Most Houston businesses should run a penetration test once every 12 months and again after a major change, such as a new office network, cloud migration, or acquisition. Annual is the floor most rules set.
Where a rule names a number, it names 12 months, and a few ask for more. The rest of the answer depends on how fast your network changes. This guide covers the schedule we’d set for a Houston firm of 20 to 200 people, and why. For what a test covers and how we run one, see our page on penetration testing in Houston.
Test once a year at a minimum, and test again within a few weeks of any change that alters who can reach your systems. Between tests, scan at least every 6 months, which is the FTC Safeguards Rule’s own interval. CISA added 181 known exploited flaws to its catalog in the last 6 months, so a test that’s a year old describes a network that no longer exists.
How often should a Houston business run a penetration test?
A penetration test is a paid, scoped attempt by a qualified tester to break into your systems the way an attacker would, followed by a written report. It gives you a snapshot, so the real question is how long that snapshot stays accurate. The table sets the cadence we use for the situations we see most.
| Your situation | How often to test | Where that comes from |
|---|---|---|
| No rule or contract requires a test | Once every 12 months, plus after major changes | Our recommendation, built on the rules below |
| Non-bank financial firm such as a CPA, mortgage broker, or auto dealer | Annually, with vulnerability scans at least every 6 months | FTC Safeguards Rule, 16 CFR 314.4(d)(2) |
| You store, process, or transmit card data | Every 12 months and after significant changes | PCI DSS v4.0.1, Requirement 11.4 |
| Clinic or other HIPAA covered entity | No fixed rule today, and 12 months is where we’d plan | HIPAA Security Rule proposal of January 2025, still not final |
| You ship custom software or run a customer portal | Annually, plus a focused test of each major release | Our recommendation |
| You’ve just had an incident or an acquisition | As soon as the cleanup or the merge is done | Our recommendation |
One detail in the FTC rule gets missed. It requires annual testing of the systems that your own risk assessment flags that year, which means the scope can change from one year to the next. You don’t have to test every system every time. You do have to be able to explain why you picked the ones you did, per the wording of 16 CFR 314.4.
The rule also gives a way out. A firm with effective continuous monitoring that detects changes on an ongoing basis can skip the annual test, and firms with records on fewer than 5,000 consumers fall outside that clause under section 314.6. Treat that as our plain-language reading and not legal advice, and let your counsel confirm how it applies to you.
Card rules work differently. PCI DSS asks for both internal and external testing every 12 months and after any significant infrastructure or application change, and service providers get an extra segmentation test every 6 months. The standards are published through the PCI Security Standards Council, and your acquiring bank decides what proof it wants to see.
What counts as a major change that should trigger an extra test?
A change counts when it alters who or what can reach your data from outside, or from inside with stolen credentials. Most Houston firms hit at least one of these in a normal year, and each one is a reason to book a test without waiting for the annual date.
- Moving offices, or opening a second one, which brings a new network, new Wi-Fi, and new firewall rules.
- Migrating servers or files to Azure, Microsoft 365, or another cloud platform.
- Buying or merging with another company and joining its network to yours.
- Launching a customer portal, an online payment page, or any new web application.
- Replacing a firewall, VPN, or remote access tool.
- Recovering from a security incident, once the cleanup is done and before you declare it closed.
Houston adds a seventh. Hurricane season runs June 1 through November 30, and a lot of firms rebuild their failover, backup, and remote access setups just before it starts. Those rebuilds open ports and accounts that were never part of last year’s test. If yours changed this spring, a late-summer test is cheaper than learning about the gap from an attacker.
Why isn’t one test a year enough on its own?
Because attackers don’t follow your calendar. CISA’s Known Exploited Vulnerabilities catalog, the government’s list of flaws that criminals are using right now, held 1,768 entries on November 4, 2026. By our count of its date-added field, 313 of them were added in the last 12 months, 181 in the last 6 months, and 29 of the 313 are tied to known ransomware campaigns. That’s roughly 26 new entries a month.
Do the math on a test finished 6 months ago. It can’t have looked for 181 flaws that hadn’t been listed when the tester packed up. It’s still useful, since it shows how your people, passwords, and network layout hold up, but it says nothing about the newest holes in your firewall or your Microsoft servers. Microsoft alone accounts for 42 of the 313 entries, with Cisco at 21 and Fortinet at 12, and plenty of Houston offices run one of those 3.
In our view, a penetration test is a poor way to keep up with that pace. Testing every quarter just to chase new flaws would cost about $40,000 a year at the rates in our cost guide, and most of that money would go to rediscovering what a scan already reports. Scanning checks known flaws on a schedule for a fraction of a tester-day, and the test then covers the part a scanner can’t, which is what a person could do with the gaps that remain. Our comparison of penetration testing vs vulnerability scanning covers the split in more detail. For which one to buy first in Houston, see our penetration test vs vulnerability scan guide for Houston firms.
