A pentest is on the annual agenda of many organisations. It feels familiar, it produces a report, and the box is ticked. But is the picture that you are therefore secure actually accurate? In this article we explain step by step what a penetration test truly measures, where the limits of an annual approach lie, and how to align your testing frequency with the actual risks of your organisation. We build from basic concepts towards concrete choices you can apply immediately.
What does a pentest actually do, and what doesn’t it do?
A penetration test is an authorised, simulated attack on your systems, networks, or applications. Certified ethical hackers attempt, using the same methods as real attackers, to find vulnerabilities before malicious parties do. The result is a report with concrete findings and priorities.
What many people do not know, however, is that a pentest works in layers. There are roughly three levels to distinguish:
- Layer 1: Known vulnerabilities – Think of known CVEs, public exploits, and checking whether patches have been applied correctly. This is the most visible layer.
- Layer 2: Individual weaknesses – Incorrect cloud configurations, overly broad permissions, identity weaknesses, and insecure application settings that do not appear directly in a CVE database.
- Layer 3: Correlated attack paths – This is where a good offensive security partner adds real value. Not every individual finding needs to be critical, but multiple small weaknesses can together lead to full access to your cloud resources.
A concrete example makes this clear: an SSRF vulnerability may seem limited on its own. But combine it with a managed identity, overly broad Azure RBAC permissions, and access to a Key Vault, and suddenly you have an attack path to subscription owner rights. Attackers do not see individual findings — they see attack paths. A pentest that only covers the first two layers misses the most dangerous part.
Why a pentest is a photograph of a moving target
An annual pentest provides an accurate picture of your security, but only at the moment of testing. To put it vividly, it is a photograph of a moving target.
Cybercriminals develop new attack techniques 365 days a year. New vulnerabilities are discovered daily, software configurations change with every update, and an organisation’s IT environment grows and evolves continuously. A pentest that gives the all-clear today says little about the situation three months from now.
Moreover: the more time there is between two pentests, the greater the chance that a vulnerability goes unnoticed while attackers are already exploiting it. An annual measurement therefore creates a false sense of security — not because the test is poor, but because the world around it does not stand still.
When is an annual pentest sufficient?
It is fair to acknowledge that an annual pentest is a good choice in some situations. Not every organisation has the same risk profile, and the testing frequency must always be proportional to the actual threat.
An annual penetration test may be sufficient when:
- The IT environment is relatively stable and undergoes few changes
- There is little sensitive customer data or critical business processes online
- Compliance requirements prescribe an annual test and there are no additional risks
- The organisation has additional security layers, such as continuous monitoring and vulnerability scanning
The pitfall is that many organisations view the annual pentest as the endpoint of their security effort, whereas in reality it is just one measurement within a broader security strategy. A vulnerability scan between two pentests can help bridge the intervening period.
How continuous testing closes the security cycle
Where an annual pentest offers a snapshot, continuous testing closes the security cycle. The idea is simple: you cannot defend what you do not test, and testing must therefore take place continuously, not once for a certificate or because an auditor is coming.
Continuous testing does not serve as a replacement for the in-depth pentest, but as a complement to it. It combines regular automated scans with periodic manual tests, so that new vulnerabilities are quickly discovered and the security status remains current. This closely aligns with the thinking behind Continuous-Q, where testing is not a one-off exercise but a living capability within the organisation.
If you build on this principle, the role of security shifts from reactive to proactive. Instead of waiting for the annual report, you have continuous visibility into your attack surface. That is not a luxury for large organisations — it is the logical response to a threat landscape that also does not change just once a year.
What determines the right testing frequency for your organisation
The right testing frequency is not a universal formula. It depends on a combination of factors that differs per organisation. If you base this decision on the concepts from the previous sections — the layers of a pentest, the dynamics of the threat landscape, and the value of continuity — the following questions are guiding:
- How dynamic is your IT environment? Regular releases, cloud migrations, and new integrations expand the attack surface and call for more frequent testing.
- How sensitive is your data? Organisations that work with personal data, financial information, or critical infrastructure require a higher testing frequency.
- Do you serve other organisations? Managed Service Providers are a favourite target of cybercriminals, precisely because compromising one MSP gives direct access to all of that MSP’s clients. The responsibility is greater, and the testing frequency must move accordingly.
- What compliance requirements apply? Regulations such as NIS2 impose requirements on demonstrable security efforts. A compliance framework can serve as a minimum baseline, not as an endpoint.
- How quickly do you want to respond to new threats? Organisations with a low risk tolerance opt for shorter testing cycles and additional red team exercises to also simulate advanced attack scenarios.
The core of all this is that the testing frequency must be a deliberate choice, based on your actual risk profile — not on habit or convenience. An annual pentest is a good starting point, but rarely the endpoint of a mature security strategy.
How Q-Cyber helps with continuous pentesting
At Q-Cyber we believe that security is not a snapshot, but an ongoing process. We help organisations take the step from an annual pentest to a security strategy that moves with the threat landscape. Concretely, we do this in the following ways:
- In-depth pentests that not only report individual vulnerabilities, but also expose correlated attack paths that automated tools miss
- Continuous-Q, our continuous testing programme developed specifically for organisations that want ongoing visibility into their attack surface
- Independent advice on the right testing frequency for your organisation, without dependency on software vendors or other suppliers
- Red team exercises for organisations that also want to simulate advanced attack scenarios
- Compliance guidance for organisations that need to comply with NIS2 or other regulations
Want to know whether your current testing frequency matches your actual risk profile? Get in touch and we will be happy to think along with you.