Pentesting should be conducted on a regular basis, at least annually (and more frequently if there have been significant changes to the system, application or network). If you’re conducting pentesting in response to a suspected breach, it’s important to act quickly in order to minimize the damage.