The frequency of security and awareness training should be determined by the combination of a risk analysis and individual security assessments. There is little benefit to “over-training” employees who demonstrate good security awareness, but it can help reduce an organization´s vulnerability to online threats if groups of susceptible employees are provided with more frequent security and awareness training.