Pen testing should be conducted regularly to ensure ongoing security. It is advisable to perform pen testing at least once a year or whenever there are significant changes to your email marketing infrastructure, such as new software deployments, updates, or changes in policies.