Security Tip: A Yearly Pentest Is One Day of Evidence, Not a Year of Cover

Most teams test their website once a year, get a report, and file it away as a year of assurance. That report only describes the system on test day. The next day your team ships code, changes a setting, or gives someone new access — and a new flaw can be published for software you already run. After any of those, the report no longer describes the system you actually have.

That is why security teams are moving from a single annual test to testing after each change. The loop is five stages, repeated every time something material changes: scope what matters, discover what is exposed, prioritise by exploitability and business impact — not by score alone — validate that an attacker can really reach it, then fix it and retest to prove it is closed. A finding that goes into a ticket and is never retested is not finished. It is just another test.

The speed of the other side is the reason the loop has to repeat. Summaries of Gartner's continuous offensive security work put the average time from a disclosure to a weaponised exploit at under 10 hours in 2026, down from roughly 53 days two years earlier, and new CVE publications in 2025 at 49,183 — about 135 a day. A scanner alone cannot always show whether an attacker can reach a weakness, whether a control blocks the path, or whether two lower-severity weaknesses together give full access. That has to be tested on the path itself, with evidence.

So do not ask when your last pentest was. Ask what has changed since it, and whether anyone tested after the change. If the answer is no, that is the gap to close first — before the next annual report, not after it.

A free scan at https://vulnerabilitytools.com/ shows you what your site is exposed to right now — then test the paths that matter, fix what is reachable, and retest to prove it stayed fixed.