Generally, security assessments get performed when a change happens to your IT infrastructure. It can be a network refresh or an application improvement in your environment. A pen test help identify gaps and smartly locate associated risks. Information assets require testing before it gets released in the production environment.