Once a year" is the most common answer to the question of how often penetration tests should be carried out. This answer may be correct, but it can also be completely inadequate, depending on your organisation, development pace and regulatory environment. Let us look at the issue systematically.
Penetration test vs. Vulnerability scan: The key difference
First, let us clarify the terminology, as confusing these terms is very common and leads to poor decisions regarding testing frequency:
Vulnerability scan (automated vulnerability scan)
A vulnerability scan is an automated tool (Nessus, OpenVAS, Qualys...) that compares your infrastructure against a database of known vulnerabilities (CVE). The result is a list of vulnerabilities with their severity (CVSS score).
- Fast and cheap: from tens of minutes to an hour.
- Covers only known vulnerabilities: does not assess logical errors, configuration faults or business logic.
- No exploitation: identification only, not verification of whether a vulnerability is actually exploitable.
- Ideal frequency: weekly to monthly as a continuous hygiene activity.
Penetration testing (manual ethical hacking)
A penetration test is a manual attack simulation carried out by an experienced penetration tester. The tester actively exploits vulnerabilities, chains findings together and attempts to achieve a defined objective (gaining access to a database, compromising a domain controller, exfiltrating sensitive data).
- More time-consuming and expensive: days to weeks.
- Reveals vulnerabilities that automated tools miss: logic errors, authorization flaws, and combinations of weaknesses.
- Provides a realistic view of actual risk: not just a list of CVE numbers.
- Recommended frequency: 1–4 times a year depending on the context.
A vulnerability scan does not replace a penetration test, nor vice versa. They are complementary tools.
Recommended frequencies for different types of organisations
Small businesses (up to 50 employees, no regulatory requirements)
Minimum recommendation: Once a year Comprehensive penetration testing of infrastructure and web applications, supplemented with quarterly vulnerability scanning.
Focus on: external perimeter (publicly accessible systems), web applications, email security (phishing simulations), backups and recovery.
Medium-sized companies (50–500 employees) and entities subject to NIS2
Recommendation: twice a year penetration testing (one on external infrastructure, one on internal systems/applications), monthly vulnerability scanning, quarterly phishing simulations.
NIS2 mandatory entities should document testing results as part of their security management system and be prepared to present the results to NÚKIB during supervisory activities.
Financial sector, healthcare and critical infrastructure
Recommendation: quarterly penetration testscontinuous vulnerability management, red team exercises at least once a year. Regulatory requirements (CNB, NIS2, DORA) may specify precise requirements.
Financial institutions under DORA (Digital Operational Resilience Act) are required to carry out TLPT (Threat-Led Penetration Testing) in cycles set by the regulator.
Software companies and SaaS providers
Recommendation: penetration test of every major release or quarterly (whichever comes first), continuous SAST/DAST in the CI/CD pipeline, and a bug bounty program as a supplement.
When to carry out an ad-hoc penetration test outside the scheduled cycle
A regular schedule is essential, but there are situations where an extraordinary test must be carried out without waiting for the scheduled date:
- Deployment of a new application or service. Every new production application with access to the internet or sensitive data should undergo a security test before launch or immediately after.
- Fundamental architectural changemigration to the cloud, transition to microservices, new VPN endpoint, new third-party integration, each such change alters the security profile and requires re-evaluation.
- Mergers and acquisitions (M&A)Before finalising the transaction, carry out a security due diligence (technical security assessment) of the target company. You are acquiring their vulnerabilities as well as their assets.
- Following a cyber incident. After successfully managing a ransomware attack, data breach or other incident, carry out a penetration test to determine whether the attacker left any backdoors or if similar vulnerabilities exist elsewhere.
- Before an audit or certificationprior to ISO 27001 certification, a SOC 2 audit or a customer security audit.
- Publication of a critical vulnerability. If a critical CVE is disclosed in the technologies you use (Log4Shell was a good example), carry out a targeted test beyond the plan.
NIS2 and requirements for security testing
The NIS2 Directive (the Cybersecurity Act in the Czech Republic) does not explicitly specify the frequency of penetration tests by a number, but Article 21 requires the implementation of a "testing and security assessment policy" and "measures to assess the effectiveness of measures for managing cybersecurity risks".
In practice, this means:
- You must have a documented procedure for safety testing.
- Testing must be commensurate with your organisation's risk profile and activities.
- The testing results must be documented and serve as input for improving safety measures.
- At the request of NÚKIB you must be able to demonstrate that testing is being carried out and that findings are being addressed.
We recommend at least Annual penetration testing for entities subject to NIS2 obligations, supplemented by regular vulnerability scanning and documentation of the results. It also depends on the entity category, "wichtige" (important) versus "wesentliche" (essential/critical) entities have different requirements.
How to plan safety testing in the annual cycle
Instead of an ad-hoc approach, we recommend compiling a security testing plan for the entire year. A typical annual cycle for a medium-sized organisation:
- Q1 (January–March)Comprehensive external penetration testing (perimeter, web applications, email gateway). Results serve as input for prioritising security investments for the given year.
- Q2 (April–June)Internal penetration testing (Active Directory, lateral movement, privilege escalation). Phishing simulation campaign.
- Q3 (July–September)Testing of specific applications or systems according to priorities (new applications, systems with historical findings). Wi-Fi audit.
- Q4 (October–December)Red team exercise or social engineering test for advanced organisations. Preparation for the following year, reassessment of the testing plan.
- Ongoing. Weekly or monthly automated vulnerability scanning, monthly phishing simulations.
SecureOn.cz offers the preparation of a custom annual security testing plan for your organisation, including risk analysis, design of the test scope and their ongoing execution. The result is not only reports with findings, but also retesting after remediation and ongoing support during the implementation of recommendations.
Conclusion: Testing as part of the safety programme
There is no simple answer to the question "how often". The correct frequency depends on your risk profile, the pace of changes in infrastructure, regulatory requirements and budgetary possibilities. It is crucial that testing is carried out regularly, results are monitored and findings are actually rectified.
The worst situation is an organisation that carries out a pentest once every three years and then ignores the findings due to a lack of capacity for remediation. A less ambitious but regular and monitored programme is better than a large-scale test without follow-up.