The ideal time to conduct web application pen testing would be before a production release. However, schedule pressures often lead to developers deploying applications without putting them through the proper security testing and that can leave security vulnerabilities in these web applications.