PCI DSS Penetration Testing

Yes, if your validation includes Requirement 11.4. ASV scans satisfy the external vulnerability scanning in Requirement 11.3.2 and are automated. Requirement 11.4 is a separate control calling for manual internal and external penetration testing that tries to exploit weaknesses, at least every 12 months and after significant changes. Most assessors will ask for evidence of both, with dates, scope and remediation.

It depends on how you accept cards. SAQ D, for merchants and service providers, includes the full set of 11.4 requirements. Some shorter SAQs include only parts of it, and some, for fully outsourced payment pages, include none. Check the current SAQ for your channel, or ask your acquirer or QSA. The scoping call can help you confirm what applies before you buy testing you don't need.

PCI DSS leaves the definition to your organization, but typical examples are new internet-facing systems, changes to the CDE network, new payment applications or major version upgrades, a change of hosting or cloud provider, and changes to firewalls or segmentation controls. Document your definition. When a change qualifies, a targeted test of the affected systems is usually enough, rather than repeating the full annual engagement.

Every six months, under Requirement 11.4.6, and after any change to segmentation controls or methods. Merchants test segmentation at least once every 12 months under 11.4.5. Service providers can combine one segmentation test with the annual internal and external test and run a lighter segmentation-only check at the six-month point, which keeps the second test smaller and more focused.

It starts with a free scoping call to agree targets, test windows and rules of engagement, and you receive a fixed price in writing. Testing is manual and non-destructive, and critical findings are reported immediately. The report includes an executive summary, CVSS-scored findings with evidence and remediation steps, and a methodology section for auditors. Once you've fixed the findings, a free retest confirms what's closed.

Every test is performed by a CREST-certified tester who also holds CREST CPSA, OffSec OSCP, OSWA, OSWP and OSAI, plus the HTB Certified Offensive AI Expert (COAE). All are practical, exam-based credentials. The same tester handles your engagement from scoping to retest, and every engagement is fixed-price with a free retest included.