PCI DSS PENETRATION TESTING

If your organisation stores, processes, or transmits payment card data, PCI DSS applies to you, and so does the testing it requires. Requirement 11 of the standard, "Regularly test security systems and processes", exists because the environment around cardholder data never stands still: new systems are deployed, firewall rules change, wireless networks appear, and vulnerabilities are published daily. A control that was effective at last year's assessment may have broken since, so the standard requires testing on a schedule, with evidence. Most organisations know they must test; the harder part is producing testing that their QSA (Qualified Security Assessor) will accept: correctly scoped to the cardholder data environment (CDE), performed with a recognised methodology, and documented in a form that maps cleanly to the requirement. A report that never mentions segmentation, ignores the CDE boundary, or arrives without retest evidence sends you back for another round, on the assessor's clock, close to your compliance deadline. Our PCI DSS penetration test performs the testing Requirement 11 calls for and delivers the evidence in the shape your QSA needs.

Incognito Lab is your penetration testing partner, not a QSA, and we do not issue your Report on Compliance; your assessor does that. We provide testing scoped the way the standard expects, findings your team can fix, and deliverables an assessor can take at face value. For a plain-language walkthrough of how the standard is structured and who the parties are, our team wrote a primer: an introduction to PCI DSS.

What Requirement 11 asks for

Under the current PCI DSS v4.0.1 standard, Requirement 11 drives four distinct testing activities, each with its own cadence. Our service covers all four:

If you are unsure which of these applies to your environment, or on what schedule, that is a scoping conversation we have with you before any proposal is written, and anything left out of scope is agreed at that stage.

ASV scan support

The external quarterly vulnerability scan occupies a special position in the standard: it must be run by an Approved Scanning Vendor, a company certified by the PCI Security Standards Council to operate that specific scan. Incognito Lab is not an ASV. We support the process around the scan:

How we work

Under the PCI-specific framing, the underlying tests are the same engagements we run every day: our infrastructure penetration test covers the internal and external network testing, and our web application penetration test covers the applications that store, process, or transmit cardholder data, both scoped to the CDE and its connected systems. Every engagement runs through the same phases:

1. 1

   Scoping

   We map the CDE with you: which systems store, process, or transmit cardholder data, which systems connect to them, where the segmentation boundaries sit, and which of the four Requirement 11 activities the engagement must cover. This is also where we align with your assessment timeline, so testing and retest both land before your QSA needs the evidence.

   You get a proposal with a fixed timeline and price.

2. 2

   Testing

   External and internal penetration testing against the agreed scope, wireless access point testing across your facilities, and segmentation testing that actively attempts to cross from out-of-scope networks into the CDE.

   Automated tooling assists with coverage, and every finding in the report has been validated by hand.

3. 3

   Reporting

   Findings are written up with reproduction steps, risk ratings, and remediation guidance, framed against the requirement each one affects, so it is clear what is broken and what it means for your assessment.

4. 4

   Remediation support & retest

   Your team fixes the findings; we answer questions along the way, then retest and update the report to show what has been closed.

   For PCI, evidence that identified issues were corrected and re-verified is part of what your assessor expects to see.

What you get

Deliverables are developed to address what the QSA needs: evidence an assessor can accept for the assessment. Every report contains, at minimum:

Team credentials

Related services