Penetration testing cadence is an important part of cybersecurity because Indian businesses need to identify vulnerabilities as their applications, cloud environments and vendor integrations change.
And when you ask a CISO how often their organization tests its controls, the most common response is, “Once a year – right before our auditor arrives.” That’s candid, but it’s the wrong answer. You don’t set the attack calendar, and attacks don’t respect your compliance calendar. Your code, your cloud configurations, and your vendor integrations change every week, so a clean bill of health in March is stale in May.
How to Build an Effective Penetration Testing Cadence.
In India, the authorities have made testing an everyday activity, and the rhythm changes according to who you are.
The SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) stipulates the requirement of almost annual testing for most of the SEBI registered entities. And for knowledgeable stock brokers, CSCRF stipulates a six-month rolling program, with a report after the IT Committee approval with an auditor empanelled by CERT-In.
Banks, NBFCs and payment operators: The ‘at least annual’ benchmark is usually specified by the RBI; most banks, on their part, combine half-yearly testing with their vendor agreements.
Frequency of testing: PCI DSS requires testing annually and after any significant change.
Everyone else: CERT-In says to report an incident within six hours. It is hard to do that if you haven’t done a drill to find out a weakness. The Digital Personal Data Protection Act, 2023 also says you should have “reasonable security safeguards” and you can quite easily show you do if you have a test record of them.
A cadence that truly works
Compliance is the baseline, not the destination. And this is the rhythm into which many experienced teams settle:
Always being scanned. Automated vulnerability scans run weekly, or even with every release, to keep costs down.
Quarterly targeted test. Conduct a manual penetration test on your most valuable assets – your customer-facing apps and APIs, and anything else that handles payment or customer data.
Half-yearly FMT. Covering the network, cloud, mobile apps and third-party integrations. For most regulated firms, this will be your stated audit report.
Event-driven testing. After a major release, migration to a different cloud provider, acquisition, or major incident. SEBI clearly mandates testing new critical systems before go-live.
The part most reports miss: retesting.
That’s a hole in one. Require a pre and post-action report – to prove the hole was actually fixed Budget for a re-test every time in fact, an open finding is more damaging than not finding it at all – because it’s an open case.
Making it human
Don’t test like an ambush if you can help it. You’re better all in sync about what’s happening before kicking off. Track and Report as lessons, not snipe. Our grateful engineer with a ‘codeception’ fixed the fatal two-day bug. Safer staff report more bugs, and speed is your real security metrics.
The bottom line
If you’ve only tested annually, on paper you’re safe; but in fact, you’re exposed. An Indian company with practical to the core thinking tests continuously, plunges in every quarter or two, then tests out again whenever something major changes. Think of each report as a pointer to your next investment, not as an ink stamp for your folder.
Note: requirements vary between sectors, are different for the size and form of your firm and are liable to change regularly. Always check your regulator’s latest circulars before choosing your timetable.
Alongside regular security testing, businesses should establish a clear DPDP breach notification process to respond effectively when personal data incidents occur.
Sources:
- SEBI CSCRF: key clarifications for regulated entities (Conventus Law)
- MCX clarifies revised VAPT submission timelines under SEBI CSCRF (TeamLease RegTech)
- SEBI incident reporting and VAPT mandate (BankInfoSecurity)
- VAPT requirements across RBI, SEBI, IRDAI and PCI DSS (CyberSigma)
- PCI Security Standards Council: PCI DSS
AI Detection
Proof reading
Plagiarized
