Ecommerce Security Audit Frequency

[AleksShamles]

Our online store changes frequently because we regularly install updates, add extensions, modify integrations, and introduce new functionality. Because the environment is constantly evolving, I am wondering whether an annual security review is sufficient or whether more frequent testing would be appropriate. Are there practical guidelines for different types of ecommerce businesses, and how often should an ecommerce website have a security audit to maintain a reasonable security posture?