Simulation Frequency
How often are phishing simulations sent?
Phishing simulations are sent at a dynamically determined frequency that typically averages around two simulations per month per user. The exact frequency is determined by a combination of the following factors:
-
User behavior data (e.g. group settings, course participation, historical click rate)
-
Evidence-based findings on learning, motivation, readiness for change, and knowledge decay
Why is a higher simulation frequency not recommended?
A higher simulation frequency is not recommended for two reasons:
-
User pressure and reduced effectiveness: Excessively frequent simulations can cause habituation and alert fatigue — users begin to filter out simulations as routine noise, which reduces their effectiveness and correlates negatively with security awareness outcomes.
-
Program dependencies: Course reminders, booster courses, and other training program components depend on the default simulation frequency and may not function correctly if it is changed.