How often should we release security training for employees?

Start with management support, not another reminder from IT. Explain why the training is needed, who needs it, and what the risks are if it is skipped. Managers need to give people time to complete it and follow up when they don't.

Agree on the consequences before announcing them. Some workplaces use account restrictions after warnings and a deadline, but that takes leadership backing and creates extra work for IT.

Hours of backlog suggests there may be too much material, or at least too much stacking up. Ask employees what gets in the way. It could be repetitive content, a lack of time, or training that doesn't feel relevant to their work.

For a starting point, consider a short course and quiz once a year, or a 20 to 30 minute session every six months. Then adjust based on the requirements you have to meet and the feedback you get.

A reset could be reasonable, but check which training still needs to be completed before removing anything. Clearing the queue makes the number look better, so pair it with a smaller, clearly scheduled set of assignments rather than letting the same backlog build again.

Content format matters too. Short episodes or scenarios can be easier to get through than a long course. A quiz can check whether people paid attention, and phishing simulations can give you another way to reinforce the lessons.

Look at simulation reporting as well as completion rates. Finishing a course and recognizing a suspicious message are not quite the same thing.

If self-paced assignments keep getting pushed aside, try a scheduled group session with management support. People get dedicated time for it, rather than another task competing with their regular work.