how often should we test?
annually as a baseline, plus after any significant change to authentication, payments, or your hosting setup. if you ship continuously, a lighter quarterly review usually beats one big annual exercise.
a pentest is a snapshot. it tells you where the ways in were on the days we tested, against the code and configuration that existed then. every deploy after that moves the picture a little, and some deploys move it a lot. the right cadence keeps the gap between snapshots smaller than the amount of change in between.
the baseline
once a year, on the full scope. that's what most client questionnaires and insurers expect to see, and it's often enough for a system that changes slowly.
the triggers
some changes deserve a test of their own, whenever the last one was:
- anything touching authentication: a new login method, single sign-on, a password reset flow, a new user role
- anything touching payments or billing
- a hosting move, a new cloud account, or a big change to how the system is deployed
- a new public API, or a new integration that gets access to customer data
these can be scoped narrowly. you don't retest the whole application because you added a payment provider; you test the payment flow and what it touches, and the price follows the scope.
if you ship every week
one big annual exercise tends to find a year's worth of accumulated problems at once, which is a bad week for your developers. a lighter quarterly review, on whatever changed that quarter, catches the same issues while they're still fresh and cheap to fix. between reviews, your own team can run the 14-point checklist before each significant release.