[{"data":1,"prerenderedAt":281},["ShallowReactive",2],{"service-pci-dss-penetration-test-en":3},{"doc":4},{"id":5,"title":6,"body":7,"description":255,"extension":256,"faq":257,"lastReviewed":273,"link":274,"meta":275,"navigation":276,"path":277,"seo":278,"stem":279,"__hash__":280},"servicesEn\u002Fservices\u002Fpci-dss-penetration-test.md","PCI DSS Penetration Test",{"type":8,"value":9,"toc":245},"minimark",[10,23,32,37,40,88,91,95,102,122,126,139,166,170,173,211,215,226,230],[11,12,13,14,18,19,22],"p",{},"If your organisation stores, processes, or transmits payment card data, PCI DSS applies to you, and so does the testing it requires. ",[15,16,17],"strong",{},"Requirement 11"," of the standard, \"Regularly test security systems and processes\", exists because the environment around cardholder data never stands still: new systems are deployed, firewall rules change, wireless networks appear, and vulnerabilities are published daily. A control that was effective at last year's assessment may have broken since, so the standard requires testing on a schedule, with evidence. Most organisations know they must test; the harder part is producing testing that their ",[15,20,21],{},"QSA"," (Qualified Security Assessor) will accept: correctly scoped to the cardholder data environment (CDE), performed with a recognised methodology, and documented in a form that maps cleanly to the requirement. A report that never mentions segmentation, ignores the CDE boundary, or arrives without retest evidence sends you back for another round, on the assessor's clock, close to your compliance deadline. Our PCI DSS penetration test performs the testing Requirement 11 calls for and delivers the evidence in the shape your QSA needs.",[11,24,25,26,31],{},"Incognito Lab is your penetration testing partner, not a QSA, and we do not issue your Report on Compliance; your assessor does that. We provide testing scoped the way the standard expects, findings your team can fix, and deliverables an assessor can take at face value. For a plain-language walkthrough of how the standard is structured and who the parties are, our team wrote a primer: ",[27,28,30],"a",{"href":29},"\u002Fblogs\u002Fpci-dss-introduction","an introduction to PCI DSS",".",[33,34,36],"h2",{"id":35},"what-requirement-11-asks-for","What Requirement 11 asks for",[11,38,39],{},"Under the current PCI DSS v4.0.1 standard, Requirement 11 drives four distinct testing activities, each with its own cadence. Our service covers all four:",[41,42,43,54,68,78],"ul",{},[44,45,46,49,50,53],"li",{},[15,47,48],{},"Wireless access point testing",": Testing for the presence of both authorised and unauthorised (rogue) wireless access points, on a ",[15,51,52],{},"quarterly"," basis. A rogue access point plugged into a CDE-connected network is a direct bridge past your perimeter, which is why the standard insists on looking for them regularly rather than assuming the inventory is accurate.",[44,55,56,59,60,63,64,67],{},[15,57,58],{},"Network vulnerability scans",": Internal and external network vulnerability scans, at least ",[15,61,62],{},"quarterly and after any significant change",". The external quarterly scan must be performed by a PCI-approved ",[15,65,66],{},"Approved Scanning Vendor (ASV)","; the next section covers how we support that. Internal scans verify that the systems inside your environment are patched and configured as the standard requires.",[44,69,70,73,74,77],{},[15,71,72],{},"Penetration testing",": External penetration testing and internal penetration testing at least ",[15,75,76],{},"annually and after any significant infrastructure or application upgrade or modification",". This is where a human tester goes beyond what a scanner reports: chaining weaknesses, validating exploitability, and testing the applications and networks that touch cardholder data the way a real attacker would.",[44,79,80,83,84,87],{},[15,81,82],{},"Segmentation testing",": Where segmentation is used to isolate the CDE from other networks, the segmentation controls themselves must be penetration tested at least ",[15,85,86],{},"annually and after any change"," to them. The goal is to verify the segmentation is operational and effective: that systems you have declared out of scope genuinely cannot reach the CDE. Your entire scope-reduction argument, and the assessment cost that follows from it, rests on segmentation actually