Pen testing frequency varies based on factors like web application complexity and breach risk. Generally, annual pen testing or testing after major application changes is recommended. However, since new threats and vulnerabilities constantly emerge, high-risk organisations or those handling sensitive data may need more frequent tests. This ensures their security measures stay effective and current. Also, consider a web app pentest after significant infrastructure changes, like new technology deployments or third-party system integrations. These changes can introduce new vulnerabilities not covered in previous tests.