All employees should complete updated security training at least once a year. This helps reinforce policies, recognize social engineering threats, and promote secure behavior.