Most organizations should run a penetration test at least once a year and after any significant change to their systems: an annual baseline plus tests after big changes. Beyond that, penetration testing frequency depends on how fast your systems change, what regulators expect and how much risk a missed vulnerability carries.
Plan backwards from any audit date. A typical test runs one to three weeks plus a few days for the report (see how long a penetration test takes), and critical findings are reported during the test. Pricing is based on tester-days with no hidden fees; see penetration testing pricing.
Recommended penetration testing frequency by risk level
Start from a yearly test; the right pentest frequency then comes from your risk assessment and how often your systems change.
- Annually (baseline): Stable environments can rely on a yearly round of network and infrastructure testing plus key applications. PCI DSS requires internal and external penetration testing at least once every 12 months and after any significant infrastructure or application upgrade or change.
- Every six months: In PCI DSS, only service providers that use segmentation must test their segmentation controls at least every six months. Otherwise, twice a year can make sense when your risk assessment shows frequent change.
- Quarterly: The quarterly cadence in PCI DSS applies to vulnerability scans, not penetration tests: internal and external scans run at least once every three months, with external scans performed by an Approved Scanning Vendor (ASV). See how vulnerability scanning and penetration testing differ.
- Per major release: Teams that deploy often should test major releases of a web application or API and keep scans running in between.
Event-driven triggers for a penetration test
Some events justify a test whatever the calendar says. PCI DSS doesn’t define a significant change; PCI SSC guidance leaves it to each organization’s risk assessment, with examples such as infrastructure or application upgrades and new system components. Common triggers:
- Major network, cloud or application changes, such as a cloud migration or a new AWS or Azure account.
- Architecture or identity changes, such as restructuring your internal network and Active Directory or adding single sign-on.
- New products, features or public endpoints added to your internet-facing systems.
- After a security incident, once fixes are in place, to check the entry points are closed; a retest is available after fixes.
- Mergers and acquisitions, when a network you’ve never tested joins yours.
Industry framework perspectives on testing frequency
Frameworks differ in how firmly they set the interval; our guide to penetration testing requirements covers each one in depth.
- PCI DSS: PCI DSS penetration testing frequency is at least once every 12 months and after significant changes. If segmentation is used to reduce PCI DSS scope, it’s tested at least every 12 months and after changes to segmentation controls.
- DORA: Threat-led penetration testing applies only to financial entities that their TLPT authority identifies based on impact, systemic character and ICT risk profile, and under Regulation (EU) 2022/2554 it’s generally carried out at least every three years.
- NIS2: There’s no fixed interval. Article 21(2)(f) asks for policies and procedures to assess the effectiveness of cybersecurity risk-management measures; see NIS2 testing obligations for how that applies to testing.
- HIPAA: The Security Rule sets no penetration testing interval; see HIPAA penetration testing requirements for the current rule and the proposed changes.
- UK NCSC guidance: The NCSC notes that a year or longer often passes between penetration tests, so vulnerabilities can go unnoticed for long periods if testing is your only check. It advises keeping your normal security testing running alongside.
Plan your testing calendar
How often should you pen test your systems?
Tell us what you run and how often it changes, and we’ll send a fixed-price quote in tester-days. Web application and API tests start at $2,500.
Sources: PCI SSC Penetration Testing Guidance v1.1; PCI SSC Scoping and Segmentation Guidance v1.1; PCI DSS v4.0 SAQ C; Regulation (EU) 2022/2554 (DORA); Commission Delegated Regulation (EU) 2025/1190; Directive (EU) 2022/2555 (NIS2); NCSC: Penetration testing.
The Pentestica penetration testing team: 25 certified senior pentesters (OSCP, OSCE, CISSP) with 10+ years of offensive security operations and 500+ penetration tests behind them. Our testing is aligned with OWASP, PTES and NIST SP 800-115.