Ideally, a vulnerability assessment will be carried out once a year or, in the case of a particular application, whenever there are code changes or new features are introduced.