Penva Security
Book a scoping call

PCI DSS v4.0 Penetration Testing

Penva Security performs internal, external and segmentation penetration testing aligned to PCI DSS v4.0 and the current v4.0.1 clarification, with evidence organised around Requirement 11.4.

We test the cardholder data environment, connected systems and payment-facing applications using a documented methodology, then provide the remediation and retest evidence your QSA or compliance team will expect.

  • Certified Testers
  • Security Compliance
  • Manual Pentesting
CRESTOWASPSecured 100+ organisations4.9Clutch
●   PENTEST REPORT● COMPLETE

PCI DSS Test Report

scope: cardholder data environment · CVSS 3.1

Critical3
High6
Medium9

✓  Requirement 11.4 evidence package generated

Built for PCI DSS Requirement 11.4.

Get Instant Quote  

Instant estimate in about 30 seconds

Definition

What Is PCI DSS Penetration Testing?

See how the testing scope and reporting support your organisation's security and assurance requirements.

PCI DSS penetration testing is a controlled attempt to identify and exploit weaknesses in the cardholder data environment and the systems that can affect its security. Unlike a vulnerability scan, the test follows attack paths, validates impact and checks whether segmentation genuinely limits access to payment systems.PCI DSS v4.0.1 is the current limited revision of the v4 standard. Requirement 11.4 sets expectations for a documented methodology, internal and external testing, testing after significant change, remediation of exploitable weaknesses and repeat testing to confirm fixes.

The result is not simply a list of scanner alerts. It is evidence your QSA or internal compliance team can review to understand scope, methodology, exploitation, segmentation and closure of findings.

Requirements

What PCI DSS Requirement 11.4 Expects

The testing program must cover the cardholder data environment, connected systems and segmentation controls, with repeat testing after material changes and remediation.

11.4.1

Documented Testing Methodology

The methodology should define the scope, attack approach, application and network coverage, threat considerations, findings process and retention of results.

11.4.2

Internal Penetration Testing

Internal systems and paths into the cardholder data environment must be tested at least annually and after significant infrastructure or application changes.

11.4.3

External Penetration Testing

Internet-facing systems and external attack paths must be tested at least annually and after significant changes that could affect exposure.

11.4.4

Remediation and Repeat Testing

Exploitable vulnerabilities must be corrected and the affected paths tested again to verify that the remediation is effective.

11.4.5

Segmentation Validation

Where segmentation reduces PCI scope, the controls must be tested to confirm that out-of-scope networks cannot reach the cardholder data environment.

11.3

Vulnerability Scanning

Internal and external scanning supports routine vulnerability management, but it remains separate from the manual and exploit-focused penetration test.

How Penva Delivers

Mapped to the Evidence Your QSA Will Review

Penva records the scope, methods, attack paths and retest results in a format that can be provided to your QSA or retained with your PCI evidence.

11.4.1 Methodology and Scope

A documented rules-of-engagement and methodology statement covering application, API, network and social-engineering exclusions, with CDE boundaries clearly recorded.

11.4.2-3 Internal and External Testing

Manual exploitation of internal and external attack paths, including authentication, payment applications, exposed services and paths into the CDE.

11.4.5 Segmentation Evidence

Segmentation validation from representative out-of-scope networks, with evidence showing whether CDE access controls can be bypassed.

11.4.4 Verified Remediation

One retest within 60 days to confirm that exploitable findings and segmentation issues have been corrected.

QSA Pack Report and Attestation

A professional report and signed attestation letter identifying the tester, scope, dates, methodology, findings and retest status.

Instant Estimate Quote

Get an Instant Penetration Testing Estimate

Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.

    01

    What type of penetration testing do you need?

    Choose the main service you want quoted.

    FAQ

    PCI DSS v4.0 Penetration Testing - Common Questions

    Clear answers for merchants and service providers preparing PCI DSS evidence. Updated July 2026.

    Is PCI DSS v4.0 or v4.0.1 the current standard?

    PCI DSS v4.0.1 is the current limited revision. It clarified wording and guidance without adding or deleting requirements. Many organisations still use "PCI DSS v4.0" as the broader name for the current v4 framework.

    How often is PCI DSS penetration testing required?

    Internal and external penetration testing is generally required at least annually and after significant infrastructure or application changes. Segmentation testing also follows defined frequencies, with additional obligations applying to some service providers.

    Is an ASV scan the same as a penetration test?

    No. An Approved Scanning Vendor scan identifies known external vulnerabilities. A penetration test uses manual techniques and exploitation to assess attack paths, business impact, application logic and segmentation. PCI DSS treats them as separate activities.

    What must be included in the PCI penetration-test scope?

    The scope should include the cardholder data environment, systems connected to it, payment applications, internal and external attack surfaces, and any segmentation controls used to reduce PCI scope. Scope should be agreed with your QSA before testing begins.

    Can Penva test network segmentation for PCI DSS?

    Yes. We test from representative out-of-scope networks and attempt to reach CDE systems and services. The report records the source locations, target paths, methods and results so your QSA can review the segmentation evidence.

    Will a QSA automatically accept the report?

    The QSA remains responsible for deciding whether evidence meets the assessment requirements. Penva provides the scope, methodology, tester credentials, detailed evidence and retest results needed for that review.

    Do you retest PCI DSS findings?

    Yes. One remediation retest is included within 60 days for fixed-price engagements. We repeat the relevant attack path and update the report to show whether the issue is closed, partially resolved or still exploitable.

    Let's talk security

    Get In Touch

    Book a scoping call or share your systems, testing requirements and preferred timeline with our team.

    Book a scoping call

    Choose a time that works for you.

    30 min

    Tell us what you need

    Share your scope, priorities and deadline.

    Share your scope and we'll help you plan the next step.

    A clear next step

    We'll review your requirements with you and confirm the scope before testing begins.

    Prefer to get in touch directly? [email protected]