Penetration testing is typically conducted after integration testing is complete and the system is fully functional, but before user acceptance testing (UAT) or final release. Testing earlier (like unit testing) is premature, and doing it during system testing is less comprehensive.