How often should you run a penetration test?
The default answer to how often you should pentest is annually, and it is worth understanding both where that number comes from and why it has quietly stopped being sufficient. The frameworks set a floor. How fast you ship sets the real answer.
What compliance requires
Most frameworks anchor on annual. PCI DSS is explicit, requiring external and internal penetration testing at least every 12 months (and segmentation testing on the same or tighter cadence), which we break down in PCI DSS penetration testing requirements. SOC 2 expects ongoing evaluation with an annual test as the practical norm. The common thread is at least once a year, which is the minimum to satisfy an auditor, not the amount that keeps you secure.
The phrase that resets the clock: significant change
Buried in nearly every requirement is a second trigger: after any significant change. A major release, a new component in scope, an infrastructure or network change, any of these can require a fresh test before the year is up. Teams that read only the annual part and ignore the significant-change part are often out of compliance without realizing it, because they shipped something material in month three and never retested.
Why annual stopped being enough
The deeper problem is that annual testing was designed for a world where software changed slowly, and that world is gone. If you deploy continuously, an annual test inspects a snapshot that is hundreds of releases stale by the time you read it, and everything shipped since is untested. We make the full argument in your annual pentest is already out of date. The gap between the annual test and the next one is exactly where new weaknesses live unexamined.
Annual is the compliance floor. The real cadence is set by how often you ship, because every release you make after the test is untested until the next one.
A practical cadence
- At minimum: annually, to meet the compliance floor.
- Plus: after any significant change to your application, infrastructure, or scope.
- Ideally: continuously, so testing keeps pace with releases instead of falling a year behind, which is feasible now that the cost of a test has collapsed.
That last option used to be impractical and now is not. Uvy runs on every release and tracks findings across runs, so you see what is new, fixed, or regressed instead of waiting a year to find out. See how it works.