PCI Penetration Testing & ASV Scanning

PCI DSS compliance testing is the independent technical assessment of security controls protecting cardholder data environments (CDE), required by the Payment Card Industry Data Security Standard for any organisation that stores, processes, or transmits payment card data. Required testing includes: annual penetration testing of CDE segmentation under Requirement 11.3/11.4, quarterly external vulnerability scanning by an Approved Scanning Vendor (ASV) under Requirement 11.2, and validation of access controls, encryption, and network segmentation controls. UK merchants failing compliance testing face acquiring bank non-compliance fees of £5,000-£100,000 per month, card brand penalties of up to £500,000 following a breach, and potential card processing suspension. Precursor Security delivers CREST-accredited PCI penetration testing (Requirement 11.3/11.4) and can provide ASV vulnerability scanning (Requirement 11.2) for UK merchants, with fixed-price scoping and a report formatted for your QSA. We provide the technical testing evidence; we do not act as a QSA or complete the full compliance assessment.

Any organisation storing, processing, or transmitting payment card data must comply with PCI DSS: merchants (e-commerce sites, retail stores, restaurants), payment processors and gateways, payment service providers, and hosting providers with CDE access. Compliance level (1-4) depends on annual transaction volume. All levels require vulnerability scanning; Level 1 merchants require annual penetration testing. Fully outsourcing card processing to a third-party payment service provider (PSP) reduces but does not eliminate your PCI DSS obligations. SAQ-A applies only if you use a fully outsourced, PCI DSS-compliant payment page and store no cardholder data. If your checkout redirects to a third-party page but your server executes any part of the payment flow, you fall under SAQ-A-EP or higher, requiring penetration testing. We confirm your actual scope before testing begins.

Requirement 11.3 mandates annual penetration testing of CDE and segmentation controls. Testing includes: network layer testing (firewall rule validation, VLAN segmentation), application layer testing (web app and payment application vulnerabilities), attempting to access cardholder data from untrusted networks, and validating that segmentation prevents lateral movement into CDE. Testing must follow the PCI DSS-defined penetration testing methodology, covering both external attacker and internal threat perspectives. PCI DSS v4.0.1 also introduced Requirement 11.4 enhancements including Requirement 11.4.7 for service providers, requiring penetration testing to include multi-tenant separation validation. A test carried out before your current QSA assessment period does not satisfy the requirement for the new period.

ASV (Approved Scanning Vendor) scanning is quarterly automated vulnerability scanning of external-facing CDE systems to identify known CVEs and misconfigurations (Requirement 11.2). Penetration testing is annual manual testing attempting to exploit vulnerabilities and bypass segmentation (Requirement 11.3). ASV scanning is continuous monitoring; penetration testing validates real-world exploitability and segmentation effectiveness. Most Approved Scanning Vendors provide scan results without remediation support, leaving your team to interpret CVSS scores and prioritise fixes without PCI DSS context. Our ASV service includes guided remediation: we triage flagged vulnerabilities by PCI DSS impact, identify false positives eligible for dispute with supporting documentation, and provide fix-first guidance to achieve a clean scan within your 30-90 day remediation window.

We test segmentation by attempting to access CDE from out-of-scope networks: testing firewall rules for bypasses, attempting VLAN hopping attacks, identifying misconfigured routing allowing unauthorised access, testing wireless network isolation, and validating that application-layer controls prevent CDE access. Failed segmentation means the entire network is in-scope for PCI DSS, significantly expanding compliance burden. We also perform internal network segmentation testing from an assumed-breach position to validate that lateral movement into the CDE is blocked. Our segmentation testing reports are formatted to satisfy QSA evidence requirements under Requirement 11.3.

Yes. PCI DSS v4.0.1 is now the current standard. We provide the technical testing it requires: penetration testing satisfying Requirement 11.3/11.4, ASV vulnerability scanning (Requirement 11.2), and CDE segmentation validation, with a remediation roadmap. Our reports reference v4.0.1 requirements by number throughout, so your QSA has the technical evidence they need. The full assessment and Report on Compliance are completed by your QSA.

You receive: a penetration testing report (Requirement 11.3/11.4 evidence), ASV scan results (Requirement 11.2 evidence), CDE segmentation validation, a prioritised remediation roadmap, and a QSA-ready evidence package suitable for submission to acquiring banks and card brands alongside your QSA assessment or SAQ. Our reports meet QSA evidence requirements and have been accepted by UK acquiring bank compliance teams. We provide the technical testing evidence; we do not act as a QSA.

PCI DSS compliance testing cost in the UK depends primarily on your merchant level and the scope of services required. Level 3-4 merchants (SAQ-eligible, lower transaction volumes): £5,000-£12,000 for an annual testing package: penetration testing, ASV scanning, and segmentation validation. Level 2 merchants (SAQ or QSA-validated): £10,000-£20,000 depending on CDE complexity, number of external IP ranges, and whether a formal gap analysis report is required for acquiring bank submission. Level 1 merchants (mandatory RoC by QSA): Penetration testing and ASV scanning as standalone technical components are £15,000-£25,000 annually. The QSA engagement itself (not our service) adds £20,000-£60,000 depending on the QSA firm. We provide the technical testing evidence that supports the QSA's assessment. These figures cover external and internal penetration testing of the CDE, quarterly ASV scanning (four scan cycles), network segmentation validation, and a compliance evidence package formatted for QSA submission. Our scoping call establishes your exact requirement before any commercial commitment. Compare testing cost to the alternative: a single month of acquiring bank non-compliance fees (£5,000-£100,000) typically exceeds an entire year of testing investment.

PCI DSS Requirement 11.4 mandates penetration testing at least annually and after any significant infrastructure or application change. Annual requirement: At minimum, a full penetration test of the CDE and its segmentation controls must be completed within each 12-month assessment period. The test must cover both external (internet-facing) and internal (within the network perimeter) perspectives. After significant changes: If you deploy new payment systems, reconfigure network segmentation, migrate to a new hosting provider, add new payment channels, or make significant changes to your CDE architecture, penetration testing is required before returning to production, regardless of where you are in the annual cycle. PCI DSS v4.0.1 change: Requirement 11.4.7 for service providers specifically requires penetration testing to include multi-tenant separation validation. If you are a payment service provider or hosting provider, this adds scope to your testing requirement. Testing performed outside your current QSA assessment period does not carry forward. If your last test was completed 14 months ago, even if it was thorough and you have not changed your infrastructure, you are overdue and technically out of compliance with Requirement 11.4. We regularly see this as an undetected compliance gap during scoping calls.