Most firms test security annually—configuration drift and missed gaps demand continuous testing to stay resilient.