PCI DSS Pen Tests.
QSA-Ready. Zero Delays.
Penetration testing reports that satisfy QSA acceptance requirements, mapped to PCI DSS v4.0 Requirements 11.4, 6.2, and 2.2. Annual external and internal testing, network segmentation validation, and CDE penetration tests in 5 days.
How Our PCI DSS Pentesting Works
Four simple steps from initial scoping to QSA-ready report delivery.
Scoping & CDE Inventory
Tell us about all systems in your Cardholder Data Environment (CDE): payment processing networks, customer databases, web applications, and cardholder infrastructure. We identify all attack surfaces, scope testing, and deliver a quote within 24 hours.
External & Internal Testing
Manual penetration testing from outside and inside your network to test firewall rules, access controls, network segmentation, and CDE isolation. Requirement 11.4.1 (external) and 11.4.2 (internal) testing conducted by experienced payment security assessors.
QSA-Mapped Report
Detailed report delivered within 5 business days. Every finding mapped to PCI DSS Requirement 11.4, v4.0 requirements, and applicable security standards (Req 6.2, 2.2) with cardholder data breach risk assessment, evidence, and remediation guidance ready for QSA review.
Remediation & Retesting
Fix findings on your timeline. When ready, we retest for free and issue updated documentation confirming your CDE meets PCI DSS Requirement 11.4 controls, exactly what QSAs require for annual certification and compliance filing.
Need PCI DSS Penetration Testing for Your Next QSA Assessment?
We can scope your engagement in 24 hours and start testing within the week. QSA-mapped reports ready in 5 business days.
Get a Pentest QuoteWhat We Test for PCI DSS
Our CDE penetration testing covers every system and every threat vector relevant to PCI DSS Requirement 11.4 compliance.
Payment Processing Applications
Payment gateways, checkout flows, point-of-sale systems, and payment card form handlers. Testing covers cardholder data exposure, PAN (Primary Account Number) encryption, PCI-relevant OWASP Top 10 risks, and session management flaws affecting payment security.
APIs & Integration Points
Payment processor integrations, banking APIs, card networks, merchant service provider connections, and third-party payment app APIs. Authorization bypass, data exfiltration, business logic vulnerabilities, and unsecured token transmission affecting cardholder data.
Network & CDE Segmentation
External network defenses, internal network assessments, CDE isolation verification, access control lists, firewall rules, and network segmentation testing. We verify that cardholder data is properly isolated from non-critical systems per Requirement 11.4.4.
Cloud & Service Provider Systems
Cloud payment infrastructure (AWS, Azure, GCP), encrypted storage, backup systems, disaster recovery, service provider connections, and third-party merchant service provider security. SAQ A-EP and SAQ D compliance for payment brands.
Reports Mapped to PCI DSS Requirements
PCI DSS Requirement 11.4 mandates annual external and internal penetration testing for all merchants and service providers storing, processing, or transmitting cardholder data. Your QSA (Qualified Security Assessor) must accept your penetration testing report as evidence of compliance. Annual retesting is also required after any significant network changes per Requirement 11.4.3.
Our reports explicitly map every finding to the relevant PCI DSS requirements, with cardholder data breach risk assessment and remediation guidance for your payment security team and QSA review.
PCI DSS Requirements Covered:
- Req 11.4.1, External penetration testing at least annually
- Req 11.4.2, Internal penetration testing at least annually
- Req 11.4.3, Exploitable vulnerabilities found are corrected and retested
- Req 11.4.4, Network segmentation testing to verify CDE isolation
- Req 6.2, Secure development and application security testing (v4.0)
- Req 2.2, System hardening and default security parameters
Sample PCI DSS Report Structure
Cardholder data breach risk assessment for leadership and payment security teams
Cardholder Data Environment systems, data flows, network diagrams, service providers in scope
Technical approach aligned with PCI DSS Requirement 11.4 and QSA acceptance criteria
Each finding mapped to Requirement 11.4, breach risk rating, evidence, and PAN exposure assessment
Step-by-step remediation with notes on meeting Requirement 11.4.3 retesting requirements
Formal report structure accepted by QSAs with v4.0 requirement mapping for 2025 compliance
PCI DSS Pentesting Pricing
Transparent pricing with no hidden costs. Complimentary retesting included with every engagement. QSA-ready reports for all tiers.
