Security Quotient recommends that employees be trained on phishing awareness Four times a year using mock assessments or gamified phishing simulations.. However, it is important to provide refresher training more often, especially if there have been any recent phishing attacks in your organization or industry.