Published · By the Aesparrow Security Research Team
Short answer
Penetration testing should be done at least once a year and after every significant change, such as a major release, new infrastructure, a cloud migration or an acquisition. High-risk or fast-moving organisations — fintech, SaaS and e-commerce — often test twice a year or per major release, with continuous vulnerability scanning in between.
What do compliance standards require?
- PCI DSS v4.0: internal and external penetration tests at least every 12 months and after significant change (Req. 11.4); vulnerability scans quarterly (Req. 11.3).
- ISO 27001:2022: technical vulnerabilities must be managed on an ongoing basis (Annex A 8.8); annual VAPT is the common evidence.
- SOC 2: no fixed interval, but auditors expect regular independent testing within the audit period.
- Financial-sector regulation: rules such as the EU’s DORA require regular resilience testing, including threat-led penetration testing for significant entities.
What counts as a significant change?
New internet-facing applications or APIs, major feature releases, authentication changes, new cloud accounts or regions, network re-architecture, mergers and acquisitions, and changes to cardholder or personal-data flows all justify a fresh penetration test.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
Is annual penetration testing enough?
For stable, low-risk systems it can be. For applications that change weekly, pair an annual deep test with per-release testing of high-risk features and automated DevSecOps checks.
What is continuous penetration testing?
An ongoing programme where testers assess new releases and assets throughout the year instead of once, usually combined with continuous vulnerability scanning.