At least once a year
For most organisations, a penetration test at least once a year is a sensible baseline for the systems that matter most, such as the applications your customers use and the parts of your network that face the internet. Systems change, new weaknesses are found in common software, and attackers’ methods move on, so a test from two years ago says little about today.
After significant changes
Test again when something important changes: a new application or a major release, new infrastructure, a move to the cloud, a merger, or a change to how people sign in. New code and new settings are where new weaknesses tend to appear, so a change is a good moment to test.
When others require it
Customers, insurers and standards may set their own expectations, and some contracts ask for an independent test each year. Standards can be specific: PCI DSS, for organisations that handle payment card data, requires penetration testing at least once every 12 months and after significant changes. Check what applies to you before you plan the year.
Between tests
A penetration test shows your systems as they were during testing. Between tests, keep systems up to date, review access when people join or leave, and consider regular vulnerability scans to catch known weaknesses as they appear. When you fix a finding, request a retest to confirm the fix rather than waiting for the next test.