A practical starting point is one short security awareness lesson and two phishing simulations per employee per month, with a little more activity in the first weeks. The right training rhythm balances regular practice with the need to avoid overwhelming employees. Nimblr uses an automated approach, combining a consistent training schedule with additional practice based on individual employee behavior.
Rather than testing everyone equally, adaptive programs give extra practice to the employees who need it. Employees who repeatedly click on a particular type of simulated attack receive additional practice on that threat. Nimblr follows a predefined training rhythm, with adaptive learning that responds to individual employee behavior.
Most organizations have run some version of the annual training day: everyone gathers for a few hours, takes a course and goes back to work. People remember a lot of it the next day, and much less a week later. Without repetition, knowledge fades quickly, and phishing attacks are designed for exactly the moment when someone is busy, distracted or under time pressure.
Nimblr's own data shows why short, regular practice matters. Nimblr analyzed 1,714 phishing simulations sent around 11 million times across 10 European countries, generating about 420,000 clicks. The lures that worked best looked like ordinary work, such as HR updates and delivery notices, rather than obvious scams. You can read more in Why does phishing still work in 2026?
Regular exposure keeps that kind of email in mind as something to pause on. A short lesson or a realistic simulation every couple of weeks works as a reminder, and over time employees build the habit of checking the sender, the link and the request before they act.
Here is how a Nimblr program usually runs for one employee, using the default settings.
When the program starts, every employee receives a short introduction course. It explains what's coming and why, so the first simulation doesn't come as a surprise. The first simulated attack follows a few days later.
After that, a normal month includes one Micro Training lesson and two simulated attacks. Lessons arrive by email and open without a login, so employees can take them on a laptop or a phone in a few minutes. Simulations arrive at random times and in different forms. One employee might get a fake delivery notice on a Monday while a colleague gets a Microsoft sign-in request on Friday, which keeps the test realistic and stops colleagues from warning each other.
If someone clicks, Instant Learning shows them what they missed and offers a short lesson on that exact threat, while the moment is still fresh. If a lesson is left unopened, a reminder follows, by default once a week. When a new threat starts spreading quickly, Nimblr can also send a short alert outside the normal schedule.
For the employee, that adds up to a few minutes a month. For the security or IT team, nothing needs to be scheduled by hand.
Frequency becomes a problem when employees feel flooded or when IT gets a stream of worried messages about every suspicious email. Prospects often raise this in their first conversation with us, and it's a fair concern. A few practical steps keep the program sustainable.
Tell employees before you start. A short message a few days before launch explains that simulations are part of training and that clicking is a chance to learn. Nimblr provides a template for this message.
Give employees a way to report. With the Microsoft report button connected, an employee who reports a simulation gets feedback within about a minute confirming that they spotted it. They don't need to contact IT, and reporting becomes a habit that feels rewarding.
Keep simulations realistic, but fair. Simulations should look like the attacks employees actually face, but a message that creates too much urgency can cause unnecessary stress across a workplace. Nimblr has removed simulations for that reason when they caused more disruption than learning.
The aim isn't to create perfect employees who never click. It's to give people regular, low-pressure practice so that pausing before acting becomes normal.
No. A fixed schedule for everyone treats a finance employee who approves invoices the same as a colleague with no access to payments, and it treats someone who reports every simulation the same as someone who keeps clicking.
Nimblr combines a consistent training schedule with behavior-based learning. Employees who need additional support receive targeted lessons and follow-up simulations, while those who consistently recognize threats continue with the regular program. Employees who handle simulations well spend about five minutes a month on training. Employees who click get extra lessons and follow-up simulations on the same type of threat, at different difficulty levels, until they show they've understood it. Simulations also mix easier and more advanced messages, so both new and experienced employees are challenged. The time each person spends reflects a real need.
Role also matters. With Role-Based Learning, employees in finance, HR and payroll, IT helpdesk, IT admin, DevOps and executive roles get courses built around the attacks most likely to target their job, such as invoice fraud or multifactor authentication (MFA) reset scams. These replace general courses rather than adding to them, so no one gets the same topic twice.
Email is where most organizations start, but text messages carry their own risk. In Nimblr's Nordic simulation data, smishing simulations had a click rate of 29.4%, compared with 4.5% for phishing email, nearly seven times higher.
Nimblr offers smishing simulations as an add-on. Organizations don't need to add it for everyone. Many start with the groups most exposed to SMS-based fraud, such as management or employees who use company phones for approvals. Smishing simulations extend security awareness training beyond email, giving employees realistic practice recognizing suspicious text messages and immediate feedback when they click.
Click rate alone doesn't tell the whole story. A falling click rate is a good sign, but you also want to see employees reporting suspicious messages, completing lessons without many reminders and improving on the types of threats they used to miss.
Look at trends over several months rather than single results. One high click rate may simply mean a simulation was particularly convincing. It's also worth tracking how much admin time the program takes, since a program that depends on someone scheduling it by hand rarely lasts.
Nimblr combines these signals into an Awareness Level for each employee, team and the organization as a whole, and sends automated monthly reports to administrators. Nimblr customers see an 80% average reduction in clicked simulations within three months. If your numbers stall, the reports show where: a team that skips lessons needs a different response than a team that keeps clicking one type of lure.
Usually not. Annual training can document that employees took a course, but knowledge fades quickly without practice. Short, regular lessons and simulations keep it current.
Some may at first. Explaining the program up front, keeping lessons short and giving instant feedback when someone clicks or reports a simulation all help.
Tell employees that the program includes simulations, but don't announce individual ones. That lets people practice in realistic conditions. Nimblr provides a template for the launch message.
About five minutes a month for employees who handle simulations well, and a bit more for those who need extra practice.
Yes, but targeted training rather than more of everything. In Nimblr, a click triggers a short lesson on that exact threat, followed by new simulations of the same type until the employee shows they've understood it.
Nimblr uses the same automated training approach regardless of organization size. The standard program includes one short lesson and two phishing simulations per employee per month, with additional targeted learning based on individual behavior. For an organization with 500 employees, automated scheduling means the IT team doesn't need to plan and distribute training manually.
If you're planning a new security awareness program or reviewing your current approach, see how Nimblr combines regular training, realistic simulations and adaptive learning without adding administrative work.
Book a 30-minute demo and we'll show you what a month of training looks like for one of your employees.