--- id: CP-388 slug: ebbinghaus-forgetting-curve-annual-training lang: en title: The Ebbinghaus forgetting curve description: "Why a single annual training session falls short: what ENISA, NIST, the NCSC and CISA say about designing and measuring awareness programmes." canonical_url: https://startbrain.io/cyberpedia/en/articles/ebbinghaus-forgetting-curve-annual-training/ markdown_url: https://startbrain.io/cyberpedia/en/articles/ebbinghaus-forgetting-curve-annual-training.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "The Ebbinghaus forgetting curve", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ebbinghaus-forgetting-curve-annual-training/ (CC BY 4.0) wing: 6 theme: learn_with_brain reflex: cr-015 schema: G2 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/ebbinghaus-forgetting-curve-annual-training/ fr: https://startbrain.io/cyberpedia/fr/articles/courbe-oubli-ebbinghaus-formation-annuelle/ de: https://startbrain.io/cyberpedia/de/articles/ebbinghaus-vergessenskurve-jahrliche-schulung/ es: https://startbrain.io/cyberpedia/es/articles/curva-olvido-ebbinghaus-formacion-anual/ sources: - "n": 1 title: "Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity" publisher: ENISA url: https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspects-of-cybersecurity published: "2019-04-16" accessed: "2026-11-03" - "n": 2 title: Addressing Skills Shortage and Gap Through Higher Education publisher: ENISA url: https://www.enisa.europa.eu/publications/addressing-skills-shortage-and-gap-through-higher-education published: "2021-11-24" accessed: "2026-11-03" - "n": 3 title: Building a Cybersecurity and Privacy Learning Program publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/50/r1/final published: "2024-09-12" accessed: "2026-11-03" - "n": 4 title: A Role-Based Model for Federal Information Technology/Cybersecurity Training publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/16/r1/2pd published: "2013-10-24" accessed: "2026-11-03" - "n": 5 title: "Phishing scams: how to spot and report them" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/phishing-scams published: "2021-11-26" accessed: "2026-11-03" - "n": 6 title: Cybersecurity Awareness Month publisher: CISA url: https://www.cisa.gov/cybersecurity-awareness-month accessed: "2026-11-03" --- # The Ebbinghaus forgetting curve Does a one-hour awareness session, once a year, leave lasting traces? The Ebbinghaus forgetting curve is this entry's starting point for doubting it. This entry draws a simple idea from it: short, repeated reminders are better than one large, isolated session. A caveat first. The pages consulted for this entry are guides and guidance pages from ENISA, NIST, the British NCSC and CISA. None of them describes the Ebbinghaus curve or puts a figure on what an employee retains after a few weeks. This entry therefore gives no forgetting percentage. It sticks to what these bodies say about designing and monitoring awareness programmes. ## In 30 seconds - Where it happens: in any organisation that limits awareness to one annual session. - What to remember: the NIST guide describes a life-cycle approach, with evaluation methods to improve and update it regularly [3]. - The reflex: report a suspicious message right away, without waiting for the next training. - If it's already done: if you have replied to a dubious message, tell your security team without delay. The NCSC, the British service, publishes a page on how to report a suspicious message and what to do after replying to a scam email [5]. ## Straight answers ### What does the Ebbinghaus forgetting curve say? None of the sources cited here describes it. This entry therefore cannot cite its values. Its link with annual training remains a working hypothesis of this entry, not a result established by the pages consulted. ### Is one training session a year enough? The pages consulted do not put it in those terms. NIST does, however, describe a life-cycle approach, which manages awareness, training and education together, with evaluation methods to improve and update the programme regularly [3]. One can infer, without the source saying so, that such a programme goes beyond one session a year. ### What do the guides expect of an awareness programme? NIST writes: « The program should encourage behavior change as part of risk management and lead to developing a privacy and security culture in the organization. » [3] The stated goal is therefore a change in behaviour. ### Is there a European guide on security culture? Yes. ENISA published a report on the human aspects of cybersecurity on 16 April 2019. It covers psychology and sociology, but also ethnography, anthropology, human biology and behavioural economics [1]. ## What it changes for employees For employees, the practical point is not to depend on a memory. A session attended once does not replace a simple gesture within easy reach. The NCSC gives an example: reporting a phishing message. According to its page, reporting is free and takes only a minute: « Reporting a scam is free and only takes a minute. » [5] The NCSC explains that these reports reduce the number of fraudulent communications received, make you a harder target and protect others [5]. The service also says it has the power to