Use both. Annual training sets a shared baseline and gives you coverage records. Just in time training teaches at the moment a developer meets a specific problem, such as a failed check or a review comment. Each does a job the other cannot, so the question is how to split the time.
Definitions
Annual training is a scheduled session or module that everyone in a role completes on a calendar cycle. Just in time training is a short piece of guidance triggered by an event: a scanner finding, a blocked pull request, a new framework, an incident.
The comparison
| Question | Annual | Just in time |
|---|---|---|
| Good for | Shared vocabulary, policy, evidence | Fixing a specific habit |
| Retention | Fades between sessions | Tied to a real task, so easier to recall |
| Evidence | Easy to record | Needs logging of events |
| Cost in developer time | One block a year | Small, spread out |
| Risk | Box ticking | Noise if triggered too often |
The retention row is a common sense claim about attaching learning to a task, not a measured figure from a source we cite. If you want proof, measure it yourself with repeat finding rates.
A practical split
Annual, about 30 to 60 minutes: how your company handles secrets, how to report a security concern, the few flaw classes your own findings show most, and what the secure development policy says.
Just in time, 2 to 5 minutes each:
- A pull request check fails because of a hardcoded secret. The message explains what to do and links a short note.
- A reviewer leaves a comment about a missing authorization check, with a link to a known example.
- A new dependency raises a license or vulnerability alert. The alert includes a one line fix path.
- After an incident, a blameless write up and a ten minute walkthrough.
How to build the just in time layer
- Pick the three findings you see most often.
- For each, write a message that says what happened, why it matters, how to fix it, in under 100 words.
- Attach it where the developer already works: the pull request, the IDE, the ticket.
- Count how often each fires. If one fires constantly, write a lab, not another message.
- Review monthly with the champions.
Evidence for auditors
Keep the annual completion record. For the just in time layer, keep the message text and a log of how many times each was shown, so you can show the control exists and is working. Do not claim more than you can show.
Try it yourself
Click through it at your own pace, or open it full screen. Watch what the developer sees at the moment the pull request is checked.
Where Safeguard fits
Safeguard provides policies, gates and guardrails that can show developers a clear message when a change fails a check. A free scan is available.
Quick check
Can just in time training replace the annual session?
Rarely. Some policies and customers expect a recorded annual completion, and new staff need a baseline.
How do we avoid alert fatigue?
Trigger messages only for findings you want fixed, tune them to the repeat issues, and retire messages that no longer fire.
Last reviewed: 19 October 2026.
