Most often, important and critically necessary objects (sensitive data, payment systems, security measures, etc.) fall under the attack. It is worth spending time and money on them, but there are those categories that in no way will interest attackers. Therefore, spending much money on testing process of low-risk items that can take days to break into is impractical and not recommended. Conduct penetration testing should be done no more than once a year.