A penetration test is one of the most useful things a business can do for its security. It is also easy to misread. A clean report tells you what a tester could and could not do on the day the test ran. It says much less about next month.
Networks change constantly. Staff join and leave, laptops get replaced, a vendor gets remote access for a project, someone spins up a cloud service, and new vulnerabilities are published every week. Verizon’s 2026 Data Breach Investigations Report found that exploited vulnerabilities were the most common way into breaches, at 31% (Verizon 2026 DBIR). Attackers work on their schedule, not your audit calendar.
That is the case for recurring testing. Not testing for its own sake, but testing often enough that what you know about your risk is still true.
How often should penetration testing be done?
The honest answer depends on how much your environment changes and what rules you answer to. A few reference points help:
- The FTC Safeguards Rule. Financial institutions covered by the rule, which includes many auto dealers, mortgage brokers, tax preparers and other non-bank businesses, must run an annual penetration test and vulnerability assessments at least every six months, unless they have continuous monitoring in place (16 CFR 314.4(d)(2)).
- PCI DSS. Organizations that handle card data must run internal and external vulnerability scans at least once every three months and a penetration test at least once every 12 months and after significant changes (PCI Security Standards Council document library).
- Cyber insurance. Many insurers now ask how often you scan and test, and whether you fix what you find. See our cyber insurance readiness page for the controls they most often ask about.
Treat those as minimums. If your environment changes every week, a test once a year leaves 51 weeks of guesswork.
Scans and tests are not the same thing
It helps to separate two jobs that often get lumped together.
A vulnerability scan is broad and automated. It checks systems against a large library of known issues and tells you what is missing a patch or misconfigured. It is fast, repeatable and good at keeping the list of known problems short.
A penetration test is deeper and adversarial. It asks what an attacker could actually do from a given starting point: which weaknesses chain together, how far they could move, and what data they could reach. It is better at showing real impact. If you want the longer comparison, our post on penetration testing vs vulnerability scanning walks through each one.
Neither one replaces the other. Scans without testing tell you what is wrong but not what matters. Testing without scans tells you how far an attacker got once, then goes quiet.
Two cadences: monthly checks and quarterly testing
The model that works for most mid-market and multi-site organizations pairs the two:
- Monthly vulnerability checks of internal and external systems. These catch newly published issues, missed patches and configuration drift while they are still small.
- Deeper testing on a recurring schedule, such as quarterly. Each round shows how far an attacker could get today, not last spring.
- Retesting after fixes. A finding is not closed when a patch is deployed. It is closed when the same path is tested again and no longer works.
- A plain-language readout. Leadership should see trend lines: what was found, what was fixed, how long it took and what is still open.
That is how BTI’s Cyber Watch program is built. Cyber Watch runs monthly vulnerability scans of internal and external assets, quarterly penetration tests with an independent testing partner, quarterly Microsoft 365 analysis and dark web credential monitoring. Testing starts without admin credentials, findings are retested after fixes, and leadership gets a quarterly readout in plain language. Fixes flow into BTI managed patching and vulnerability management, backed by our 24/7 NOC/SOC.
Is “continuous penetration testing” the same thing?
You will see the phrase continuous penetration testing used in a few ways. Sometimes it means fully automated attack simulation running all the time. Sometimes it means a human-led test repeated on a schedule. Sometimes it simply means scanning plus an annual test.
The label matters less than three questions:
- How often does someone test how far an attacker could get, not just what is missing a patch?
- Are fixes retested, or just marked done?
- Does leadership see progress over time, or one report a year?
If the answers are “once a year,” “no” and “one report,” the program is a snapshot, whatever it is called.
Signs a yearly test is not enough for you
- You have added offices, a new line of business or a large group of remote users since the last test.
- Vendors or contractors have remote access to your network.
- You moved systems to the cloud or Microsoft 365 since the last report.
- Your last report had findings, and nobody has confirmed they were fixed.
- An insurer, auditor or customer asked how often you test, and the answer was uncomfortable.
What recurring testing looks like in Los Angeles, Chicago and Phoenix
BTI supports organizations across Southern California, Chicagoland and Arizona, including multi-site businesses with locations in more than one region. Local engineers handle on-site follow-up when a finding involves a physical device, a closet or a branch network. Find your nearest team on our Los Angeles, Chicago or Phoenix and Tucson cybersecurity pages.
Start with a free baseline
If you have never had a test, or your last one is more than a year old, start with a baseline. BTI’s free cybersecurity assessment is a credential-free test of 3 to 5 machines you choose, with an optional external scan, a written report, a prioritized roadmap and a readout with a senior engineer. If you want the work to keep going after that, Cyber Watch turns the baseline into a monthly and quarterly rhythm.
Get a free cybersecurity assessment or book a free consultation. Call the BTI IT team: Los Angeles 323-510-8003, Chicago 312-492-2613, Phoenix 480-272-8728.
Cybersecurity by industry
Logistics
Warehouses, dispatch and multi-site networks.
Logistics cybersecurity →Healthcare
Medical groups, pharmacies and dental practices.
Healthcare cybersecurity →Construction
Job sites, project files and field devices.
Construction cybersecurity →Education
Schools and campuses with many users and devices.
Education cybersecurity →Nonprofits
Lean teams protecting donor and client data.
Nonprofits cybersecurity →Parking and venues
Payment, access and guest networks.
Parking and venues cybersecurity →
Frequently asked questions
How often should penetration testing be done?
At least once a year and after any significant change, which is what PCI DSS requires. The FTC Safeguards Rule also calls for an annual penetration test and vulnerability assessments every six months for covered businesses. Organizations whose networks change often get more value from quarterly testing paired with monthly scans.
What is continuous penetration testing?
It usually means testing on a recurring schedule, or with automated tools running all the time, rather than one test a year. What matters is that someone regularly checks how far an attacker could get, fixes are retested, and leadership sees progress over time.
Is a vulnerability scan the same as a penetration test?
No. A scan is a broad, automated check for known issues. A penetration test goes deeper and shows what an attacker could actually do with those issues. A strong program uses both.
Why retest after fixing a finding?
Because a deployed patch or configuration change does not always close the problem. Retesting the same attack path is the only way to confirm the risk is really gone.
What does BTI's Cyber Watch include?
Monthly vulnerability scans of internal and external assets, quarterly penetration tests with an independent testing partner, quarterly Microsoft 365 analysis, dark web credential monitoring, retesting after fixes and a quarterly plain-language readout.
