How often do companies pentest? Statistics from two vendor surveys

Last updated 9 November 2026. Two vendor surveys give numbers for how often companies pentest. Cobalt reports 27% annual, 15% semi-annual and 30% quarterly testing in its 2025 survey. Fortra reports 43% testing a couple of times a year and 17% never testing in its 2024 survey. This page sets the figures side by side, flags how each sample is biased and explains what you can and cannot conclude.

Key figures: how often do companies pentest?#

The table lists every frequency figure we could verify in the two reports, each with its survey and year. The answer options differ, so the rows are not additive across the two surveys.

Sources: Cobalt State of Pentesting Report 2025, Figure 5; Fortra 2024 Penetration Testing Report, Figure 8. Both checked 9 November 2026.

What did Cobalt's 2025 survey find?#

Cobalt's survey found that quarterly testing was the most common answer (30%), with annual testing at 27%. The report states: "more than half of organizations conduct pentests more than twice a year." The survey asked how often the respondent's organization conducts pentests.

The sample is 450 validated responses from a double-blind survey run by Emerald Research. About 1,600 people responded to the invitation and over 70% were disqualified. Half of the respondents are security leaders and half are practitioners. Cobalt sells pentesting as a service, and the report does not say how many respondents are its customers. The respondents are security staff at firms with 500 to 9,999 employees, so small software companies are not the core of this sample.

Cobalt has published a 2026 edition of the report. We did not open the 2026 PDF, and its frequency figures are not in this table. We cite only what we read in the 2025 report.

What did Fortra's 2024 survey find?#

Fortra's 2024 report found that 43% of respondents pen test "a couple times a year" and 17% never do. Quarterly testing fell by 9 points against 2023, while the share who test a couple of times a year rose by 5 points and the share who never test rose by 3 points.

The 2023 comparison values in Fortra's Figure 8 are 38% for a couple of times a year and 14% for never. Fortra gives these as the comparison years in the figure.

Fortra's report text says "respondents representing a diverse cross-section" but we found no total number of respondents. We also found no public URL for the PDF, so the figures come from a copy we read locally. Fortra's Core Security business ran the survey, so this is a vendor survey too. Without a sample size, the percentages carry no stated margin of error.

Fortra's own advice in the same section is that there is "no magic number" for frequency. It says size, infrastructure complexity, data type and regulation all matter.

Which compliance drivers sit behind the figures?#

Compliance explains part of the pattern. In Fortra's 2024 report, PCI DSS is the most common regulation for which respondents use pen testing, at 43% (Figure 5). Cobalt's 2025 report says third-party pentest reports are the most common assurance that customers and regulators ask for, at 59% of its 450 respondents.

PCI DSS sets a test interval in its own text. Requirement 11.4 asks for internal and external penetration tests at least once every 12 months and after any significant change (see PCI DSS penetration testing requirements for the wording we checked). SOC 2 and ISO 27001 set no fixed interval, so a company under only those frameworks has no calendar rule to follow. Does SOC 2 require penetration testing? covers that case.

A survey figure for "annual" testing may therefore mix companies that test once because a standard says so and companies that test once by choice. Neither survey separates the two.

What are the limits of survey data on pentest frequency?#

Survey figures on frequency are weak evidence for three reasons. Each point below limits what you can say with them.

1. Both surveys come from vendors that sell testing, so people who already buy or run testing may be over-represented. Neither report rules this out.
2. The answer scales differ. Cobalt offers "annually", "semi-annually" and "continuously". Fortra offers "never", "1-2 times a year" and "daily". A 27% "annual" and a 43% "1 to 2 times a year" are different groups.
3. Neither survey links frequency to outcomes. A company that tests quarterly is not shown to have fewer breaches.

Use the figures to see that annual testing is common, not universal, and that a visible share of respondents never test (17% in Fortra's 2024 survey). Do not use them as a benchmark that your own interval must match. For an interval based on your own release pace and rules, use how often should you pentest.

A worked example shows why a benchmark misleads.

How do I cite pentest frequency statistics?#

Cite the survey, not a website that repeats it. Name the vendor, the report, the year, the sample and the figure, and call it a vendor survey. A safe pattern: "Cobalt, State of Pentesting Report 2025 (450 respondents, vendor survey): 30% pentest quarterly, 27% annually." For Fortra, add that the report gives no sample size.

Check the date before you reuse a number. Both surveys are from 2024 and 2025 data. Newer editions may change the figures.