Phishing basics
How often should you run phishing simulations?
Updated
Short answer
For most small businesses, once a month is a sensible default: one short practice email per person, with a quick lesson for anyone who clicks. Official guidance from the NCSC, the Canadian Centre for Cyber Security and NIST does not set a fixed frequency. Monthly is a practical choice because it builds a habit, gives a usable trend and stays light enough that staff do not resent it.
What do official cyber security agencies say about frequency?
None of the main public sources set a required number of phishing simulations per year. The UK National Cyber Security Centre (NCSC) phishing guidance does not give a frequency. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations say organizations should invest in awareness training for employees, including identifying malicious emails and links, but do not specify how often.
NIST Special Publication 800-50 Revision 1 (September 2024), which covers building a cybersecurity and privacy learning program, focuses on behaviour change and on measuring and improving the program over time. It treats learning as an ongoing program rather than a single annual event.
So any specific frequency is a judgement call. The useful question is what schedule builds lasting habits without wearing people out.
Why is monthly a good default for small businesses?
Monthly sits in the middle of the realistic range. Running simulations once or twice a year leaves months where nobody practises, and a single result is too noisy to show whether anything changed. Running them weekly tends to feel like surveillance and adds work for the MSP or office manager handling questions.
- It builds a habit: people see a realistic scenario regularly, so checking before clicking becomes routine.
- It gives a trend: twelve data points a year are enough to see whether clicks fall and reports rise.
- It fits reporting cycles: monthly results roll up neatly into quarterly business reviews and annual insurance renewals.
- It keeps the lesson fresh: a short lesson every month is easier to absorb than one long annual course.
- It stays light: one email a month is a small ask of staff who already get a lot of email.
When should you run simulations more or less often?
Monthly is a starting point, not a rule. Some situations justify a different pace for particular people or periods.
- New hires: a practice email in their first few weeks helps set expectations early.
- High-risk roles: the NCSC recommends extra support for departments that handle finances, sensitive information or IT administration, so they may benefit from more scenarios aimed at their work.
- After a real incident: a follow-up simulation using a similar lure helps confirm the lesson landed.
- Seasonal scams: tax season, holiday shipping and year-end invoicing are good times for a relevant scenario.
- Very small teams: with only a handful of staff, monthly is still fine, but keep scenarios varied so people do not learn to spot the test rather than the scam.
Can you run phishing simulations too often?
Yes. The NCSC warns that phishing simulations can erode trust between employees and the people running security, and that blaming users for clicking on links doesn't work. Frequent tests delivered with a punitive tone make people defensive and less likely to report a real mistake quickly.
Too many simulations also add noise. If staff expect a test every few days, they may report everything unusual as a test, or start ignoring genuine messages from IT. The goal is a steady rhythm that keeps people alert without making them anxious.
How should each simulation be timed and varied?
Frequency matters less than how the simulations are run. A few practical habits make a monthly schedule work better.
- Stagger send times so not everyone gets the email at once. This stops one person warning the whole office.
- Rotate scenarios: shared documents, delivery notices, invoice questions, password expiry and QR codes all test slightly different instincts.
- Model lures on real scams that target small businesses, but avoid impersonating real brands.
- Pair every click with a short lesson delivered at that moment, so the feedback arrives when it is most useful.
- Track report rate alongside click rate, as the NCSC suggests counting reports as well as clicks.
How do insurers and compliance rules fit into the schedule?
Cyber insurance applications and some regulations ask whether a business provides security awareness training and runs phishing simulations. Wording varies by insurer and changes between renewals, so check the actual questionnaire rather than assuming a number.
A monthly program makes these questions easy to answer, because there is a full year of dated activity and results to point to. It also produces evidence for frameworks that expect ongoing training, not a one-off session.
NetMinder Security, a white-label phishing simulation platform for MSPs, sends one practice email per person each month and shows a two minute lesson with a three question check to anyone who clicks. Results feed a branded cyber insurance report PDF that the MSP can hand to the client at renewal.