How often to run phishing simulations, what changes at each cadence, and the scheduling mistakes that make results meaningless.
How often should you test your team? There is no single correct answer, but there is a clear principle: consistency beats intensity. A predictable rhythm builds habit; an occasional big exercise does not.
Deep dive: for scheduling, cadences, and building a 12-month plan, read How Often Should You Run Phishing Simulations?
What each cadence gives you
Monthly. Where most mature programmes land. Frequent enough that recognition becomes reflex, and enough data points that a trend is real rather than noise. The cost is administrative, which is why it usually needs automation to survive contact with a busy quarter.
Quarterly. A sensible starting point for smaller teams. You get useful data without much overhead, but the learning effect fades between rounds, so pair it with short monthly lessons to fill the gap.
Twice yearly. About the minimum that still counts as a programme. Enough to satisfy most framework expectations, not enough to change behaviour much.
Annually. Effectively a compliance exercise. Threats change constantly, and almost nobody remembers a lesson from eleven months ago at the moment it matters.
Why frequency does the work
Recognition is a skill, and skills decay. The first simulation tells you where you stand; it is the repetition that turns "I know phishing exists" into noticing something is wrong before clicking.
Frequent testing also protects you from a single misleading result. One campaign landing during a quiet week produces flattering numbers; one landing during quarter-end produces alarming ones. Neither is your real position — the trend across several is.
Scheduling mistakes worth avoiding
Predictable timing. Always the first Tuesday of the month, and people start expecting it. Vary the day and week.
The same lure repeatedly. Recognising your simulations is not the same as recognising phishing. Rotate pretext, channel, and difficulty.
Everyone at once, every time. Staggering across departments spreads the workload and stops one warning spreading through the office within minutes of the send.
Escalating difficulty too fast. Jumping to a highly targeted lure early produces a demoralising click rate and little learning. Raise difficulty as reporting rates rise.
Testing without following up. A simulation that produces no training and no feedback is data collection, not a programme.
Pausing over holidays. Attackers do not, and distracted people are exactly who they target. Keep the rhythm through quieter periods rather than resuming in January.
Where to start
Begin with what you can genuinely sustain. If monthly is unrealistic, run every two months and hold that rhythm rather than starting ambitiously and quietly stopping — an abandoned monthly programme is worse than a maintained quarterly one.
Cadence can also vary by group rather than being one number for the whole company. Finance, IT administrators, executives and their assistants are targeted more often and carry more access, so many programmes test them monthly while the wider workforce runs quarterly. That concentrates effort where a successful attack would cost most.
Then let the numbers set the pace. Rising report rates and falling click rates mean you can add difficulty. A group that keeps clicking needs targeted help, not simply more tests.
Related Learning
More Learning Resources
View all learning resourcesBusiness Email Compromise (BEC) Explained
Learn what Business Email Compromise (BEC) is, how these sophisticated financial scams work, and the strategies organizations can use to defend against them.
What Is Phishing Awareness Training?
How phishing awareness training differs from simulation, what separates programmes that change behaviour from ones that do not, and the metrics worth tracking.
Quick Guide: Spear Phishing
How spear phishing differs from mass phishing, which roles attackers target, and the one verification habit that stops most attempts.
Ready to stop phishing attacks?
Run realistic phishing simulations and high-impact security awareness training with PhishSkill's automated platform.