Blog

The Internet has opened up many new opportunities for business everywhere. But it has also created new threats and vulnerabilities that bad actors with malicious intent freely exploit. To protect their assets from threat actors, smart organizations try to find exploitable vulnerabilities in their networks and systems as early as possible. But they know that simply finding weaknesses is not enough. They must also address them before cybercriminals can exploit them. And for this, penetration testing is crucial.

Penetration testing (pen testing) enables organizations to simulate cyberattacks to proactively find and fix issues before they cause untold damage.

So, how often should you pen test?

Is there a “best” time for pen testing?

Pen Test vs Vulnerability Scans

Vulnerability scans have their place in cybersecurity. After all, they bring automation to the organization’s testing environment. “We don’t like automation,” said no company ever!

Automation helps identify vulnerabilities using a predefined list of known vulnerabilities. However, the italicized words hint at the weaknesses of vulnerability scanners. Yes, they can identify vulnerabilities before cybercriminals, help firms save time and money and meet security compliance requirements. But since they rely on a list of known security weaknesses, they’re only as good as the latest update. Delayed updates mean outdated scanners that miss critical weaknesses and increase the risk to organizations.

Vulnerability scanners are also infamous for delivering numerous false positives. Reviewing each result means wasted time, inaccurate information about the organization’s security posture, and overburdened reviewers suffering from alert fatigue.

Unlike vulnerability scans, pen tests are performed manually by qualified individuals, say with an OSCP certification, and working with a specialist firm like Packetlabs. It uses the latest tools and technologies but does not rely on automation to deliver valuable insights. The tester carefully examines multiple issue types and provides a detailed test report with findings and prescriptive suggestions. Some specialists like Packetlabs also perform a root cause analysis to inform and strengthen their strategic and tactical recommendations.

Clearly, pen tests are a crucial element of organizations’ information security management systems. Now, the question is: when and how often should organizations undertake pen testing?

When to Perform a Pen Test

First, organizations must understand that a pen test is not a one-time-only activity. The cyber threat landscape is constantly evolving. New vulnerabilities are being discovered frequently, and for every cybercriminal that hangs up their shoes (one can always hope!), another three jump into their place. That’s why it’s important to put up timing “goal posts” to guide the organizations’ pen test strategy.

Therefore, pen tests should be conducted whenever these situations occur:

• New components or applications added to the IT infrastructure,

• Significant changes or upgrades made to the infrastructure, even if no further components are added,

• Security patches applied to antivirus or firewall software,

• Company acquisitions and mergers (should be conducted before acquiring or merging)

Almost all organizations experience these situations during their operations, making pen tests critical for maintaining a strong security posture.

The “best” time to perform pen testing is right before a particular system is put into production. This is important since the system is no longer in a state of constant change at this stage. Contrarily, when organizations (initiate and complete) pen tests too early, i.e. when the system is still being deployed, they could miss important vulnerabilities that have not yet been discovered.

Pen testing is also important in unusual or rare situations, such as when the company’s location changes or when another office is added to the enterprise network.

That was the when part. What about the frequency? How often should you conduct a pen test?

How Often to Perform a Pen Test

Many pen test experts recommend annual or half-annual pen tests for most organizations. However, this is more of a thumb rule rather than a mandate.

An annual pen test can reduce the company’s security risks. And it’s definitely better than no pen tests at all! However, today’s businesses tend to undertake rapid changes to production systems. Therefore, they should ideally run pen tests quarterly or immediately after production deployment following a change in an application or its underlying technologies. As a rule of thumb, it’s best to split the penetration testing throughout the year, conducting a quarterly external pen test and a semi-annual internal test.

Other factors to be considered to determine pen test frequency:

• Company size

• Potential exposure to attack vectors

• Industry

• Infrastructure type/size

• Industry-specific regulatory environment

Conclusion

When thinking about pen test timing and frequency, the cost is a concern for organizations – a valid one. However, organizations should be cognizant of and focus on their advantages instead of focusing only on costs. A pen test can strengthen organizational security and improve its resilience to the threat environment. It also forces the firm to be more vigilant and take proactive action to minimize security risks. 

Are you ready for more than a VA scan?® Ask us for a free, no-obligation quote. And if you have any questions about choosing a penetration testing company or penetration testing pricing, please contact us.