PCI DSS Penetration Testing
PCI DSS Requirement 11.4 explicitly requires penetration testing — this is one of the few compliance frameworks that names it directly rather than leaving it implied. We scope testing to match what your QSA or ISA will expect to see.
What PCI DSS Requirement 11.4 requires
- External and internal penetration testing at least annually and after any significant infrastructure or application change.
- Segmentation testing, if you rely on network segmentation to reduce the scope of your cardholder data environment (CDE) — confirming that segmentation actually isolates the CDE.
- Application-layer testing for public-facing, custom-developed applications in scope.
What we test
External and internal infrastructure touching or supporting the CDE, segmentation controls, and any custom-developed applications that process, store, or transmit cardholder data.
Technical depth behind every engagement
Our testers hold certifications including OSCP, OSWP, CRTO, CEH, and AWS Security Specialty, among others. Our in-house team delivers 200+ penetration tests annually across 9+ industry sectors.
A clear process from scope to retest
You know what is happening, who to contact, and when to expect each deliverable.
- 1
Scoping
We confirm targets, objectives, access levels, exclusions, and the compliance requirement the test supports.
- 2
Kickoff & rules of engagement
We agree communications, safety limits, test accounts, escalation contacts, and the incident process before testing begins.
- 3
Testing window
Our specialists combine manual techniques with automated tooling. Critical findings are reported immediately, not held for the final report.
- 4
Written report
Each finding includes evidence, remediation guidance, CVSS scoring, and a real-world exploitability assessment for your environment.
- 5
Follow-up consultation
A free session with our technical team explains the findings, business impact, and practical remediation options.
- 6
Retest
We verify completed fixes and document the result so you can show auditors and stakeholders what changed.
Frequently asked questions
Testing for other frameworks
Get a PCI DSS-scoped test
Tell us what is in scope and which audit or business requirement the test needs to support.