Security & privacy · PCI DSS Penetration Testing
PCI DSS penetration testing that meets requirement 11.4
Internal, external, application and segmentation testing for your cardholder data environment, run to a documented methodology and retested until it passes.
Does PCI DSS require penetration testing?
Yes. PCI DSS v4.0.1 requirement 11.4 requires internal and external penetration testing at least once every 12 months and after any significant change, testing of segmentation controls, and retesting to confirm exploitable vulnerabilities were corrected. The tester must be qualified and organizationally independent, but does not need to be a QSA or ASV.
Last reviewed by the Mighty Infosec team. This page is guidance, not legal advice.
PCI DSS v4.0.1
What requirement 11.4 asks for
11.4.1
A documented, industry-accepted methodology covering the CDE perimeter, critical systems, and both network and application layers.
11.4.2 / 11.4.3
Internal and external penetration testing at least once every 12 months and after any significant infrastructure or application change.
11.4.4
Exploitable vulnerabilities and security weaknesses are corrected, and testing is repeated to verify the fixes.
11.4.5 / 11.4.6
Segmentation controls are tested at least every 12 months, and every six months for service providers.
How we help
AI-native testing, verified by experts
Methodology on paper
We share our documented methodology up front, based on NIST SP 800-115 and OWASP, so your QSA can review it.
Network and application layers
External perimeter, internal network, payment pages, APIs and the web apps that touch cardholder data.
Segmentation testing
We confirm out-of-scope networks really cannot reach the CDE, which keeps your scope small.
Retest until clean
Exploitable findings are retested after you fix them, as 11.4.4 requires, with results documented.
What you receive
- Report mapped to requirement 11.4 sub-requirements
- Segmentation test results
- Retest report confirming fixes
- Methodology document for your QSA
FAQ
PCI DSS Penetration Testing questions
Are you an ASV for quarterly scans?
No. Quarterly external vulnerability scans under requirement 11.3.2 must come from a PCI SSC Approved Scanning Vendor. Penetration testing under 11.4 is a separate requirement, and that is what we deliver.
Does the pentester need to be a QSA?
No. PCI DSS requires the tester to be qualified and organizationally independent, not a QSA or ASV.
What counts as a significant change?
Examples include new systems in the CDE, network or firewall changes, new payment flows and major application releases. Your QSA has the final say for your environment.
Services
Services behind this engagement
Network Pentesting
External and internal infrastructure testing to show how an intrusion would unfold.
Web Application Pentesting
AI-native, expert-verified testing of your web apps, from auth bypass to business-logic abuse.
Cloud Security & Pentesting
AWS, Azure and GCP configuration review and attack-path analysis.
Talk to us about PCI DSS Penetration Testing
Tell us what you're building. In a free 30-minute scoping call we'll map your risks and recommend the right engagement, whether you need a pentest, a threat model or an AI security review.