PCI DSS Penetration Testing

Card-holder data penetration testing for PCI DSS

Manual internal and external penetration testing of the cardholder data environment, including segmentation checks, with reports your QSA can work from.
Get a Pentest Quote Book a Scoping Call

Accreditations and memberships

CREST member company, accredited for penetration testing CREST-accredited penetration testing Cyber Essentials certified UK Cyber Security Council member

Why PCI DSS Teams Come to Us

What brings a PCI DSS team to a penetration test

Unlike ISO 27001 or SOC 2, PCI DSS asks for penetration testing directly. These are the most common reasons teams commission it.

Annual testing under Requirement 11.4

PCI DSS v4.0.1 Requirement 11.4 asks for internal and external penetration testing at least annually and after significant change. The test must be carried out by a qualified tester with organisational independence, which for most organisations means an external provider.

A change to your payment environment

A replatform, a new payment integration, a migration or modification to your network segmentation can be a significant change under the standard and call for a fresh test.

Keeping systems out of PCI scope

If you rely on network segmentation to keep systems out of scope, the standard expects it to be tested and not just documented.

Evidence for your QSA

Your QSA, or the acquirer you report to, will ask for the report, scope, and evidence that exploitable findings were fixed and retested.

Scope of Testing

What a PCI DSS penetration test covers

We test the cardholder data environment (CDE) and the systems connected to it, from outside and inside the network. Your QSA assesses your compliance, and Exploitr provides the penetration testing. If you run an online shop, see our e-commerce penetration testing page for an application-specific view.
01

External perimeter of the CDE

Internet-facing systems that form part of, or connect to, the CDE: payment pages, APIs, remote access, web and mail servers, and exposed services. See our external penetration testing service.
02

Internal network and connected systems

Testing from inside the network, covering lateral movement, privilege escalation and access to the systems that store, process or transmit card data. See our internal penetration testing service.
03

Segmentation testing

If segmentation keeps systems out of PCI scope, we test from the out-of-scope networks to check that the CDE can't be reached where your diagrams say it can't. Segmentation checks are part of the internal testing scope.
04

Payment applications and APIs

Application-layer testing of the web applications and APIs that handle card data or sit alongside it, including authentication, access control and business logic. See our web application and API penetration testing services.

How It Works

From first contact to final report

You don't need a finished scope document before reaching out.
01

Tell us about your PCI scope

Submit a quote request or book a scoping call with a description of your CDE or a network diagram, whether you're a merchant or a service provider, and your assessment date. We reply within one business day to confirm the scope, usually with a short questionnaire or a call.
02

Receive a written, fixed-price proposal

The proposal confirms the scope, methodology, timing, rules of engagement and a fixed price. You accept when you're ready, and there's no obligation at any stage.
03

Testing timed around your assessment

Count back from your assessment date and leave room for the report, remediation and retesting, not just the days of testing. Your consultant is your direct contact throughout, and critical findings are escalated the same day they're discovered.
04

Report delivery, debrief and retest

Technical and executive reports are delivered within 2 business days of testing completion, followed by a debrief call. PCI DSS expects exploitable findings to be fixed and retested. Retesting of remediated findings is included for remotely delivered web application, API, website and external network testing, and is agreed at scoping for internal testing.

Typical Scope and Price

A worked example from our published prices

An organisation with a small cardholder data environment: one standard web application, a small internet-facing network and one or two internal subnets. Prices are indicative, exclude VAT and are confirmed as a fixed price after scoping.

Larger environments or service-provider scopes may cost more. See the pricing guide for every service, or use the cost calculator to get an initial indication.

    Asset in your PCI scopeTestingIndicative price
    Customer-facing web application, standard complexityWeb application penetration testing£3,600 to £6,000
    Internet-facing network, up to 25 IP addressesExternal penetration testing£2,400 to £3,350
    Internal network, one or two subnets with local servers, including segmentation checksInternal penetration testing£3,600 to £4,150

    What You Receive

    Included in every engagement

    • Executive and technical reports

      A summary for leadership and your QSA, every finding with evidence, CVSS scoring, and remediation guidance.

    • Attestation

      We provide an attestation letter, confirming the scope and testing dates, without disclosing any sensitive information.

    • Debrief session

      A video call or presentation to walk through findings and remediation priorities with your technical and security teams.

    • Retesting and platform access

      Retesting where included for the service, and findings tracked in the Exploitr platform at no extra cost.

    Common Questions

    PCI DSS penetration testing: frequently asked questions

    How testing relates to PCI DSS, answered before you request a quote.

    The report is structured for your QSA to work from: the scope, methodology documentation, testing dates, findings with evidence and remediation guidance, and an attestation letter. Your QSA decides whether the evidence meets the requirement, so share their expectations with us during scoping.

    Exploitr is not a QSA or an ASV. We don't assess your compliance, produce a Report on Compliance or run ASV scans. We provide the penetration testing and evidence through our reporting.

    Yes, they are separate requirements. PCI DSS asks for external vulnerability scans by an Approved Scanning Vendor (ASV) at least every three months, and these are automated.

    A penetration test is a consultant-led engagement, where they attempt to exploit weaknesses, chain them together, and compromise your CDE.

    Exploitr isn't an ASV, so you'd use an approved vendor for the quarterly scans separate from us. Our article on vulnerability scanning vs penetration testing explains the differences.

    Internal and external penetration testing is required at least every 12 months and after any significant change to the infrastructure or applications. Where segmentation is used to reduce scope, the segmentation controls must also be tested at least every 12 months and after any change to them. Your QSA can tell you which of your changes count as significant.

    If you release frequently, our Penetration Testing as a Service (PTaaS) offering provides ongoing testing aligned with your release cadence. Our guide to how often to get a penetration test covers cadence by situation.

    Yes. Service providers that use segmentation to reduce scope must test those controls at least every 6 months and after any change, rather than every 12 months. The standard sets other additional requirements for service providers too, and which apply depends on your services and how you're assessed.

    Tell us you're a service provider when you request a quote, and share your QSA's requirements, so we can reflect them in the scope.

    Segmentation testing is covered during the internal penetration test, as part of the standard methodology. We test from each network segment that is meant to be out of scope towards the CDE, across every segmentation control in scope, such as firewall rules, VLANs and access control lists. The aim is to confirm that the CDE can't be reached where your diagrams say it can't.

    The commands that were run and their output are documented in the report, with screenshots where possible, so your QSA can see what was tested and the result. Share your network diagrams and segmentation design during scoping so we can agree the full set of boundaries to test.

    Ready to scope your PCI DSS penetration test?

    Tell us about your cardholder data environment and your assessment date, and we'll reply within one business day to confirm the scope, then send a fixed-price proposal. No obligation at any stage.
    Request a Quote