Annual testing is a compliance floor, not a security strategy. A report is accurate for the commit it tested. If you deploy weekly, most of your application by the end of the year was never in scope of anything.
The practical model for a fast-moving team is layered: automated scanning and SAST on every merge, a focused review of any feature that touches authentication, authorisation, payments or file handling, and one full manual test a year with a retest included.
Regulatory drivers change the cadence. PCI DSS requires testing at least annually and after significant change. SOC 2 auditors expect evidence of a recent test. RBI and IRDAI guidance for regulated Indian entities is stricter and prescribes specific auditor categories — check the circular that applies to you rather than the general advice.
In short
- Minimum: once a year, plus after significant change.
- Trigger a test on: new auth, new payments, new public API, post-incident.
- Continuous deployment needs continuous scanning between annual tests.
- A retest after fixes is part of the test, not an optional extra.