investigate fraudulent addresses and sites and to have them removed [5]. The NCSC adds a habit that requires no training: criminals use information available online, social media included, to make their messages more convincing. Thinking about what you post and reviewing your privacy settings reduces the risk of being targeted [5]. CISA sums up the basic actions in four points, presented during Cybersecurity Awareness Month, in October: avoid and report phishing, use strong passwords, turn on multifactor authentication with a password manager, update software [6]. Each reminder (a poster, an internal message, a short team briefing) can take up just one of them. ## What it changes for management For management, the sources consulted point toward measurement rather than a simple headcount of participants. NIST states that its guide includes proposed metrics and evaluation methods, in order to improve the programme regularly [3]. It also specifies that the recommendations are adaptable, for large or small organisations, including those building a programme from scratch [3]. NIST presents its programme as a process that manages awareness, training and education for a varied set of federal employee audiences [3]. A second public draft from 2013, since replaced, described a role-based training model for people with significant responsibilities in IT or cybersecurity [4]. In this entry, the inference is that an identical annual module for everyone suits this variety of audiences poorly, but no source says so. For its part, CISA offers a toolkit for Cybersecurity Awareness Month 2026, with visuals and presentations that organisations can use for their own campaigns [6]. ENISA describes the policies of European Union Member States along four objectives: awareness, training, challenges and exercises [2]. Awareness is one objective among others there, alongside training and exercises. None of these pages sets a frequency threshold, for example a number of reminders per year. This entry therefore gives none. ## What the text says The main document consulted is NIST publication SP 800-50 revision 1, titled « Building a Cybersecurity and Privacy Learning Program ». It provides US federal agencies and organisations with guidance for building a cybersecurity and privacy learning program using a life-cycle approach [3]. It draws on widely accepted standards, regulations, legislation and good practices [3]. This publication replaces the 2003 SP 800-50 and the 1998 SP 800-16 [3]. The page cites the Cybersecurity Enhancement Act and OMB Circular A-130 among the associated laws and regulations [3]. An earlier version of SP 800-16 revision 1, dated October 2013, describes a role-based training model. It specifies that every person who owns, uses or manages information must clearly understand their security responsibilities [4]. This version is a second public draft, and the page indicates that it was replaced on 14 March 2014 by a third draft [4]. The 2021 ENISA report, for its part, makes five recommendations on the cybersecurity skills shortage in the Union. The pages consulted do not detail their content [2]. ## Where implementation stands The documents consulted are guides. The pages do not mention any legal obligation for a private company to train its employees at a given frequency, and this entry asserts none. On the American side, the final version of SP 800-50 revision 1 dates from September 2024, after two public drafts published in September 2021 and in August 2023 [3]. It is aimed at federal agencies and organisations [3]. On the European side, ENISA's page on cybersecurity culture classes its 2019 report among the content written for the private sector [1]. It also lists events: a third European awareness conference, scheduled for 11 November 2026 [1]. The pages do not say which organisations apply these guides, or with what results. As for the central idea of this entry, it remains to be checked in a dedicated source. Measuring real behaviours, for example the rate of reporting of suspicious messages, is consistent with NIST guidance. None of the documents consulted puts a figure on it. ## Sources 1. ENISA, "Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity", 16 April 2019. https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspects-of-cybersecurity (accessed 3 November 2026) 2. ENISA, "Addressing Skills Shortage and Gap Through Higher Education", 24 November 2021. https://www.enisa.europa.eu/publications/addressing-skills-shortage-and-gap-through-higher-education (accessed 3 November 2026) 3. NIST, "Building a Cybersecurity and Privacy Learning Program", 12 September 2024. https://csrc.nist.gov/pubs/sp/800/50/r1/final (accessed 3 November 2026) 4. NIST, "A Role-Based Model for Federal Information Technology/Cybersecurity Training", 24 October 2013. https://csrc.nist.gov/pubs/sp/800/16/r1/2pd (accessed 3 November 2026) 5. NCSC (UK), "Phishing scams: how to spot and report them", 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026) 6. CISA, "Cybersecurity Awareness Month". https://www.cisa.gov/cybersecurity-awareness-month (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/ebbinghaus-forgetting-curve-annual-training/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.