Schedule A Meeting
Schedule A Meeting

PCI DSS v4.0 Penetration Testing

Human-Led + AI

Penva Security performs internal, external and segmentation penetration testing aligned to PCI DSS v4.0 and the current v4.0.1 clarification, with evidence organised around Requirement 11.4.

We test the cardholder data environment, connected systems and payment-facing applications using a documented methodology, then provide the remediation and retest evidence your QSA or compliance team will expect.

Book a Free Scoping Call with US
  • Certified Testers
  • Security Compliance
  • Manual Pentesting
Pentest Report SCANNING COMPLETE
PCI DSS Test Report
scope: cardholder data environment · CVSS 3.1
Critical 3
High 6
Medium 9
Requirement 11.4 evidence package generated
Built for PCI DSS Requirement 11.4.
Get Instant Quote
Instant estimate in about 30 seconds
CREST + OSCP testers PCI evidence 100% Australian
Definition

What Is PCI DSS Penetration Testing?

PCI DSS penetration testing is a controlled attempt to identify and exploit weaknesses in the cardholder data environment and the systems that can affect its security. Unlike a vulnerability scan, the test follows attack paths, validates impact and checks whether segmentation genuinely limits access to payment systems.
PCI DSS v4.0.1 is the current limited revision of the v4 standard. Requirement 11.4 sets expectations for a documented methodology, internal and external testing, testing after significant change, remediation of exploitable weaknesses and repeat testing to confirm fixes.

The result is not simply a list of scanner alerts. It is evidence your QSA or internal compliance team can review to understand scope, methodology, exploitation, segmentation and closure of findings.

Requirements

What PCI DSS Requirement 11.4 Expects

The testing program must cover the cardholder data environment, connected systems and segmentation controls, with repeat testing after material changes and remediation.

11.4.1

Documented Testing Methodology

The methodology should define the scope, attack approach, application and network coverage, threat considerations, findings process and retention of results.
11.4.2

Internal Penetration Testing

Internal systems and paths into the cardholder data environment must be tested at least annually and after significant infrastructure or application changes.
11.4.3

External Penetration Testing

Internet-facing systems and external attack paths must be tested at least annually and after significant changes that could affect exposure.
11.4.4

Remediation and Repeat Testing

Exploitable vulnerabilities must be corrected and the affected paths tested again to verify that the remediation is effective.
11.4.5

Segmentation Validation

Where segmentation reduces PCI scope, the controls must be tested to confirm that out-of-scope networks cannot reach the cardholder data environment.
11.3

Vulnerability Scanning

Internal and external scanning supports routine vulnerability management, but it remains separate from the manual and exploit-focused penetration test.
How Penva Delivers

Mapped to the Evidence Your QSA Will Review

Penva records the scope, methods, attack paths and retest results in a format that can be provided to your QSA or retained with your PCI evidence.

11.4.1 Methodology and Scope

A documented rules-of-engagement and methodology statement covering application, API, network and social-engineering exclusions, with CDE boundaries clearly recorded.

11.4.2-3 Internal and External Testing

Manual exploitation of internal and external attack paths, including authentication, payment applications, exposed services and paths into the CDE.

11.4.5 Segmentation Evidence

Segmentation validation from representative out-of-scope networks, with evidence showing whether CDE access controls can be bypassed.

11.4.4 Verified Remediation

One retest within 60 days to confirm that exploitable findings and segmentation issues have been corrected.

QSA Pack Report and Attestation

A professional report and signed attestation letter identifying the tester, scope, dates, methodology, findings and retest status.
Instant Estimate Quote

Get an Instant Penetration Testing Estimate

Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.

Quote Builder Step 1 of 6
5 steps left
01

What type of penetration testing do you need?

Choose the main service you want quoted.

FAQ

PCI DSS v4.0 Penetration Testing - Common Questions

Clear answers for merchants and service providers preparing PCI DSS evidence. Updated July 2026.

Is PCI DSS v4.0 or v4.0.1 the current standard?

PCI DSS v4.0.1 is the current limited revision. It clarified wording and guidance without adding or deleting requirements. Many organisations still use “PCI DSS v4.0” as the broader name for the current v4 framework.

How often is PCI DSS penetration testing required?

Internal and external penetration testing is generally required at least annually and after significant infrastructure or application changes. Segmentation testing also follows defined frequencies, with additional obligations applying to some service providers.

Is an ASV scan the same as a penetration test?

No. An Approved Scanning Vendor scan identifies known external vulnerabilities. A penetration test uses manual techniques and exploitation to assess attack paths, business impact, application logic and segmentation. PCI DSS treats them as separate activities.

What must be included in the PCI penetration-test scope?

The scope should include the cardholder data environment, systems connected to it, payment applications, internal and external attack surfaces, and any segmentation controls used to reduce PCI scope. Scope should be agreed with your QSA before testing begins.

Can Penva test network segmentation for PCI DSS?

Yes. We test from representative out-of-scope networks and attempt to reach CDE systems and services. The report records the source locations, target paths, methods and results so your QSA can review the segmentation evidence.

Will a QSA automatically accept the report?

The QSA remains responsible for deciding whether evidence meets the assessment requirements. Penva provides the scope, methodology, tester credentials, detailed evidence and retest results needed for that review.

Do you retest PCI DSS findings?

Yes. One remediation retest is included within 60 days for fixed-price engagements. We repeat the relevant attack path and update the report to show whether the issue is closed, partially resolved or still exploitable.

Get In Touch

Schedule a Call Today

Contact us