Which of the following is the MOST significant indicator of the need to perform a penetration test?

High-risk audit findings indicate control deficiencies but are typically based on reviews or scans, whereas security incidents represent actual successful compromises, making them a more urgent trigger for a penetration test.

An increase in the number of security incidents is the most significant indicator because it directly demonstrates that existing security controls are insufficient or that new vulnerabilities are being actively exploited, making a penetration test critical to identify the root causes and validate the effectiveness of the security posture against real-world attack techniques.

Increased IT personnel turnover can introduce security risks due to loss of institutional knowledge or inconsistent policy application, but it is an indirect factor and not as immediate a signal for a penetration test as actual breaches.

An increase in infrastructure changes introduces new potential vulnerabilities that warrant security reviews or scanning, but security incidents are a stronger and more immediate signal that the existing attack surface is being compromised.