When should organisations change their awareness approach after the first year?

Why the first year is not a fixed endpoint

The first year should be treated as a learning window, not a finish line. Awareness programmes often look strongest early because content is fresh and participation is high, but that effect fades if the programme does not evolve. The real signal is whether people are still changing behaviour when the scenarios become familiar, not whether the calendar has rolled over.

Static annual content usually breaks down for the same reason recurring training in other control areas does: people learn the pattern, not the habit. Once that happens, awareness stops testing judgement under realistic conditions and becomes a predictable exercise in recognition. At that point, the programme is measuring exposure to the module, not resilience to the threat.

What change looks like after plateauing gains

When the first-year curve flattens, the answer is not more of the same material. The programme needs sharper scenario design, clearer segmentation by role or risk, and measurement that tracks whether behaviour is improving in the situations that matter. The objective shifts from completion and recall to demonstrated response quality, especially for users or groups who keep missing the same themes.

That usually means replacing broad, generic messaging with content that mirrors the organisation’s real exposure. If the same mistake keeps recurring, the issue is rarely awareness volume alone. It is more often a mismatch between the training format and the decisions people actually make under time pressure, ambiguity, or distraction.

How to know the programme has outgrown its current model

The clearest indicator is repetition without improvement. If repeat failure is concentrated in the same scenarios, the programme should be reworked around those failure modes rather than refreshed cosmetically. Another sign is when the organisation can report attendance and clicks, but not whether risky behaviour is shrinking in the population that receives the training.

A stronger model introduces progressive realism. That can include more specific scenarios, shorter feedback loops, targeted refreshers for high-risk groups, and metrics that compare first exposure with later performance. The point is to detect whether the intervention is changing decisions, not just whether people can recognise the right answer in a classroom-style prompt.

Risk and Threat Considerations

When awareness training stays static after the first year, the main risk is control fatigue. Employees learn the routine, attackers benefit from predictability, and the programme loses its ability to surface weak decision-making before it becomes an incident.

Failure mechanism: The organisation keeps delivering the same scenarios and assumes participation equals resilience, so habitual mistakes remain uncorrected and the training no longer exercises judgement under realistic conditions.

Impact: Repeated exposure without adaptation can leave the same user groups vulnerable to phishing, social engineering, credential misuse, and other common failure paths even though programme metrics still look healthy.

Practitioner Guidance

What to prioritise: Treat plateau as a design signal. If the same people keep failing the same scenarios, redesign those scenarios first rather than expanding the library indiscriminately.

What to measure: Track behaviour change by scenario type, audience segment, and repeat exposure. Completion rates are useful for administration, but they do not tell you whether the programme is affecting real-world judgement.

Common mistake: Refreshing slide decks or swapping graphics while keeping the same content logic. That creates the appearance of change without addressing the underlying loss of realism.

Practitioner takeaway: Change the approach as soon as the programme stops changing behaviour, because after that point additional repetition usually extends the plateau rather than reducing risk.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• What should organisations change first after a breach like Xfinity?
• Should organisations prioritise behavior change or awareness training first?
• How do organisations operationalise NHI ownership at scale?