Cyberpediaby Brain
ENDEFR

The Ebbinghaus forgetting curve

Why a single annual training session falls short: what ENISA, NIST, the NCSC and CISA say about designing and measuring awareness programmes.

In 30 seconds

Where it happens
In any organisation that limits awareness to one annual session.
What to remember
The NIST guide describes a life-cycle approach, with evaluation methods to improve and update it regularly3.
The reflex
Report a suspicious message right away, without waiting for the next training.
If it's already done
If you have replied to a dubious message, tell your security team without delay. The NCSC, the British service, publishes a page on how to report a suspicious message and what to do after replying to a scam email5.

What it is

Does a one-hour awareness session, once a year, leave lasting traces? The Ebbinghaus forgetting curve is this entry's starting point for doubting it. This entry draws a simple idea from it: short, repeated reminders are better than one large, isolated session.

A caveat first. The pages consulted for this entry are guides and guidance pages from ENISA, NIST, the British NCSC and CISA. None of them describes the Ebbinghaus curve or puts a figure on what an employee retains after a few weeks. This entry therefore gives no forgetting percentage. It sticks to what these bodies say about designing and monitoring awareness programmes.

Straight answers

What does the Ebbinghaus forgetting curve say?

None of the sources cited here describes it. This entry therefore cannot cite its values. Its link with annual training remains a working hypothesis of this entry, not a result established by the pages consulted.

Is one training session a year enough?

The pages consulted do not put it in those terms. NIST does, however, describe a life-cycle approach, which manages awareness, training and education together, with evaluation methods to improve and update the programme regularly3. One can infer, without the source saying so, that such a programme goes beyond one session a year.

What do the guides expect of an awareness programme?

NIST writes: « The program should encourage behavior change as part of risk management and lead to developing a privacy and security culture in the organization. »3 The stated goal is therefore a change in behaviour.

Is there a European guide on security culture?

Yes. ENISA published a report on the human aspects of cybersecurity on 16 April 2019. It covers psychology and sociology, but also ethnography, anthropology, human biology and behavioural economics1.

1What it changes for employees1 min

For employees, the practical point is not to depend on a memory. A session attended once does not replace a simple gesture within easy reach.

The NCSC gives an example: reporting a phishing message. According to its page, reporting is free and takes only a minute: « Reporting a scam is free and only takes a minute. »5 The NCSC explains that these reports reduce the number of fraudulent communications received, make you a harder target and protect others5. The service also says it has the power to investigate fraudulent addresses and sites and to have them removed5.

The NCSC adds a habit that requires no training: criminals use information available online, social media included, to make their messages more convincing. Thinking about what you post and reviewing your privacy settings reduces the risk of being targeted5.

CISA sums up the basic actions in four points, presented during Cybersecurity Awareness Month, in October: avoid and report phishing, use strong passwords, turn on multifactor authentication with a password manager, update software6. Each reminder (a poster, an internal message, a short team briefing) can take up just one of them.

2What it changes for managementManagement1 min

For management, the sources consulted point toward measurement rather than a simple headcount of participants. NIST states that its guide includes proposed metrics and evaluation methods, in order to improve the programme regularly3. It also specifies that the recommendations are adaptable, for large or small organisations, including those building a programme from scratch3.

NIST presents its programme as a process that manages awareness, training and education for a varied set of federal employee audiences3. A second public draft from 2013, since replaced, described a role-based training model for people with significant responsibilities in IT or cybersecurity4. In this entry, the inference is that an identical annual module for everyone suits this variety of audiences poorly, but no source says so.

For its part, CISA offers a toolkit for Cybersecurity Awareness Month 2026, with visuals and presentations that organisations can use for their own campaigns6. ENISA describes the policies of European Union Member States along four objectives: awareness, training, challenges and exercises2. Awareness is one objective among others there, alongside training and exercises.

None of these pages sets a frequency threshold, for example a number of reminders per year. This entry therefore gives none.

3What the text saysOfficial text1 min

The main document consulted is NIST publication SP 800-50 revision 1, titled « Building a Cybersecurity and Privacy Learning Program ». It provides US federal agencies and organisations with guidance for building a cybersecurity and privacy learning program using a life-cycle approach3. It draws on widely accepted standards, regulations, legislation and good practices3.

This publication replaces the 2003 SP 800-50 and the 1998 SP 800-163. The page cites the Cybersecurity Enhancement Act and OMB Circular A-130 among the associated laws and regulations3.

An earlier version of SP 800-16 revision 1, dated October 2013, describes a role-based training model. It specifies that every person who owns, uses or manages information must clearly understand their security responsibilities4. This version is a second public draft, and the page indicates that it was replaced on 14 March 2014 by a third draft4.

The 2021 ENISA report, for its part, makes five recommendations on the cybersecurity skills shortage in the Union. The pages consulted do not detail their content2.

4Where implementation stands1 min

The documents consulted are guides. The pages do not mention any legal obligation for a private company to train its employees at a given frequency, and this entry asserts none.

On the American side, the final version of SP 800-50 revision 1 dates from September 2024, after two public drafts published in September 2021 and in August 20233. It is aimed at federal agencies and organisations3.

On the European side, ENISA's page on cybersecurity culture classes its 2019 report among the content written for the private sector1. It also lists events: a third European awareness conference, scheduled for 11 November 20261. The pages do not say which organisations apply these guides, or with what results.

As for the central idea of this entry, it remains to be checked in a dedicated source. Measuring real behaviours, for example the rate of reporting of suspicious messages, is consistent with NIST guidance. None of the documents consulted puts a figure on it.

Fact sheet

Identifier
CP-388
Wing
6. Governance and GRC
Brain skill
Learning with BRAIN (learn_with_brain)
Brain reflex
cr-015
Diagram
G2 · Visual vs Technical Indicators
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. ENISA, “Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity”, 16 April 2019. https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspects-of-cybersecurity (accessed 3 November 2026)
  2. ENISA, “Addressing Skills Shortage and Gap Through Higher Education”, 24 November 2021. https://www.enisa.europa.eu/publications/addressing-skills-shortage-and-gap-through-higher-education (accessed 3 November 2026)
  3. NIST, “Building a Cybersecurity and Privacy Learning Program”, 12 September 2024. https://csrc.nist.gov/pubs/sp/800/50/r1/final (accessed 3 November 2026)
  4. NIST, “A Role-Based Model for Federal Information Technology/Cybersecurity Training”, 24 October 2013. https://csrc.nist.gov/pubs/sp/800/16/r1/2pd (accessed 3 November 2026)
  5. NCSC (UK), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
  6. CISA, “Cybersecurity Awareness Month”. https://www.cisa.gov/cybersecurity-awareness-month (accessed 3 November 2026)

Cite this article

Brain, “The Ebbinghaus forgetting curve”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ebbinghaus-forgetting-curve-annual-training/

BibTeX 
@misc{brain_cp388_en_2026,
  author = {Brain},
  title = {The Ebbinghaus forgetting curve},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/ebbinghaus-forgetting-curve-annual-training/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence