When Nobody’s Watching is back this week… yay! And this week’s episode has something that the other’s don’t. A number.

I’ve been arguing for a while now that annual training doesn’t work. I’ve argued it in this newsletter repeatedly. In a whole book I wrote. On many stages. On social media. In meetings. You get the drift. And I’ve come to that conclusion from a good few years of experience in this industry. Our guest on the podcast this week, Bec McKeown, has spent twenty years arriving at the same conclusion from the other direction.. research into human behaviour.

So, I asked her whether the science backs the annual awareness module. Her response? “Can I do a bit of an eye roll?” Then she gave me the data. At Cranfield, she looked at something called skill fade… i.e. what happens to a capability when we stop practicing it. “Eight weeks is to keep it at the gold standard, and then those skills disappear.”

EIGHT WEEKS. Not eight months. Not a year with a reminder email in October. Eight weeks, and then the thing you built starts coming apart. And Bec was careful to point out that she was looking at decision-making and procedural skills. Not facts and trivia like what year the company was founded. She looked at the very specific skills that we’re asking people to do every day to keep our companies safe. Spot the thing that’s slightly off. Decide in a second whether to click. Choose to tell somebody you did click.

Every behaviour we care about lives in that category with the eight-week clock on it. So let’s do the maths, shall we? There are 52 weeks in a year. If a skill needs refreshing every 8 weeks, you’d need to be touching it 6 or 7 times a year to hold it anywhere near where you want it.

And what does the industry actually do? One module. Once a year. That doesn’t actually let us test decision making and procedural skills at all. We’ve built a profession around an intervention that gets delivered at roughly one sixth of the frequency the evidence asks for, and then spent years being confused about the results. And as Bec eloquently puts it, “why would you wanna do an annual module when it’s not going to last? It’s not gonna be there when you need it.”

And before you all @ me with the “well, we run phishing simulations every month.” Fine. But then explain to me how that is training. There’s no instruction. No debrief. No feedback. No pressure. No learning outcomes. A phishing sim is a test. It’s a thermometer. And as far as I know, a thermometer has never made anybody warmer.

Rehearsal is a different thing entirely. It’s doing the move under something close to real conditions. And then having someone talk you through what just happened in your own head. The majority of our training is a knowledge transfer exercise. And we don’t have a knowledge gap. We have a “what the hell do I need to do in this moment?” gap. We have a behaviour problem.

We know what a phishing email looks like. We click them. We know not to reuse passwords. We reuse them. We know not to plug in random USB sticks. We throw them in the USB port regardless. The knowledge is there. The actions are not.

So this week, do one thing. Pick the single behaviour you care about the most. And then count the weeks since anybody in your organisation actually practiced it. Not read about it. Not clicked through a slide about it. But actually practiced it. Under pressure. And was given some feedback on that practice.

If the answer is more than eight, you already know what your programme is protecting. It’s protecting the completion report.