Annual penetration testing that satisfies PCI DSS v4.0.1 Requirement 11.4 — internal, external, and segmentation testing of your cardholder data environment, in a report your QSA will accept.
PCI DSS Requirement 11.4 mandates penetration testing of your cardholder data environment (CDE) at least annually and after any significant change to the environment.
Internal and external penetration testing of the CDE, plus testing to validate that segmentation controls isolate the CDE from out-of-scope systems.
At least annually, and after any significant change to the environment — new infrastructure, new applications, or material architecture changes.
Any organization that stores, processes, or transmits cardholder data: fintech, payment processors, e-commerce, and SaaS handling payments.
5–10 days · from $15,000 · retests for HIGH and CRITICAL findings included.
Our reports are structured the way assessors expect — scope boundary statements, methodology disclosure, and control mapping. Your QSA validates, doesn't interpret.
We test segmentation the way an attacker would attempt to cross it, not just a config review — so your scope reduction actually holds up.
Most engagements run 5–10 business days. We schedule around your assessment date, not the other way around.
Final scope depends on the size of your CDE, number of in-scope applications, and whether segmentation testing is required. We set final scope and price on a 30-minute call — no obligation.
Yes. Findings are mapped directly to Requirement 11.4 and the report includes the scope, methodology, and segmentation testing your QSA needs to validate the control.
Yes. We actively attempt to cross segmentation boundaries between the CDE and out-of-scope systems, which is what 11.4.6 requires after significant change.
At least annually, and after any significant change to your environment. Many organizations schedule it ahead of their annual assessment.
The size of your cardholder data environment, the number of in-scope applications, and whether internal and segmentation testing are required. Engagements start at $15,000.
Book a 30-minute scoping call. We'll confirm scope, timeline, and price — and how the report maps to your PCI DSS requirements.
Book a scoping call