What to refresh when your awareness program turns two

Doctor Who has been on air for more than six decades and it is still the same show. It pulled that off thanks to an emergency exit. In 1966 William Hartnell, the actor playing the lead, was ill and could not continue, so the writers decided the character would transform on camera into someone else. Patrick Troughton turned up that way, at the end of The Tenth Planet, and on screen the process was not yet called regeneration. It was called renewal.

The premise was never touched. The face changed.

A security awareness program reaches its second year with that same problem and without that same plan. The content is still good, the platform delivers, the calendar is set. And people open less than they did twelve months ago, and when they open they stay for less time. What wore out is the packaging.

It helps to place which organisations we are talking about. Among large UK businesses, 84% ran some form of staff training or awareness activity in the last twelve months, up from 76% the year before, according to the British government’s Cyber Security Breaches Survey 2025/2026. Across all businesses the number has sat at 19% for two years running. Where the program is already in place, the interesting question stopped being how to start and became how to refresh a security awareness program that has been all the way round the block.

What changes when an awareness program turns two?

A program enters its second year once the organisation recognises the format, the sender and the type of request before opening anything. From there novelty stops working for free, and everything that sustains participation has to be put there on purpose.

Year one has an advantage that never shows up in the report. Everything was a first. The first simulation, the first game, the first video that did not look like a corporate video. Attention arrived on its own because the material was unfamiliar, and that covered up any weak design decision we made along the way.

Year two uncovers those decisions. Whatever we learned to recognise, we file away. The message arrives with the same subject line, from the same sender and with the same look, and the person knows what is inside before opening it. They still complete it, because it sits on their task list. They stop looking.

That point weighs more than it seems. In year one the organisation is still testing whether the program is any use. In year two it decides, without a vote in any meeting, whether this becomes part of how work is done or one more administrative task. And it decides from what it sees landing in its inbox, long before anyone presents a report.

Security fatigue describes something deeper, the wear on someone who receives warnings all the time until they stop responding to them. Here the matter is a good deal more domestic and has a known fix. The form has to change.

How can you tell participation is dropping?

Participation drops in depth first and in volume much later. That is why the completion rate is the last to find out (and usually the only one we look at).

Four signals that warn you in time:

• Time inside the content shrinks below what that content needs. A piece designed for five minutes gets completed in two.
• Questions disappear. Last year someone would write in to argue about a case or to tell their own. Now nobody writes, and the silence reads as agreement.
• Voluntary reports go down while clicks hold steady. Fewer alerts at the same level of exposure means some people stopped speaking up.
• The same departments always answer. The overall average holds because three enthusiastic teams make up for five that quietly went dark.

None of those four shows up on the completion dashboard. They all show up when you look at the whole quarter, and that is where year two hides an extra trap. Year one leaves numbers inflated by novelty, and taking them as a baseline turns any normal result into a decline. It pays off more to compare against the equivalent quarter of the previous year and to look at the shape of the curve inside each campaign, from the send to the last person who responded.

What should you refresh and what should you leave alone?

Refreshing a security awareness program means changing the packaging while keeping the message intact. When the refresh moves everything, the following year starts from scratch all over again.

What rotates:

• The format. If year one lived in modules and newsletters, year two comes in through comic, video or game. Each format asks for a different kind of attention and reaches different people.
• The voice. Who signs the communication changes how it is read. It can be signed by the security team, it can be signed by the people team, or it can be signed by someone respected within the department who tells a story that actually happened to them.
• The request. One year we ask people to watch. The next we ask them to answer, to report or to decide. A new request wakes people up more than new content does.
• The setting. The same risk moved into the real context of each department becomes another piece without shifting a comma of the message.

What stays put:

• The core message. If what we ask people to understand changes every year, the organisation never finishes learning it.
• The measurement yardstick. Moving the indicators in the same season we rotate formats leaves the year impossible to compare with the last one.
• The cadence. Rhythm is the one thing people take in without noticing, and breaking it costs more than it returns.

The two lists split by what each thing is made of. Packaging is form and it wears with use. The message and the yardstick are what gives the program continuity, and they break if we touch them every season.

Rotating does not force you to produce everything again. At SMARTFENSE the awareness and assessment tools catalogue brings together comics, video, video games, interactive modules and newsletters, so in year two it is enough to pick another format instead of writing from zero. Content tailored to each organization covers the rest, which is the setting where the case takes place.

How do you build a rotation calendar for year two?

A rotation calendar is the list of which format goes into each stretch of the year, decided in advance so that no choice is left to the urgency of the week.

Four steps are enough:

1. Write down what has already been used. Record the format, the sender and the topic of every send in year one. That list is the set of pieces worth resting for now.
2. Pick three main formats for the year and assign one per quarter. Three is plenty, and it leaves room to do each one properly.
3. Leave a short reinforcement in between. Repeating a format does help here, because microlearning works through repetition and lasts two minutes.
4. Reserve one date for something that looks like nothing from the previous year. A round of game with a shared score, a piece made with people from the house, whatever breaks the pattern once a year.

The campaign calendar is there to get all four steps scheduled in one sitting, with the groups and the dates in place before the quarter starts. After that the year runs on its own, which is the only way rotation survives March.

What does not fix a drop in participation?

• Raising the frequency. More sends of the same kind speed up the very wear we are trying to slow.
• Hardening the tone. Fear lifts the open rate once and leaves people dodging the sender for months afterwards.
• Making it mandatory. You buy the compliance and you lose the attention. Someone who has to complete the module (with the same enthusiasm as renewing a passport) takes away exactly enough to pass.
• Producing a more elaborate piece. Inside the same old packaging it gets opened just as little, and it costs three times as much.
• Making the content longer. Doubling the running time to make the most of the send is the fastest way to get the next piece opened less.

What does move the needle is duller to explain in a committee and cheaper to run. It comes down to changing the face of the program, keeping what we already know works and letting the content look new again for a while.

When it was called renewal

That show survived because someone found, in a hard moment, a way to change the face without touching the story.

An awareness program in its second year needs that decision and little else. If you want somewhere concrete to start, open last year’s calendar and mark the sends that went out with the same format and the same sender. That is the block to refresh first. The message will hold for another full year; the face is asking to be relieved.