How long does security awareness training take?
For most employees, a foundation security awareness course takes 20 to 45 minutes, completed once. After that, effective programmes run short refreshers of 5 to 10 minutes a month rather than repeating a long annual session. Phishing simulations take seconds unless someone clicks, which triggers a few minutes of follow-up coaching. A realistic all-in figure is one to two hours per employee per year.
Why shorter, more often beats one long session
Knowledge from a single annual session decays within months, which is why NIST's awareness and training guidance treats awareness as a continuous programme rather than a one-off event. Short monthly touchpoints keep recognition skills current without pulling staff away from work.
The time that matters most is the smallest: the three to five minutes of coaching served immediately after someone clicks a simulated phish. It lands while the mistake is fresh, which is exactly when people are most receptive.
| Format | Typical time per employee |
|---|---|
| Foundation course | 20 to 45 minutes, once |
| Monthly refresher | 5 to 10 minutes |
| Phishing simulation | Under a minute |
| Post-click coaching | 3 to 5 minutes |
train2secure runs exactly this cadence: short country-specific courses, monthly refreshers and phishing simulations with instant follow-up coaching.
See how train2secure structures training