We have observed enough awareness programmes long enough to see a consistent pattern: year one shows enthusiastic uptake, real engagement, and measurable behavioural change. Year two regresses. Year three is often indistinguishable from no programme at all.
The cause is almost never the training content itself. The content typically remains accurate; the lures used in simulations remain relevant. The cause is structural — the programme stops being something the organisation pays attention to, the format becomes predictable, and the lack of progression turns the experience from training into compliance ritual.
Three structural changes consistently change the trajectory in our experience.
First, annual format rotation. Long-form courses one year, short micro-learning the next, scenario-based tabletops the third. The cadence keeps the experience fresh and prevents the format from becoming the message. Employees who would tune out a fourth annual security course will engage with a tabletop that asks them to play through an incident.
Second, genuine simulation. The simulation library has to refresh continuously to reflect the current threat picture. Programmes that recycle the same lure families across multiple years produce excellent metrics on those families and progressively worse generalised resilience. The simulation calendar needs explicit progression: from the familiar to the novel, from the obvious to the subtle, from the email vector to the multi-vector campaign.
Third, executive visibility. Programmes that drop off the senior leadership agenda after year one stop being seen as a priority by the workforce. Quarterly KPIs reviewed by the security committee, board-level visibility of the reporting-rate trend, explicit acknowledgement of progress — these are not optional governance overhead; they are structural inputs into whether the programme continues to deliver behavioural change.
Implementing these three together is the single highest-leverage intervention we recommend to clients moving from year-one programmes to durable multi-year ones. Each by itself helps; together they change the underlying trajectory.
A fourth element matters at the multi-year scale: rotation of the people running the programme. Programmes maintained by the same internal owner for multiple years tend to ossify around that person's preferences. Periodic rotation of the internal lead, even just between two named owners in alternating years, keeps a healthy diversity of perspective.
If you are entering year two of an awareness programme and worried about the regression: implement the three structural changes deliberately rather than continuing the year-one approach with refreshed content. The content refresh is necessary but not sufficient.