Application Penetration Testing is conducted at least on an annual basis or after any significant change. The secure coding must cover OWASP top 10.
The scanning software must be updated prior to conduct any scanning task
(obsolete scanning software is not allowed)