The FTC rule follows the same logic. Its text asks for vulnerability assessments at least every 6 months and whenever a material change affects your operations, so a workable rhythm is 1 test a year, a scan at least every 6 months, and a quick scan after each change in the list above.
What does each testing schedule cost?
We priced 3 schedules using the median federal ceiling rate of $155.78 an hour, or $1,246 per tester-day, drawn from GSA’s public rate data and explained in what a penetration test costs in Houston. Day counts are our own planning assumptions for this guide, which makes the totals budget figures rather than quotes.
| Schedule | Tester-days a year | Rough yearly cost | Best for |
|---|---|---|---|
| Annual external plus internal test | 8 | About $10,000 | Most firms of 20 to 200 people with a steady network |
| Annual test plus a 3-day external test mid-year | 11 | About $13,700 | Firms that changed their network or took on a new service mid-year |
| Quarterly external plus internal tests | 32 | About $40,000 | Rarely worth it, even for software teams shipping weekly |
Our advice for most firms is the first row, with an extra test when something big changes and scans in between. That covers the 12-month floor in every rule above and leaves money for fixing what the test finds, and fixing is where the risk actually drops. A report that nobody acts on doesn’t lower your risk at all.
How do you set your own pen test schedule?
You can do this in an afternoon with the people who run your IT, and it works whether Uprite does your testing, someone else does, or you haven’t started yet.
- Write down the rules and contracts you answer to, and the testing interval each one names.
- Find the date and the scope of your last test. If nobody can, treat it as never done.
- List every change since that date from the triggers above.
- Put vulnerability scans on the calendar at least every 6 months, and monthly if you can.
- Schedule the next test about 10 months after the last one, so a slip doesn’t push you past 12.
- Book a retest after fixes, so each finding gets closed and proven closed.
Step 5 gets skipped most often. Testers get booked up and a month-end close can push a date back by weeks, so starting at month 10 leaves room, and we schedule around payroll weeks and storm watches for the same reason.
If you aren’t sure where your last test left you, our network assessment is no charge and produces a device inventory plus a ranked findings list to start from. Monthly rates for scanning and the rest of our security stack are on the public pricing page, and our guide to managed security services in Houston shows how scanning, monitoring, and testing fit together.
A breach costs a lot more than a test, and Texas starts a clock of its own. When 250 or more Texans are affected, the notice to the Texas Attorney General is due within 30 days of discovery, and the state publishes those reports. If your methods for planning a test are still loose, the NIST SP 800-115 guide explains how a test is planned, run, and reported, and it leaves the calendar to your own risk assessment.
What Houston owners ask about pen test frequency
How often should you pen test in Houston?
Once every 12 months at minimum, and again after any major change to your network, cloud setup, or applications. That matches what PCI DSS and the FTC Safeguards Rule ask for. Add vulnerability scans at least every 6 months between tests.
Is an annual penetration test enough?
It satisfies most written rules, but it isn’t enough alone. CISA added 313 known exploited flaws to its catalog in the 12 months ending November 4, 2026, so a year-old test misses a lot. Pair the annual test with regular scans and an extra test after big changes.
How often does PCI DSS require penetration testing?
PCI DSS v4.0.1 requires internal and external testing at least once every 12 months and after significant changes to your environment. Service providers also test their segmentation controls every 6 months. Ask your acquiring bank which proof it wants.
How often does the FTC Safeguards Rule require a pen test?
Annually, covering the systems your risk assessment flags that year, unless you run effective continuous monitoring. The rule also requires vulnerability assessments at least every 6 months and after material changes. Firms with customer data on fewer than 5,000 consumers are exempt from that clause, though counsel should confirm it for you.
Does HIPAA require an annual penetration test?
Not yet. A January 2025 proposal would require one at least every 12 months, and as of November 2026 it has not been finalized. Since the final wording could still change, a Houston clinic is better off treating an annual test as good practice than budgeting around the proposal.
Do we need to test again after every software update?
No, routine patches are handled by scanning, and a full test after every update would cost far more than it returns. A new office network, a cloud migration, a customer portal, or a new firewall changes your attack surface enough to justify one, and a focused test of a single major release is a reasonable middle path.
Does Uprite perform the test, and what schedule do you recommend?
Yes, Uprite performs penetration tests itself, quoted by scope. For most firms we recommend 1 full test a year, scans at least every 6 months, and an extra test after major changes. If we also manage your network, ask how we keep the testing independent of the team running your IT.
Send us the date of your last test and a list of what’s changed since. We’ll tell you in writing whether you’re due, which systems to put in scope, and what to scan and fix before the tester arrives. We usually reply within 5 minutes.
Talk to a Security ExpertPrefer email or a phone call? Reach the team through our contact page.