holding.",[11,89,90],{},"If you are unsure which of these applies to your environment, or on what schedule, that is a scoping conversation we have with you before any proposal is written, and anything left out of scope is agreed at that stage.",[33,92,94],{"id":93},"asv-scan-support","ASV scan support",[11,96,97,98,101],{},"The external quarterly vulnerability scan occupies a special position in the standard: it must be run by an ",[15,99,100],{},"Approved Scanning Vendor",", a company certified by the PCI Security Standards Council to operate that specific scan. Incognito Lab is not an ASV. We support the process around the scan:",[41,103,104,110,116],{},[44,105,106,109],{},[15,107,108],{},"Coordination",": we help you set up and schedule the ASV scans, define the external scope correctly, and manage the quarterly cadence so a missed window does not surface at assessment time.",[44,111,112,115],{},[15,113,114],{},"Remediation",": ASV scan results arrive as raw findings; a failing scan blocks your compliance. We interpret the results, separate genuine exposure from false positives, guide your team through the fixes, and support the rescan until you have a passing attestation.",[44,117,118,121],{},[15,119,120],{},"Alignment",": the ASV scan, the internal scans, and the penetration testing all describe the same environment. We make sure they tell one consistent story, because inconsistencies between them are exactly what an assessor will probe.",[33,123,125],{"id":124},"how-we-work","How we work",[11,127,128,129,133,134,138],{},"Under the PCI-specific framing, the underlying tests are the same engagements we run every day: our ",[27,130,132],{"href":131},"\u002Finfrastructure-penetration-test","infrastructure penetration test"," covers the internal and external network testing, and our ",[27,135,137],{"href":136},"\u002Fweb-application-penetration-test","web application penetration test"," covers the applications that store, process, or transmit cardholder data, both scoped to the CDE and its connected systems. Every engagement runs through the same phases:",[140,141,142,148,154,160],"ol",{},[44,143,144,147],{},[15,145,146],{},"Scoping",": We map the CDE with you: which systems store, process, or transmit cardholder data, which systems connect to them, where the segmentation boundaries sit, and which of the four Requirement 11 activities the engagement must cover. This is also where we align with your assessment timeline, so testing and retest both land before your QSA needs the evidence. You get a proposal with a fixed timeline and price.",[44,149,150,153],{},[15,151,152],{},"Testing",": External and internal penetration testing against the agreed scope, wireless access point testing across your facilities, and segmentation testing that actively attempts to cross from out-of-scope networks into the CDE. Automated tooling assists with coverage, and every finding in the report has been validated by hand.",[44,155,156,159],{},[15,157,158],{},"Reporting",": Findings are written up with reproduction steps, risk ratings, and remediation guidance, framed against the requirement each one affects, so it is clear what is broken and what it means for your assessment.",[44,161,162,165],{},[15,163,164],{},"Remediation support & retest",": Your team fixes the findings; we answer questions along the way, then retest and update the report to show what has been closed. For PCI, evidence that identified issues were corrected and re-verified is part of what your assessor expects to see.",[33,167,169],{"id":168},"what-you-get","What you get",[11,171,172],{},"Deliverables are developed to address what the QSA needs: evidence an assessor can accept for the assessment. Every report contains, at minimum:",[41,174,175,181,187,193,199,205],{},[44,176,177,180],{},[15,178,179],{},"Executive summary",": the business-level risk picture, suitable for management and your assessor.",[44,182,183,186],{},[15,184,185],{},"Findings by Risk Level",": each issue rated Critical, High, Medium, or Low so remediation can be prioritised objectively.",[44,188,189,192],{},[15,190,191],{},"POC for every finding",": the exact steps to reproduce each finding, with requests and evidence.",[44,194,195,198],{},[15,196,197],{},"Remediation guidance",": practical fixes for your environment.",[44,200,201,204],{},[15,202,203],{},"Retest verification",": findings are re-checked after your fixes and the report