network by clicking on a phishing link. 

 So, what was the point in training your employees each year about the same security threats if your company still managed to suffer from a security incident? 

 Well, it’s not that the security training wasn’t effective. Cyber awareness training is actually essential in defending against sophisticated cyber-attacks (which have reached an all-time high).  

 The problem lies with not training your employees often enough. 

 People can’t change their behaviors unless they experience reinforcement. In addition, your staff will typically forget what they’ve learned after several months have passed. 

It turns out that training your employees every four months provides your company with the most effective employee threat detection and response. This training frequency allows your organization to experience the most consistent results in your IT security. 

Why Training your Employees Every 4-Months is Advised. 

The four-month recommendation comes from a recent study presented at the USENIX SOUPS security conference. This study analyzed users’ ability to detect phishing emails relative to security training frequency. In other words, it looked at the relationship between training on phishing awareness and IT security. 

In the study, employees took phishing identification tests at various time increments that included: 

• 4-months
• 6-months
• 8-months
• 10-months
• 12-months

 The study’s results indicated that employees’ training scores were good four months later. For up to four months, employees could still identify and avoid clicking on phishing emails accurately. However, after 6-months, training scores started to decline. The scores steadily decreased as more months passed from the initial employee security awareness training. 

 The results indicated that training and refreshers on security awareness are essential to keeping employees well prepared and helping them strengthen your company’s cybersecurity strategy.

How to Train Employees & Develop a Cybersecure Culture  

 The gold standard for cybersecurity awareness training is to develop a cyber-secure culture, which means everyone in the company is aware of the need to protect sensitive data within the organization. This includes avoiding phishing scams and other cyber threats and keeping passwords secure. 

 Unfortunately, according to the 2021 Sophos Threat Report, this is not the case in most organizations. One of the biggest threats to network cybersecurity is the lack of good security practices. The report stated that poor security hygiene was the primary cause of many of the most damaging attacks investigated. 

 Well-trained employees greatly reduce a company’s security risk by decreasing the chance of becoming victims of various online attacks. Being “well-trained” doesn’t mean you need to conduct a long day of cybersecurity training. It’s best to mix up your security awareness delivery methods. 

 Here are examples of some engaging ways you can train your employees on cybersecurity. Include the following in your training plan: 

• Security awareness videos for individual completion emailed once per month
• Team-based roundtable discussions
• Security “Weekly Tip” in company newsletters or other messaging channels
• Training session hosted by an IT professional 
• Randomized simulated phishing tests
• Cybersecurity posters
• Celebrate Cybersecurity Awareness Month in October 

 Although phishing is a major topic you want to be sure to cover when conducting training, it’s not the only one. Bad actors use many different attack methods to get ahold of your data, and your employees must be up to date with those as well. Below are other important topics you want to include in your mix of cyber awareness training. 

You might also like