AI-Assisted
Starting price
- Automated + AI-powered CDE testing
- External + internal network coverage
- Requirement 11.4 mapped findings
- 5-day report delivery
- Free retesting after remediation
Most Popular
Manual Assessment
Starting price
- Full-scope CDE penetration testing
- Payment security-experienced testers
- Complete Requirement 11.4 mapping
- Cardholder data breach risk assessment
- 5-day report delivery
- Free retesting
- QSA compliance guidance call
Enterprise
Recurring & multi-location
- Everything in Manual Assessment
- Multiple merchant locations & service providers
- Dedicated payment security team
- Annual or bi-annual retesting
- Priority scheduling & expedited delivery
- SAQ and compliance program integration
- Direct QSA coordination support
What Our Payment Clients Say
"First pentesting report we've had that directly mapped to PCI DSS Requirement 11.4. Our QSA accepted it immediately without follow-up questions on compliance."
E-Commerce Retailer
"They understood our payment processing architecture and found actual cardholder data exposure risks that generic pentesting vendors completely missed during testing."
Payment Processor
"Delivered our CDE assessment in 5 days with Requirement 11.4.4 network segmentation testing proving our payment systems are properly isolated from general networks."
Merchant Services Provider
"We handle cardholder data for hundreds of merchants as a third-party processor. This report gave us QSA-ready evidence that we meet all Requirement 11.4 testing obligations."
Payment Service Provider
PCI DSS Pentesting FAQ
Yes. PCI DSS Requirement 11.4 mandates annual external and internal penetration testing for all organizations that store, process, or transmit cardholder data. Penetration testing must also be conducted immediately after any significant network infrastructure changes. Testing results must be reviewed and formally accepted by a QSA (Qualified Security Assessor).
Requirement 11.4.1 (external) simulates attacks from outside your network to test perimeter security, firewall rules, and externally-facing services. Requirement 11.4.2 (internal) simulates attacks by insiders or compromised systems to test network segmentation, access controls, lateral movement within the CDE, and isolation from non-critical systems. Both are required annually.
Requirement 11.4 requires annual external and internal penetration testing for all SAQ levels. Additionally, organizations must conduct penetration testing immediately after significant changes to network infrastructure, payment applications, or systems that could impact cardholder data security per Requirement 11.4.3. We can schedule annual, bi-annual, or triggered assessments based on your change management schedule.
Requirement 11.4.4 mandates network segmentation testing to verify that the Cardholder Data Environment (CDE) is properly isolated from the rest of your network. Inadequate CDE segmentation is the most commonly reported PCI finding. Proper testing confirms that even if non-CDE systems (like guest WiFi or corporate networks) are compromised, attackers cannot access cardholder data. QSAs specifically require evidence of successful segmentation testing.
PCI DSS v4.0 (effective March 2025) adds new requirements for secure development testing (Requirement 6.2), strengthens system hardening standards (Requirement 2.2), and requires applicant testing after significant system changes. Most organizations transition to v4.0 by March 31, 2025. Our reports explicitly map findings to both v3.2.1 and v4.0 requirements so your QSA can accept them for either compliance version.
ASV (Approved Scanning Vendor) quarterly external vulnerability scanning is automated scanning of your external IP ranges and is required by PCI DSS, but it is limited in scope. Penetration testing (Requirement 11.4) is manual, in-depth testing for exploitable vulnerabilities, business logic flaws, access control bypasses, and network segmentation failures. Both are required, ASV scanning alone does not satisfy Requirement 11.4 and QSAs will require evidence of actual penetration testing.