The honest floor is once a year and after significant change. The honest answer for how software is actually built today is continuously. This guide covers frequency by risk tier, why the annual snapshot leaves a gap, and how a hybrid of human depth and continuous coverage closes it.
Every organization should test at least once a year and after significant change. This is the floor set by frameworks like PCI DSS, not a target to aim for.
Teams handling sensitive data, shipping frequently, or under regulatory pressure should test far more often. Quarterly is a common step up from annual.
If you deploy weekly, your surface changes weekly. Continuous testing is the only cadence that matches how the systems it protects actually change.
An annual test tells you the state of your security on one day. The other 364 days, you are relying on the assumption that nothing changed, in an environment built to change constantly. Attackers weaponize new disclosures in days, not months.
Continuous testing removes the assumption. A change is exercised when it lands, and a new exposure becomes a proven finding the same week, not at the next audit.
At minimum once a year and after any significant change, which is the floor most frameworks set. The better answer for a modern environment is continuously, because significant change now happens weekly, and a purely annual test cannot see what shipped since.
Rarely, on its own. An annual test is a snapshot that ages the moment it ends, and most exploited vulnerabilities are weaponized within days of disclosure. Annual depth plus continuous coverage closes the gap between the two.
Testing that re runs as your attack surface changes rather than on a fixed calendar. It catches exposure introduced by deployments, drift, and new assets in the same week it appears, instead of at the next audit.
Continuous coverage from the agent, deep human engagements when they matter, on one standard of evidence.