Most companies buy penetration testing twice a year. Two weeks each time, if the scope is generous. That is 28 days of coverage out of 365, and the other 337 are the ones an attacker gets to choose from.
The arithmetic nobody runs
A yearly programme is usually described in engagements, which makes it sound continuous. Described in days it does not. Two two-week tests is 7.7% of the year. If you assume an attacker needs a single unobserved window, you have handed them nine out of every ten days.
Two standard engagements, two weeks each
That number would be defensible if the thing being tested held still. It does not. A mid sized estate ships infrastructure changes weekly: a new subdomain, a forgotten staging host, an SSO integration, a third party that suddenly holds a token. Every one of those is surface that appeared after the last test and will be gone or changed before the next one.
Point in time versus continuous
A report is a photograph. It is accurate about the moment it was taken and says nothing about the moment you read it. The gap between those two moments is where the entire risk lives, and it is a gap the report format cannot describe, because a PDF has no way to say this was true in March.
- A finding fixed in April is not re-tested until October.
- A host that appeared in May is not in either report.
- A technique published in June is in neither methodology.
The second clock
There is a second clock running, and it is faster. Attack technique moves daily: a new bypass, a new chain, a new way to abuse a integration that was safe last week. A methodology written for an engagement is fixed at the moment it is written, which means it is already behind on the first day of testing.
You are not defending against the techniques that existed when your test was scoped. You are defending against the ones published since.
This is the part that a bigger budget does not solve. Four engagements a year is 56 days, still under a sixth of the calendar, and every one of them still uses a methodology frozen at kickoff. The problem is not how often you test. It is that testing is an event at all.