Pentest Today.
compliance framework

Pass your PCI DSS assessment

PCI DSS requires internal and external penetration testing under Requirement 11.4. Pentest Today produces the external half: a penetration test report for the cardholder data environment's publicly reachable systems. The internal test, segmentation testing under 11.4.5, and the quarterly ASV scan under 11.3.2 each need a separate engagement.

What a PCI DSS review asks for

PCI DSS protects cardholder data and explicitly requires both internal and external penetration testing at least annually.

✓Annual internal and external penetration testing (Req. 11.4)
✓Quarterly vulnerability scans (Req. 11.3)
✓Segmentation testing of the cardholder data environment
✓Documented remediation of all findings
✓Network and data-flow diagrams of the CDE

What closes each requirement

ControlWhat they askEvidenceWhere it comes from
11.4 · penetration testingProof that an organizationally independent tester assessed both the external perimeter and the internal network of the cardholder data environment within the past twelve months, and again after anything that materially changed it.The penetration test report for the CDE's publicly reachable systems — each finding rated by severity and tied to the asset it was found on, a CVSS v3.1 vector and base score attached wherever scoring was done, and a documented fix on the findings that got one — plus the retest report that restates each finding as fixed or not fixed. Testing runs only against targets that resolve to a public address, so this is the external half of 11.4; the internal test has to come from a tester positioned inside the network.The pentest workflow's client-ready PDF and the retest workflow, for the externally facing part of the scope only.
11.4.5 / 11.4.6 · segmentation testingIf segmentation is what keeps part of the network out of the CDE's scope, show that the controls enforcing that separation were actually tested — not just drawn as separate on a diagram.Not produced here. Segmentation testing needs a tester positioned inside the network, sending traffic across the boundary from an out-of-scope segment and recording which control stopped it. This product's testing runs only against targets that resolve to a public address, so it has nothing to say about reachability between internal segments. Source this from a firm that performs internal testing, and have it re-run after any change to the segmentation controls.A separate internal engagement. Not this product.
11.3 · vulnerability scanningInternal vulnerability scans at least quarterly and after significant change (11.3.1), plus an external scan at least quarterly by a PCI SSC Approved Scanning Vendor (11.3.2) and again after significant change (11.3.2.1).Neither half of 11.3 is produced here. The external quarterly scan has to come from a PCI SSC Approved Scanning Vendor, which this product is not; the internal quarterly scan needs a scanner positioned inside the network, and this product's scans run only against publicly reachable targets. The scans here cover the externally reachable surface, which is evidence toward 11.4, not 11.3.Not this product. An Approved Scanning Vendor for the external scan; a scanner inside the network for the internal one.
6.3 · identifying and addressing vulnerabilitiesThat vulnerabilities are actively found and ranked by risk, and that critical and high-severity ones are patched inside a defined window rather than sitting in a backlog.The pentest and scan findings give the ranked, dated list; the Vulnerability Management Policy's remediation SLA — seven days for critical, thirty for high — gives the documented patch window a QSA checks the dates against.The pentest/scan workflow for the findings, the policy pack's Vulnerability Management Policy for the SLA.
1.2 · network security controlsA current diagram of every connection between the CDE and other networks, and of the cardholder data flows themselves — the diagram drawn for last year's assessment doesn't count once the network has changed.The generated system architecture and data-flow diagram, regenerated from the current intake rather than reused from a prior assessment — so a segment added since the last drawing actually shows up on it. The diagram and the pentest's approved-target list are separate artifacts; keeping them pointed at the same boundary is still the reviewer's job, not something the shared intake guarantees on its own.The architecture diagram generator, drawn from the intake's cloud provider, hosting setup, and vendor fields.
12.10 · incident responseA documented plan specific enough to run during an actual incident — roles, an escalation path, and a recovery process — not a policy that exists only to be shown to an assessor. For a payment environment, that plan has to cover a suspected compromise of cardholder data specifically, not just security events in general.The Incident Response Policy, read for who is named to run it and whether the process it describes reaches past detection into recovery and a post-incident review, rather than stopping once something has been noticed.The policy pack, drawing its named contact and monitoring detail from your intake instead of a placeholder title.

What the report actually contains

Detailed Findings — a finding on the CDE's externally facing surface, illustrative
4. Payment API reflects any Origin header and allows credentials with it Severity: HIGH CVSS: 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Status: triaged Affected Asset: https://pay.[REDACTED].com/api/v1/customer/cards OWASP Category: A05:2021 – Security Misconfiguration Retest Status: pending Reproduction: 1. Send a request to the endpoint carrying an Origin header for a host the merchant does not control. 2. Read the CORS headers on the response. 3. GET /api/v1/customer/cards (Origin: https://[attacker-controlled host]) Evidence: HTTP/1.1 200 OK access-control-allow-origin: https://[attacker-controlled host] access-control-allow-credentials: true The API echoes whatever Origin it is sent and grants credentials with it, so any page a signed-in customer visits can read this endpoint's response inside their browser. Business Impact: A signed-in customer who lands on an attacker's page leaks their stored-card summary — last four digits, expiry, cardholder name, billing address — to that page, and where an endpoint has no separate request token the same session can be used to call it. PCI DSS 6.2.4 requires that bespoke and custom software be developed with techniques that prevent or mitigate common attacks, and names attacks on access control mechanisms among them — a QSA reading this will ask what else on the payment host trusts the browser's Origin. Remediation: Replace the reflected Origin with an explicit allow-list of the merchant's own origins, and never send access-control-allow-credentials: true to an origin outside it. Answer an unrecognised Origin with no CORS headers at all rather than echoing it. Re-run the check after the change and add it to the pre-release gate so a later deploy cannot reintroduce the reflection.

