How Often Should You Have a Penetration Test Performed?

October 11, 2022 Josh Tomkiel

So you're interested in having a penetration test performed and you're wondering, is one enough for five years? Do I have to do it weekly or monthly? In this video, we'll talk about how frequently you should have a test performed.

Hi, I'm Josh Tomkiel, I'm a senior manager here at Schellman on the pen test team. I've been in the industry for over 10 years, started out as a penetration tester, and now I'm a manager so I've seen things from both sides. And all the time we get asked how frequently should we have a pen test perform?

Well, as with most things, it does depend (at least annually). If there's any major changes to your environment or web application, that's a good time to have a pen test. If there's a compliance initiative that says you must do it by X date or you must have certain things tested, well, there's your answer on that front.

But in general, we have all sorts of clients having pen tests performed quarterly or after major releases, or annually. It's really up to you.

The threat landscape is always evolving and changing. Just because you're not vulnerable today doesn't mean you won't be vulnerable to something tomorrow.

There's new patches, security updates coming out all the time. And a pen test is only good for a moment in time. That point in time, that report, that deliverable will say you had certain issues or you didn't have certain issues identified at this point in time. Now, tomorrow is a different story.

So I hope you understand now why maybe just having a pen test performed annually is not good enough in all cases. If you're interested in learning more about penetration testing or have any other questions, head over to our website, fill out our form and myself or another pen test specialist will be in touch shortly.

About the Author

Josh Tomkiel is a Director and Penetration Tester based in Philadelphia, PA with over 10 years of experience within the Information Technology field. Josh has a deep background in all facets of penetration testing and works closely with Schellman's other service lines to ensure penetration testing requirements are met. Additionally, Josh leads Schellman's Red Team service offering, which provides an in-depth security assessment focusing on different tactics, techniques, and procedures (TTPs) for clients with mature security programs.
More Content by Josh Tomkiel

How to Use Entropy in Penetration Testing

Need a real way to bypass antivirus/endpoint detection (AV/EDRs)? We explored entropy, and here we lay out ...

Next Video

How Long Does a Penetration Test Take?

Stay up to date and discover new insights into compliance through our team’s thought leadership

How Often Should You Have a Penetration Test Performed?

About the Author

Previous Article

Next Video

How Often Should You Have a Penetration Test Performed?

About the Author

Previous Article

Next Video

Other content in this Stream

Wondering how a web application penetration test actually works? We overview the 4 steps of our process so that you can know what to expect from your engagement.

Are you an experienced penetration tester seeking a new opportunity? Learn how Schellman is addressing common issues those in the industry face to help determine if this is the right place for you.

Want to be part of our Pen Test Team? We provide details on the expectations and responsibilities of an Associate Penetration Tester so that you can decide whether this is the right move for you.

Malicious actors can still leverage XSS payloads to perform CSRF-type attacks to great effect. Learn how this threat works and how you can demonstrate its potential impact during penetration testing.

Need a real way to bypass antivirus/endpoint detection (AV/EDRs)? We explored entropy, and here we lay out how you too can use it to help in bypassing security tools during testing.

Invested in a web application penetration test? We detail what this specific test is, as well as 5 things you need to prepare so that you can streamline your experience as much as possible.

Now that the new guidance is out, understand what's changed and the 6 attack vectors that will factor into your next FedRAMP penetration test.

If you're gearing up for an internal pen test, learn exactly what you're in for and how you can streamline your preparation by making 2 key decisions ahead of time. Famous detectives throughout

Getting ready for your penetration test with Schellman's team? Here are 6 common issues you'll want to avoid so that your testing isn't delayed and goes as smoothly as possible.

Curious about Schellman's pen test capabilities? Read about what you can expect from our experienced team of pen testers during an engagement, including details on our qualifications & deliverables.

Penetration testing can mean a number of different things and approaches. We break down one specific kind of test that may suit your cybersecurity needs.

Wondering what a pen test costs? Your scope will play a huge part in price--we detail different kinds of pen tests and the scoping factors that will affect your final number.

Do you need a penetration test of some sort? We detail, step-by-step, what the experience of such a process with Schellman would look like so you can better set expectations for your own pen test.

It has never been easier to establish an online presence and having your domain is key. When managing DNS records users should stay up to date with regards to safeguarding their domain's reputation.

Having trouble scanning RDS? Here are 5 easy steps to help you set up your Nessus scanner correctly so that you can complete successful scans to meet FedRAMP requirements.