Frequently Asked Questions

Any competent, independent tester, though certification bodies look for genuine expertise rather than an automated scan with a cover page. In the UK, CREST accreditation is a common benchmark for quality and independence.

The standard does not spell out either by name, but a test that covers only your perimeter leaves the insider view untested. Most organisations run both external and internal testing so their vulnerability management evidence stands up to scrutiny.

The standard sets no fixed frequency and ties it to your risk assessment instead. Most certified organisations test at least once a year and again after any significant change, and align testing with their surveillance and recertification audits.

Not word for word. ISO 27001 does not explicitly require a penetration test, but Annex A control 8.8 requires you to manage technical vulnerabilities and prove it, and penetration testing is the most credible evidence most organisations can offer. In practice, auditors expect to see it.

Requirement 11.4 in PCI DSS v4.x. In the older v3.2.1 version it was Requirement 11.3, so any guidance still pointing to 11.3 for penetration testing is out of date.

At least once every 12 months for both internal and external testing, plus an additional test after any significant change to your in-scope systems. Segmentation testing is required at least every 12 months for most organisations, and at least every six months for service providers.

A vulnerability scan is largely automated and checks your systems against known issues, and it has to be run at least quarterly, with external scans performed by an Approved Scanning Vendor. A penetration test is a manual, in-depth exercise where a tester actively tries to exploit weaknesses and reach cardholder data. Both are required, and neither replaces the other.

Yes. Requirement 11.4 of PCI DSS v4.0.1 requires internal and external penetration testing at least every 12 months and after any significant change. It is one of the most explicit penetration testing mandates in any major security standard.

Requirement 11.4 in PCI DSS v4.x. In the older v3.2.1 version it was Requirement 11.3, so any guidance still pointing to 11.3 for penetration testing is out of date.

At least once every 12 months for both internal and external testing, plus an additional test after any significant change to your in-scope systems. Segmentation testing is required at least every 12 months for most organisations, and at least every six months for service providers.

A vulnerability scan is largely automated and checks your systems against known issues, and it has to be run at least quarterly, with external scans performed by an Approved Scanning Vendor. A penetration test is a manual, in-depth exercise where a tester actively tries to exploit weaknesses and reach cardholder data. Both are required, and neither replaces the other.

Yes. Requirement 11.4 of PCI DSS v4.0.1 requires internal and external penetration testing at least every 12 months and after any significant change. It is one of the most explicit penetration testing mandates in any major security standard.

Requirement 11.4 in PCI DSS v4.x. In the older v3.2.1 version it was Requirement 11.3, so any guidance still pointing to 11.3 for penetration testing is out of date.

At least once every 12 months for both internal and external testing, plus an additional test after any significant change to your in-scope systems. Segmentation testing is required at least every 12 months for most organisations, and at least every six months for service providers.

A vulnerability scan is largely automated and checks your systems against known issues, and it has to be run at least quarterly, with external scans performed by an Approved Scanning Vendor. A penetration test is a manual, in-depth exercise where a tester actively tries to exploit weaknesses and reach cardholder data. Both are required, and neither replaces the other.

Yes. Requirement 11.4 of PCI DSS v4.0.1 requires internal and external penetration testing at least every 12 months and after any significant change. It is one of the most explicit penetration testing mandates in any major security standard.

Neither standard is satisfied by testing alone, but testing provides the evidence that your risk assessments and technical controls have been validated rather than assumed.

Annually is the common baseline, and it is what most client questionnaires and insurers ask about. Test again after significant change, such as a migration, a merger or a new client portal going live, rather than waiting for the anniversary.

Neither standard is satisfied by testing alone, but testing provides the evidence that your risk assessments and technical controls have been validated rather than assumed.

Annually is the common baseline, and it is what most client questionnaires and insurers ask about. Test again after significant change, such as a migration, a merger or a new client portal going live, rather than waiting for the anniversary.

No, a scan automatically identifies possible weaknesses, while a penetration test confirms which of them are genuinely exploitable and how far an attacker could get, which is the part that informs your decisions.

They are separate lists aimed at different targets. The standard OWASP Top 10 covers web application security risks, while the OWASP API Security Top 10 and OWASP Mobile Top 10 focus on API-specific and mobile-specific risks. If you run APIs or mobile apps, they need their own testing alongside your web application testing.

No, the OWASP Top 10 is an awareness document, not a law or a certification you can pass. It does carry weight in compliance though, because standards such as PCI DSS reference OWASP Top 10 coverage as accepted evidence of secure development, so working to the list helps you meet requirements across several frameworks.

OWASP updates the Top 10 roughly every three to four years. That cadence gives development and security teams a stable baseline to work against between editions rather than a target that keeps moving. The 2025 edition followed the 2021 list, so the next update is likely later this decade.

The latest version is the OWASP Top 10:2025, released in 2025 and announced at the OWASP Global AppSec conference in Washington DC. It is the eighth edition and the first update since the 2021 list, adding two new categories and reordering several others. The full 2025 list is set out above.

It depends on the size and complexity of your application and the type of test you need. The most accurate way to get a figure is a short scoping call where we review your app and provide a fixed quote. Book a call to get started.

LLM pentests should ideally be carried out as often as possible or after significant updates to your model or training data; however, this isn’t always feasible, so we recommend testing at least annually.

LLM penetration testing involves simulating attacks on your large language models to identify and remediate cybersecurity vulnerabilities.

The purpose of penetration testing is not to break anything, so minimal disruption should be expected. If necessary, we can work with you to schedule testing during low-usage periods.

Mobile application pentests should ideally be carried out as often as possible or after significant updates or changes to the app; however, this isn’t always feasible, so we recommend testing at least annually.

Mobile app penetration testing involves simulation cyberattacks on your mobile application to identify and remediate cybersecurity vulnerabilities before they can be exploited by real attackers.

Red team engagements can vary from a few weeks to several months, depending on the scope and complexity. Purple team exercises are typically shorter, focusing on intensive collaboration and knowledge transfer to remediate vulnerabilities.

If you want to assess how your organisation would fare against a real-world attack, then red teaming. If you want attackers and defenders to collaborate to identify vulnerabilities and improve overall security effectiveness, then purple teaming.

Red and purple teaming exercises should be carried out annually or after significant changes to your network or security infrastructure.

No. Testing is scoped and scheduled with you in advance, and we can run it against a staging environment if you prefer. We agree the approach before any work begins, so there are no surprises for your users or your uptime.

Once a year is the baseline most standards expect. You should also test after any major change to the application, such as a new payment flow, an authentication update, or a significant release, since each can introduce new vulnerabilities. Check out our guide to annual pentests for more information.

The purpose of penetration testing is not to break anything, so minimal disruption should be expected. If necessary, we can work with you to schedule testing during low-usage periods.

To learn more about network penetration testing, click the link below.

Network penetration tests should ideally be carried out as often as possible or after significant updates or changes to the internal or external infrastructure; however, this isn’t always feasible, so we recommend testing at least annually.

Network penetration testing involves simulating cyberattackers on your internal and external network infrastructure to identify and remediate vulnerabilities.

The purpose of penetration testing is not to break anything, so minimal disruption should be expected. If necessary, we can work with you to schedule testing during low-usage periods.