Penetration testing that meets PCI DSS Requirement 11.4 and supports your HIPAA Security Rule risk analysis. You get a fixed price, testing by a CREST CRT and OSCP certified tester, an auditor-ready report and a free retest after you fix the findings.
Annual external and internal penetration testing of your cardholder data environment (CDE), plus testing after significant changes, as PCI DSS v4.0 Requirement 11.4 requires.
Proof that segmentation controls isolate the CDE from out-of-scope networks, required at least every 12 months (every 6 months for service providers) under PCI DSS 11.4.5 and 11.4.6.
Technical testing of the systems that store, process or transmit ePHI, supporting your HIPAA risk analysis and periodic technical evaluation of your safeguards.
Payment pages, patient portals, APIs, and internal and external networks, tested by hand against OWASP and industry-standard methodologies, not just scanned.
An executive summary, CVSS-scored findings with proof of exploitation, clear remediation steps and a methodology section your QSA or HIPAA auditor can rely on.
After you fix the findings, we retest and issue an updated report confirming the fixes, giving your auditor the evidence needed to close them out.
Questions about compliance testing? Email info@zerodaysecurity.net or book a free scoping call.
External and internal penetration testing at least once every 12 months and after significant changes, following a documented methodology that covers the network and application layers. Exploitable findings must be fixed and retested, and segmentation controls must be tested if you use them to reduce scope.
The current HIPAA Security Rule does not name it, but it requires a risk analysis and periodic technical evaluations of your safeguards, and a penetration test is the most direct evidence of both. HHS has proposed making annual penetration testing an explicit requirement.
Often, yes. If the same applications and networks are in scope, one test can produce a report with findings mapped to each framework, which saves time and money compared with separate engagements. We confirm what each auditor needs during scoping.
External testing attacks what is exposed to the internet, such as websites, VPNs, email and remote access. Internal testing assumes an attacker is already inside, for example after phishing, and shows how far they could move toward cardholder data or ePHI. PCI DSS requires both.
It depends on scope: which applications, how many user roles, and how much of your network is in scope. Most compliance programs need application and network testing, including segmentation testing. Every test is fixed-price and includes a free retest. See our Pricing page for current packages, or book a free scoping call for a written quote.
Copyright © 2026 Zero Day Security - All Rights Reserved.
CREST CRT, OSCP, OSWA, OSWP, OSAI, COAE certified