HackproofHacks
Cardholder data security

PCI DSS Penetration Testing

Unlike most standards, PCI DSS is explicit: it requires penetration testing. Requirement 11 mandates internal and external penetration tests at least annually and after significant changes, plus segmentation testing to prove your cardholder data environment is genuinely isolated. This is not a nice-to-have; it is a line item your QSA will check.

This engagement is built to satisfy that requirement cleanly, with the methodology and evidence your assessor expects, so PCI does not become the thing that holds up your compliance.

Why PCI DSS makes penetration testing non-negotiable

PCI DSS Requirement 11.4 (11.3 in older versions) explicitly requires penetration testing of the cardholder data environment, from both outside and inside, following an industry-accepted methodology. If you handle card data, there is no interpretation to debate: the test must happen, and it must be documented.

Segmentation is the other half. Most organizations reduce their PCI scope by isolating the cardholder data environment from the rest of the network. PCI requires you to prove that isolation actually holds by testing it, because a segmentation gap silently pulls your entire network back into scope and invalidates the assumption your compliance rests on.

A failed or missing penetration test is one of the most common reasons a PCI assessment stalls. Getting a clean, methodology-driven test done ahead of your QSA engagement keeps the assessment on schedule and avoids an expensive last-minute scramble.

What we test

External penetration test

All internet-facing components of the cardholder data environment, probing for exploitable vulnerabilities that could give an outside attacker a foothold toward card data.

Internal penetration test

Testing from inside the network to model an attacker who already has a foothold, checking whether they can pivot toward systems that store, process, or transmit cardholder data.

Segmentation testing

Explicit verification that the controls isolating the cardholder data environment from out-of-scope networks actually prevent access, as PCI requires.

Application-layer testing

The web applications and APIs handling payment flows, tested for injection, broken access control, and the logic flaws that let an attacker tamper with transactions.

The report you receive

The report is structured for your QSA and your engineers. It contains:

  • An executive summary and a clear statement that the test followed an industry-accepted methodology, as PCI requires.
  • Separate external, internal, and segmentation results, matching how Requirement 11 is assessed.
  • Findings rated by severity with reproduction steps, impact, and remediation.
  • An explicit mapping to the relevant PCI DSS requirements.
  • A retest and updated report confirming remediation before your assessment.

Findings we commonly report in this category

Segmentation gaps

A route from an out-of-scope network into the cardholder data environment that was assumed to be blocked, which would expand PCI scope dramatically if left unaddressed.

Payment-flow logic tampering

Price, quantity, or amount values that can be manipulated client-side because the server trusts them, allowing an attacker to alter what they pay.

Storage of prohibited data

Full card numbers or sensitive authentication data persisted where PCI forbids it, often in logs or debug output.

Exposed administrative interfaces

Management panels for in-scope systems reachable from untrusted networks, a direct path toward cardholder data.

Frequently asked questions

Does PCI DSS actually require penetration testing?

Yes, explicitly. Requirement 11.4 (11.3 in older versions) mandates internal and external penetration testing at least annually and after significant changes, plus segmentation testing. It is one of the few standards that names penetration testing directly.

What is segmentation testing and why does it matter?

Segmentation testing proves that the controls isolating your cardholder data environment from the rest of your network actually work. It matters because a single gap pulls your whole network into PCI scope, so PCI requires you to verify the isolation rather than assume it.

How often do we need a PCI penetration test?

At least once every twelve months and after any significant change to the cardholder data environment. Segmentation testing is required at least annually, and more frequently for service providers.

Will the report satisfy our QSA?

Yes. It follows an industry-accepted methodology, separates external, internal, and segmentation results, maps findings to PCI requirements, and includes a retest, which is exactly what a QSA needs to sign off Requirement 11.

Related services

Ready to scope your pci dss penetration testing?

Book a free 30-minute scoping call. We agree the scope, timeline, and a fixed price up front — no obligation, and no surprises for your deadline.