How often you penetration test depends entirely on what you are testing and how often systems and environments are updated. A rule of thumb is to test at least once a year in cases where you do not make major releases or changes to what is to be tested.