Many business leaders ask the question: "How often should we pentest?" The frequency of pentesting depends on what type of company you are running, how many devices are in use, and where your data resides. For many companies, the idea of pentesting seems like a luxury. They're not sure what to think about this additional security measure and wonder if it's worth the effort or expense.  There are some pretty big benefits to pentesting that you can't get from just doing your best to stay on top of patching and vulnerability scanning alone.

What is a Pentest?

A penetration test (or pentest)  is an attempt to evaluate the security of your IT infrastructure. These tests are useful in validating both defensive mechanisms and end-user adherence to policies. Penetration testers see if they can exploit vulnerabilities, like OS flaws or application flaws that exist on more than one system with improper configurations.

There are a variety of different standard frameworks and methodologies for conducting penetration tests. These include the Open Source Security Testing Methodology Manual (OSSTMM), the Penetration Testing Execution Standard (PTES), the NIST Special Publication 800-115, the Information System Security Assessment Framework (ISSAF) and the OWASP Testing Guide. It's important to understand which framework is most appropriate for your business needs before starting any testing engagements.

How often should we Pentest?

When should you do a pentest? There is not one answer for every business but if your business has never had a pen test, but it's best to start soon. Even if the audit can only be done once every year or two years, they are still worth doing because these tests will find vulnerabilities before hackers exploit them and steal your data from under your nose.

It is important to remember that eventually, every defense will become vulnerable due to technological advances in hacking tools and techniques. As a result of this, it’s essential for businesses with high risk profiles – especially those who rely heavily on data-driven processes or customer information – to test their defenses regularly by performing regular pentests. A good rule of thumb is once per month if your organization falls into the “high” category, and once every six months if you belong in the “low” category.

Companies need to ask these questions to determine the risk category:

  • Do you collect, generate, or otherwise handle sensitive information (such as names, addresses, phone numbers, banking information, or other personally identifiable information) for customers?
  • Do you believe your organization is actively at risk of a cyberattack? Are you aware of other organizations like yours that have been actively targeted with a cyberattack?
  • Does your work generate controversy, or is it viewed with hostility by government actors, government-backed organizations, or independent malicious actors?
  • Is any individual affiliated with your organization (staff, board members, advisors) engaged in work or behaviors that might draw attention from adversaries and malicious actors?

What are the costs of doing a Pentest?

What are the costs of doing a pentest? The cost for penetration testing can vary greatly depending on the organization’s size, requirements, and objectives. A basic penetration test usually starts at $5K but goes up to $500K+ for an enterprise-level assessment. In addition to the price tag there is also a wide range in quality among pentesters. This makes it difficult for companies to compare pricing or choose from qualified providers without conducting significant research beforehand.

For example, if you have conducted a Google search looking for “pentester” your results will show several firms offering their services with wildly different pricing.  This is certainly a situation where you get what you pay for.

Conclusion

Pentesting is an important part of cybersecurity. The frequency with which you should pentest depends on the level of risk that your business takes and how quickly you want to know if a vulnerability has been found in your network. Regardless of what type of risk your company faces, remember that eventually all systems will become vulnerable due to new and evolving threats.

To help determine when it’s time for a pentest, schedule a consultation today.

The world is changing, and so are the threats to your business. We’re here to help you stay ahead of the curve with our comprehensive penetration testing services. Our team will work closely with your IT team to identify vulnerabilities in your environment that can be exploited by attackers. You may not know it now, but there could be many exploitable vulnerabilities in your environment that could lead to a data breach or other security incident if left unaddressed.

At Framework Security, with our proactive approach, we can find these vulnerabilities before an attacker does and remediate them before they cause any damage. This way you can rest easy knowing that all of the potential risks have been eliminated from your company's network infrastructure and systems - leaving you free to focus on what matters most – running a successful business!

‍