Short answer: most organisations should commission a penetration test at least once a year and after any significant change, such as a new application, a major release, a cloud migration or a network redesign. That is the PCI DSS rule for card payment environments (PCI SSC), and it is a sensible default for everyone else. ISO/IEC 27001 and the NCSC do not set a fixed interval, so your risk assessment decides whether you need to test more often.
Checked 28 October 2026.
What does the NCSC say about how often to pen test?
The NCSC does not set a fixed frequency. It warns that “A penetration test can only validate that your organisation’s IT systems are not vulnerable to known issues on the day of the test”, and that “It’s not uncommon for a year or more to elapse between penetration tests. So, vulnerabilities could exist for long periods of time without you knowing about them if this is your only means of validating security” (NCSC).
Its advice is to treat penetration testing “as a method for gaining assurance in your organisation’s vulnerability assessment and management processes, not as a primary method for identifying vulnerabilities”. In other words: scan and patch continuously, and use the penetration test to check that this is working.
How often does PCI DSS require penetration testing?
The PCI Security Standards Council’s penetration testing guidance says: “Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any significant change” (PCI SSC Penetration Testing Guidance v1.1).
That guidance was written for PCI DSS v3.2. In the current version of the standard the penetration testing requirements are numbered under requirement 11.4, so confirm the exact wording and any extra requirements, such as segmentation testing, with your QSA.
Does ISO 27001 require an annual penetration test?
No. ISO/IEC 27001:2022 is the requirements standard for an information security management system (ISO). No Annex A control is called “penetration testing”, and the standard “sets no interval for scans or penetration tests” (zerohunt).
Penetration testing is, however, a common way to evidence Annex A controls 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance). You set the frequency in your risk treatment plan, and your auditor will expect you to follow it. Many certified organisations choose annual testing plus testing after major changes. See our ISO 27001 certification support.
Is Cyber Essentials Plus the same as a penetration test?
No. The NCSC describes Cyber Essentials as the “minimum standard of cyber security recommended by the Government”, based on five controls. Cyber Essentials Plus adds “more rigorous, independent technical testing” (NCSC). That technical audit checks the Cyber Essentials controls; it is not a scoped penetration test of your systems. Many organisations do both. See our Cyber Essentials certification service.
When should you test more often than once a year?
Test outside your annual cycle when:
- you launch a new application, website, API or mobile app
- you make a major release, especially changes to login, payments or user roles
- you migrate to or change cloud platforms
- you redesign your network, add a new site or change remote access
- you merge with or acquire another business
- a customer contract, tender or regulator asks for a recent test
- you have had a security incident and want assurance after remediation
Fast-moving software teams often test each significant release, or use continuous vulnerability scanning between annual tests. As the NCSC says, the aim is to know what the testers will find “before they find it”.
How often should different types of test happen?
| Type of test | Typical minimum | Plus |
|---|---|---|
| External network | Annually | After internet-facing changes |
| Internal network | Annually | After major network or Active Directory changes |
| Web application or API | Annually | After significant releases |
| Card payment (PCI DSS) environment | At least annually | After any significant change (PCI SSC) |
| Red team or threat-led test | As your risk and regulator require |
These are common practice defaults based on the PCI DSS rule and NCSC guidance above, not legal requirements. Your own risk assessment should set the final schedule.
How Samurai Security can help
We can set a testing calendar that fits your compliance needs, from an annual external and internal test to testing each major release. Retesting is scoped to the number of findings to re-verify and quoted up front. Our typical day rate is £1,350 per consultant day, lower for multi-day programmes and for clients on a retainer with more days. See our penetration testing services. To see what a test in your calendar might cost, try our penetration testing cost calculator.
Frequently asked questions
How often should a company do a penetration test? At least once a year and after any significant change to its systems. Higher-risk organisations and those that release software often may need to test more frequently.
Is annual penetration testing a legal requirement in the UK? No UK law sets a general annual requirement. PCI DSS requires testing at least annually and after significant change for card payment environments, and contracts or regulators may set their own rules.
Does ISO 27001 require penetration testing? ISO/IEC 27001:2022 does not name penetration testing or set an interval. Many organisations use it as evidence for controls 8.8 and 8.29 and set the frequency in their risk treatment plan.
Does Cyber Essentials Plus count as a penetration test? No. Cyber Essentials Plus adds independent technical testing of the five Cyber Essentials controls, but it is not a scoped penetration test.
Sources
All checked 28 October 2026.