Example scenario. On Monday an employee identifies every warning sign in an example phishing email. A week later a similar but unfamiliar message arrives, and they cannot recall the first action. Should the learning team send the video again or ask the employee to make the decision again?
Why research recommends retrieval
A practice guide from the US Institute of Education Sciences recommends spacing learning and using quizzes to revisit key content. Its evidence comes from educational settings. Adjust your workplace schedule using pilot data.
A workplace example
On day one, review an example phishing message. On day seven, ask learners to identify suspicious signs in a new message. On day thirty, ask what they would do first in a similar case. Explain the reasoning after each response.
Reviewing a lesson and recalling it are different tasks
An employee can recognise the clues while watching an example phishing message. A week later they need to identify the clues in a different message independently. Spaced practice asks them to retrieve the information on different days and in different situations.
The IES guide suggests two design decisions. Spread the learning over time and use short quizzes to revisit important content. Combine the ideas and treat the schedule as something to test rather than a fixed prescription.
Sample practice schedule
- Day 1 · Review an example
- Day 7 · Assess a new message
- Day 30 · Explain a decision
| Time | Prompt | Feedback |
|---|---|---|
| First day | Which two clues look suspicious? | Explain why the clues matter |
| One week later | What should you do first with this new message? | Compare the answer with the reporting process |
| One month later | What would you check even if the message looked credible? | Reinforce the check for similar situations |
Interpret results by question
A total score can rise while performance on one critical decision remains low. If employees spot suspicious links but confuse reporting channels, design an additional example about reporting rather than assigning the entire course again.
Use different prompts in the first and final checks. The aim is to observe application in a new situation. Account for shifts and workload when scheduling, and adjust the interval using results from the pilot.
Use questions to teach
Ask employees who choose the right answer to explain why in one sentence. Their reasoning shows how they applied the rule. After a wrong answer, explain the missed clue briefly and give them another example. A short quiz can supply feedback rather than merely a score.
For measurement, ask for the same decision in two comparably difficult cases. Record first-session participation and return for the follow-up separately. Learners who complete both sessions may differ from the workforce as a whole, so interpret final scores with that in mind.
Fit the interval to the work
A week can be a useful starting interval. If employees make the decision every day, feedback on the job can also affect learning. If the task is rare, plan a short fictional example instead. Try the schedule with the team’s shifts and workload in mind.
For the final check, choose a decision that people often get wrong. Ask for their first action and the reasoning behind it. If they select the correct option but explain it incorrectly, use a different clue in the next example. Check how the explanation changes as well as the score.
How to apply it with COBIDU
Select suitable cybersecurity content in COBIDU Library. Schedule checks on different dates in Platform and review answers by critical topic. Add a short worked example for common misunderstandings and check them again in the next round.
Remembering a decision is the first step. Can an employee explain it to a frustrated customer? The next article moves from recall to conversation practice.
