How often do you actually test your website for security vulnerabilities?

I’m curious how people here approach website security.

Do you regularly run vulnerability scans or penetration tests, or do you mostly rely on keeping your CMS, plugins, and dependencies updated?

I feel like a lot of website owners only think about security after something goes wrong. What’s your approach?