Illustrative example, written in the format the product generates. Not taken from a customer engagement.

How this review actually runs

A PCI DSS assessment runs through a QSA if you file a Report on Compliance, or through self-assessment against a Self-Assessment Questionnaire if your acquirer allows it — which track applies depends on transaction volume and is the acquirer's call, not yours. The requirement text is identical either way; only who signs off changes.

Scoping happens before any testing does, and it decides more than any technical step that follows: which systems store, process, or transmit cardholder data, plus every system that can reach one of them without a network security control in the way. That second group — adjacent to the boundary rather than inside it — is where most CDEs turn out larger than the network diagram claims.

The penetration test covers the CDE and its perimeter under Requirement 11.4, at least annually and again after a significant change. Where segmentation is used to shrink the CDE, 11.4.5 tests whether that isolation actually holds instead of accepting the diagram at face value — and that test, like the internal penetration test under 11.4.2, is run from inside the network, which this product does not do. Only the external penetration test under 11.4.3, the CDE's publicly reachable systems, is what the pentest here covers; the internal test and the segmentation test each need a separate engagement. Findings then move through remediation and a retest that restates each one as fixed or not fixed, the same trail a QSA samples later.

It stalls when the tested boundary doesn't match the CDE the QSA has already walked through on their own: a segment the client called out of scope turns out reachable, and the assessment restarts from the network diagram rather than from the findings.

What gets this sent back

A pentest scoped to the CDE but not the systems that can reach it. A QSA who has already scoped their own view of the CDE finds an adjacent segment the report never touched, and the report gets read as covering the wrong boundary rather than as evidence at all.
External scanning treated as satisfying Requirement 11.3.2 without an Approved Scanning Vendor. 11.3.2 specifically requires the external quarterly scan to come from a PCI SSC-approved vendor; a scan from anyone else, however thorough, doesn't count toward that line item, and the requirement stays open.
Segmentation tested once, before the last firewall change. 11.4.5 treats a change to segmentation controls as its own trigger for re-testing, so a segmentation report that predates the current firewall ruleset is evidence for a network that no longer exists.
A network diagram that doesn't match where cardholder data actually flows. Requirement 1.2 wants the diagram and the data flows to agree, and a QSA who spots a system in the pentest scope the diagram never drew starts questioning what else the diagram left out.
Findings closed with no remediation date attached. Requirement 6.3.3 expects critical and high findings inside a defined patch window; a finding marked fixed with nothing showing when gives the QSA no way to check whether the window held.
Free · no account

Start your Pentest

Our agent swarm and human experts test your endpoints and deliver an audit, fast.

PCI DSS, answered

Is penetration testing mandatory for PCI DSS?

Requirement 11.4 mandates internal and external penetration testing at least annually and after any significant change to the environment. The report has to be scoped specifically to the cardholder data environment — a test of the wrong systems doesn't satisfy the requirement, even when the testing itself was thorough.

Does Pentest Today's scanning satisfy the ASV requirement?

Pentest Today's scanning is not a substitute for the ASV requirement. Requirement 11.3.2 requires the quarterly external scan to be performed by a PCI SSC-approved scanning vendor, which Pentest Today is not. Its scanning supports internal vulnerability management and the penetration test; the ASV scan stays a separate obligation sourced elsewhere.

What is segmentation testing, and do I need it?

Segmentation testing checks whether the network controls separating your cardholder data environment from the rest of the network actually hold, not just whether a diagram shows them separated. Requirement 11.4.5 requires it for any environment that relies on segmentation to reduce PCI scope, at least annually and after changes.

What's the difference between a ROC and an SAQ?

A Report on Compliance is a full assessment performed by a QSA, typically required at higher transaction volumes. A Self-Assessment Questionnaire lets a merchant attest to the same requirements themselves, where their acquirer permits it. Which track applies is set by the acquiring bank based on volume, not chosen by the merchant.

How is the scope of a PCI pentest decided?

Scope starts with every system that stores, processes, or transmits cardholder data, then extends to anything that can reach one of those systems without a network security control in between. Getting that second group wrong is the most common reason a completed pentest still doesn't match the CDE a QSA has scoped.

What triggers a PCI pentest outside the annual cycle?

Requirement 11.4 requires re-testing after any significant change to the CDE — a new network segment, a changed firewall ruleset, a new system handling cardholder data. Segmentation testing under 11.4.5 has its own trigger: any change to the segmentation controls themselves, independent of whether the annual test is already due.

Is the pentest a real test or just a scanner dump?

Both scanning and AI triage are scoped to your approved targets, and every finding is reviewed and signed off by a human before delivery — so the report reflects verified findings, not raw scanner noise.

How fast can I get a report?

Most reports turn around in hours, not weeks. You connect an approved target, we scan and verify, and you export a client-ready report and policy pack.

Get the evidence for your PCI DSS review this week.

Start a scan on an approved target and walk in with the report, policies, and diagrams already done.