PCI DSS Penetration Testing for MSPs

PCI DSS penetration testing leaves very little room for interpretation. If your client stores, processes or transmits cardholder data, Requirement 11.4 calls for external and internal penetration testing of the cardholder data environment at least once every 12 months and after any significant change. The current standard is PCI DSS v4.0.1, which became the sole active version after v4.0 was retired at the end of 2024, so a report written against an older version is a conversation you do not want to have with a QSA.

A scan is not a penetration test

This is the single most common misunderstanding, and it costs clients money and time. PCI DSS keeps the two in separate requirements on purpose.

• Requirement 11.3.2 covers external vulnerability scanning, performed quarterly by a PCI SSC Approved Scanning Vendor. It is automated, it is recurring, and it answers what known vulnerabilities are visible from the internet.
• Requirement 11.4 covers penetration testing. It is manual, it happens at least annually and after significant change, and it answers a different question: can someone actually get in, chain findings together and reach cardholder data.

A passing ASV scan does not evidence a penetration test, and a penetration test does not replace the quarterly scans. Your client needs both, and a QSA will ask for both separately.

What Requirement 11.4 actually demands

Requirement 11.4 breaks down into sub-requirements a QSA will work through one at a time: a defined and documented testing methodology, internal testing, external testing, correction of exploitable findings followed by a retest, and segmentation testing to prove that out-of-scope networks are genuinely isolated from the CDE. Service providers and multi-tenant environments carry extra segmentation testing obligations on a shorter cycle. v4.0.1 also tightened expectations around tester qualification and the rigor of the methodology, so the assessor is checking who tested as closely as what they found.

What our PCI DSS penetration testing delivers

• External and internal testing of the cardholder data environment
• Segmentation testing that proves out-of-scope networks are actually isolated from the CDE
• Web application testing aligned with OWASP for any in-scope payment applications
• A report mapped to the specific 11.4 sub-requirements your QSA will reference
• Free remediation retesting, which 11.4 requires in order to close findings
• Qualified pentesters with OSCP, CEH and CREST credentials a QSA will recognize

Significant changes trigger a new test

Do not let your clients get caught by this one. Migrating to a new payment processor, deploying a new in-scope web application, or restructuring the CDE network all count as significant changes and all require fresh testing. We price it so your client can stay compliant through the year instead of blowing the entire security budget on one annual engagement.

Built for MSP resellers

You take the client conversation, we do the testing. Reports are fully white-labeled. We never approach your clients directly, and our pricing is structured so you can build a real margin on top of compliance work, turning a painful audit requirement into a profitable, recurring service line.