is updated to reflect closed items, giving your assessor the corrected-and-verified trail the standard expects.",[44,206,207,210],{},[15,208,209],{},"Segmentation test evidence",": where segmentation is in scope, explicit documentation that the controls were tested and that out-of-scope systems could not reach the CDE.",[33,212,214],{"id":213},"team-credentials","Team credentials",[11,216,217,218,221,222,31],{},"Testing is performed by our in-house team holding industry certifications including ",[15,219,220],{},"OSCP, OSCE, CREST CRT, CREST CPSA, and GIAC GREM",", each earned through hands-on practical examination. ",[27,223,225],{"href":224},"\u002Fcertifications","See the full list of certifications the team holds",[33,227,229],{"id":228},"standards","Standards",[11,231,232,233,236,237,240,241,31],{},"Our methodology follows ",[15,234,235],{},"NIST SP800-115"," (Technical Guide to Information Security Testing and Assessment), with scope, cadence, and reporting aligned to ",[15,238,239],{},"PCI DSS"," Requirement 11 under the current v4.0.1 standard. Penetration testing is one requirement among twelve, though. If you are earlier in the journey, still defining your CDE, or building the broader security programme the standard sits inside (policies, ISMS, ISO\u002FIEC 27001), that work is handled by our ",[27,242,244],{"href":243},"\u002Fconsulting","consulting team",{"title":246,"searchDepth":247,"depth":247,"links":248},"",2,[249,250,251,252,253,254],{"id":35,"depth":247,"text":36},{"id":93,"depth":247,"text":94},{"id":124,"depth":247,"text":125},{"id":168,"depth":247,"text":169},{"id":213,"depth":247,"text":214},{"id":228,"depth":247,"text":229},"PCI DSS penetration testing in Thailand: Requirement 11 network, application, and segmentation testing plus ASV scan support, with deliverables built for your QSA.","md",[258,261,264,267,270],{"q":259,"a":260},"Do you help us define our CDE scope?","Yes, scoping is where a PCI engagement is won or lost. We map the cardholder data environment (CDE) with you: which systems store, process, or transmit cardholder data, which connect to them, where the segmentation boundaries sit, and which of the four Requirement 11 activities the engagement must cover. We align with your assessment timeline too, so testing and retest both land before your QSA needs the evidence.",{"q":262,"a":263},"What does PCI DSS Requirement 11 require you to test?","Under PCI DSS v4.0.1, Requirement 11 drives four testing activities, each on its own cadence: wireless access point (rogue AP) testing quarterly; internal and external network vulnerability scans at least quarterly and after significant change; external and internal penetration testing at least annually and after significant change; and segmentation testing at least annually (every six months for service providers) where segmentation isolates the CDE. Our service covers all four, with the external quarterly scan executed by an approved ASV that we coordinate.",{"q":265,"a":266},"Can you perform our ASV scan?","The external quarterly scan must be run by a PCI-approved Approved Scanning Vendor, and Incognito Lab is not an ASV. We support the process around it: coordinating and scheduling the ASV scans, defining the external scope, interpreting results, guiding remediation, and supporting the rescan until you have a passing attestation.",{"q":268,"a":269},"What is segmentation testing, and why does it matter?","Where segmentation isolates the cardholder data environment (CDE) from other networks, the segmentation controls must be penetration tested to verify that systems declared out of scope genuinely cannot reach the CDE. It matters commercially as well as technically: your entire scope-reduction argument, and the assessment cost that follows from it, rests on segmentation actually holding.",{"q":271,"a":272},"Will the deliverables be accepted by our QSA?","Deliverables are developed to address what the QSA needs: evidence an assessor can accept. Findings are framed against the requirement each one affects, and retest evidence shows that identified issues were corrected and re-verified, which is part of what your assessor expects to see.","2026-10-12","\u002Fpci-dss-penetration-test",{},true,"\u002Fservices\u002Fpci-dss-penetration-test",{"title":6,"description":255},"services\u002Fpci-dss-penetration-test","npvoluyspkLdYkUimEfz3BrMkClf9R9y3_BJXpjMbyU",1791794279980]