When is a pentest needed for a company's IT infrastructure?

If a company’s customer portal, remote access solution, or cloud services environment works without visible disruptions, that still does not mean it is secure. Attackers do not look only for large international companies. They look for an accessible entry point: an unpatched VPN device, excessive user privileges, a publicly accessible testing environment, or a flaw in a web application. That is why the question when do you need a pentest is not just technical. It is a question of business continuity, data protection, and management’s ability to make informed decisions.

A penetration test, or pentest, is a controlled attempt to gain access to a company’s systems using methods that an attacker could use in practice. Its goal is not simply to find vulnerabilities. The most valuable result is understanding whether a particular weakness really allows access to data, account takeover, service disruption, or movement further within the company’s infrastructure.

A pentest is not the same as vulnerability scanning

Automated vulnerability scanning is a useful security hygiene tool. It helps quickly identify missing updates, outdated software versions, misconfigurations, and known security weaknesses. However, a scanner usually cannot fully assess business logic, access chains, or how several small errors together can lead to a serious incident.

During a pentest, a specialist checks whether the identified issue can actually be exploited, how far it is possible to get, and what the impact on the business would be. For example, one incorrectly configured access may seem insignificant on its own. But together with weak password policy and insufficient segmentation, it can provide access to financial data or backup systems.

Scanning is a routine control. A pentest is a targeted security assessment with context. In mature security management, both measures complement each other rather than replace one another.

When do you need a pentest: situations where delaying creates risk

A pentest does not need to be performed only after an incident. On the contrary - after an incident, a company is often already in response mode, with possible operational, reputational, and contractual losses. It is more practical to plan the test at times when the technological environment or the company’s risk profile changes.

Before launching a new system or customer portal

If a company is introducing an e-commerce environment, a customer self-service portal, a mobile app, API integration, or an externally accessible business system, a pentest should be performed before going live. In this situation it is especially important to check authentication, access rights, data isolation between customers, input handling, and administrative functions.

Errors at this stage are usually cheaper to fix than after launch. In addition, an early test allows the technical team to address priority risks instead of urgently reacting to an external report or a data breach.

After major infrastructure changes

Migration to Microsoft 365, Azure, AWS, or another cloud platform is not just a technology replacement. It changes identity management, the access model, data storage location, and the distribution of responsibilities. Risk also increases after office network consolidation, replacement of a VPN solution, introduction of remote work, or integration of systems within a corporate group.

In such projects, existing access rights are often carried over, temporary exceptions are created, or administrative rights that are no longer needed are left in place. A pentest helps verify whether the new environment is not only functional, but also protected against realistic attack scenarios.

Before an audit, partnership, or transaction

For companies in regulated industries, payment processors, and suppliers with heightened customer requirements, a pentest may be a contractual or compliance requirement. But even where there is no formal requirement, a security assessment is justified before working with a major client, an insurer’s review, an investment raise, or an acquisition process.

During IT infrastructure due diligence, reviewing documents and policies is not enough. It is necessary to assess whether the declared controls work in practice. A pentest can reveal risks that affect the transaction value, the integration plan, or the budget needed for the first 100 days of improvements.

When the attack surface has grown

The attack surface increases every time a company adds a new externally accessible system, branch office, remote worker group, supplier integration, or administrative tool. Companies whose IT environment has grown gradually and whose solutions were built across multiple projects with different vendors should be especially careful.

Signs that an assessment is needed include an incomplete asset inventory, unclear responsibility for access rights, accounts of former employees, firewall changes that are reviewed infrequently, or an unclear picture of what exactly is accessible from the internet. Here, a pentest simultaneously provides a security assessment and a reality check on infrastructure management.

What management should receive from a quality pentest

A good test does not produce only a long technical report with a list of critical vulnerabilities. Management needs a clear picture of the possible business impact: which data or processes would be at risk, whether an attacker could stop operations, how quickly the risk can be reduced, and what investments are needed.

The report should separate critical issues from improvements that can be planned over a longer term. For example, an internet-facing administrative interface without multifactor authentication requires immediate action. Meanwhile, certain configuration or process shortcomings can be included in a planned modernization program.

A valuable pentest also includes retesting after fixes are implemented. Otherwise, the company knows what should be done, but cannot confidently confirm that the priority risk has truly been eliminated.

How to choose the scope of a pentest

There is no one pentest format that fits everyone. The scope should be determined by the company’s risks and business-critical systems. An external test focuses on what an attacker can reach from the internet. An internal test shows what a user or attacker who has already obtained initial network access could do. Meanwhile, a web application and API test examines specific digital services.

In some cases, a test with limited information about the environment is needed, which more accurately imitates an external attacker. At other times, an access test with assigned user accounts is more useful to check privilege escalation and segmentation. The choice is determined not by technical fashion, but by the question: what scenario would cause the greatest loss to the company?

It is important to agree in advance on the boundaries of the test, the permitted methods, the testing time, contact persons, and the incident escalation procedure. A pentest must not create uncontrolled risk for the production environment. Professionally performed work is always based on an agreed methodology and documented authorization.

How often should a pentest be performed

For most small and medium-sized businesses, a sensible starting point is a pentest once a year, in addition to performing one before major changes. However, the frequency depends on system criticality, the type of data processed, the number of external integrations, and the pace of change.

If a company regularly develops a public application or works with sensitive customer data, security assessments should be integrated into development and change management processes more often. If the environment is stable and there are few externally accessible services, an annual test together with regular vulnerability management may be a proportionate solution.

The most important thing is not to assume that last year’s positive result guarantees security today. Software, suppliers, employees, access, and attacker techniques change. A pentest is a management tool that allows you to verify whether security assumptions match the actual situation.

A company does not need to wait for a visible incident to start this conversation. If it is not clear which services are accessible from the internet, where critical data is stored, and whether access rights are managed according to risk, the first step is a structured assessment of the IT and security situation. This helps determine the pentest scope, priorities, and action plan that strengthens not only protection, but also the company’s ability to continue operating during disruptions.