How Often Should You Run Phishing Simulations?

Run a phishing simulation for each employee at least every four months, and monthly if you can vary the difficulty, tactic, and timing for each person. The four-month floor comes from research showing awareness gains fade by six months. Monthly works, but only when the emails stop feeling like a routine.

Where "monthly" comes from

Ask a vendor how often to run what most people call a phishing test and you'll hear monthly. SoSafe's guide says it. Most platform defaults say it, including ours. Monthly is a sensible default. It is also a calendar habit, not a research finding. We don't know of any study that compared monthly against every six weeks and picked a winner.

What the studies do support is narrower, and more useful.

The floor is four months

Reinheimer et al. (SOUPS 2020) trained employees and then checked how well they spotted phishing over time. The improvement was significant right away and still significant at four months. By six months it was gone. Reminders built on videos and interactive examples worked best, and their effect lasted at least another six months.

So the useful question is whether anyone in your company goes more than four months without a reminder. A program that runs one big simulation twice a year leaves most people sitting at baseline for a big chunk of every cycle.

The reminder is doing the work

This is the part vendors rarely mention. Lain et al. (2024) found the benefit of embedded training came from the periodic nudge, not the training content. Training delivered later worked as well as training delivered right after a click. Rewards didn't improve behavior. The authors describe phishing as more of an attention problem than a knowledge problem.

That changes what frequency is for. If attention is the problem, each simulation is a tap on the shoulder. You need taps often enough that "this could be phishing" stays near the front of someone's mind. You don't need a new lesson every time.

It also lines up with the earlier Lain et al. study of 14,000+ employees over 15 months. Training shown right after a failed simulation did not improve resilience and could increase susceptibility. More content per click is not the lever. Regular, light reminders are.

Too often and too similar

Here is where "monthly" goes wrong in practice. Vance et al. (2018) watched attention to repeated security warnings fall across a single workweek. Varied designs slowed that drop. Their study looked at software warnings, not simulations, but habituation is habituation. A brain that sees the same pattern every month learns to skim it.

The worst version is the everyone-at-once send. Same template, whole company, 9 a.m. Tuesday. By 9:20 someone posts "don't click the shipping email, it's IT" in the team chat. Now you're measuring the chat, not the people.

Difficulty matters too. Rozema and Davis (WWW '26, 12,511 employees) found click rates tracked email difficulty: 7% on easy emails, 15% on hard ones. If every month's simulation is equally easy, a falling click rate may describe your templates more than your people.

A schedule that holds up

• Every employee gets at least one simulation every four months. Treat that as the floor, not the goal.
• Go monthly if each person sees a different tactic, difficulty level, and send time from one month to the next.
• Stagger sends across days and weeks. Never send to everyone at once.
• Vary the channel where you can. Not every attack arrives by email.
• Send more often to high-exposure roles: finance and accounts payable, executive assistants, and help desk staff. Attackers go after people who move money, manage calendars, and reset passwords. Tolsdorf et al. (2025) found susceptibility varied sharply between staff groups in the same organization.
• After each round, send a short note to everyone, not just the people who clicked. Yin et al. (MIS Quarterly 2026) found feedback to all employees more promising than feedback only for clickers.

Then measure the right thing. Click rate drifts with difficulty. Reporting is the behavior that protects you. Track Suspicious Email Reporting Rate (SERR) per round. In Rozema and Davis's data, a report arrived before the first click in 36-55% of simulations. That race is the one worth winning, and we wrote more about it in the reporting race.

More often raises the stakes on tone

Frequency multiplies whatever your program feels like. Tolsdorf's hospital study found some staff reacted to simulations with fear, shame, guilt, or hostility. If a click leads to a scolding, monthly just means monthly resentment. Treat clicks as learning moments, and talk to employees who click more than once as people who need a different approach.

How Hook handles it

Hook Security is a security awareness training and phishing simulation platform built for MSPs and SMBs. Autopilot runs training and simulations automatically each month, so the rhythm happens without anyone building each send by hand. If you're setting one up yourself, start with how to run a phishing simulation.

FAQ

Is quarterly phishing simulation enough?

It clears the research floor, barely. Reinheimer found gains held at four months and were gone by six, so a three-month rhythm should keep people above baseline. A short video reminder between rounds gives you more margin.

Can you run phishing simulations too often?

Yes, if they look alike. Repetition without variety teaches people to spot your template instead of real phishing. Weekly sends of similar emails are likely worse than monthly sends of varied ones.

Should everyone get the phishing simulation on the same day?

No. Simultaneous sends get flagged in team chat within minutes and your results stop meaning anything. Spread each round across days and send times so each person meets it alone.

How often should finance and executive assistants get phishing simulations?

More often than everyone else, because attackers go after them more. Monthly with harder, role-specific scenarios is reasonable for these groups, even if the rest of the company is on a slower rhythm.