All articles
ComplianceSeptember 16, 2026 · 7 min read

Does PCI DSS Require Penetration Testing?

By PentestPilot · Offensive Security Team

Yes. Unlike ISO 27001, which never uses the words "penetration testing" anywhere in the standard, PCI DSS names it directly. Requirement 11.4 of PCI DSS v4.0.1 spells out exactly what kind of testing you need, how often, and what a tester has to be independent of. There's no ambiguity to argue your way around here.

That specificity is also where most companies trip up. Requirement 11.4 isn't one line, it's seven sub-requirements, and passing an audit means satisfying all of them, not just producing a report with "penetration test" in the title.

What Requirement 11.4 actually says

Sub-requirementWhat it coversMinimum frequency
11.4.1Documented testing methodology, covering the full cardholder data environment perimeter and critical systems, both application and network layerOngoing, used for every test
11.4.2Internal penetration testEvery 12 months, plus after any significant change
11.4.3External penetration testEvery 12 months, plus after any significant change
11.4.4Remediate exploitable findings and retest to confirm they're fixedEvery time a test finds something exploitable
11.4.5Segmentation testing, if you use segmentation to isolate your cardholder data environmentEvery 12 months, plus after any change to segmentation
11.4.6Segmentation testing for service providers specificallyEvery 6 months, plus after any change to segmentation
11.4.7Multi-tenant service providers must support their customers' own external testing under 11.4.3Tied to the customer's cycle

Notice 11.4.6 is stricter than 11.4.5. If you're a service provider, meaning you process, store, or transmit cardholder data on behalf of other businesses, you're on a six-month segmentation testing clock, not twelve. A lot of fintechs providing payment infrastructure to other companies fall into this category without realizing the shorter cadence applies to them.

The mix-up that gets people in trouble: scanning vs. testing

Requirement 11.3 covers vulnerability scanning. Requirement 11.4 covers penetration testing. They are not the same requirement, they don't satisfy each other, and QSAs see this confusion constantly.

Vulnerability scanning is largely automated. It runs on a fixed schedule (quarterly, for external scans, done by an Approved Scanning Vendor) and checks for known issues against a signature database. Penetration testing under 11.4 is a manual process. A person actively tries to exploit what they find, chain smaller issues together, and prove real impact, the same distinction that matters for ISO 27001's A.8.29. A clean quarterly scan report does not check the 11.4 box, no matter how thorough the scan was.

Who's allowed to run the test

11.4.2 and 11.4.3 both require the tester to have organizational independence, meaning they can't test systems they're also responsible for managing or maintaining. Your own infrastructure team running a test on their own environment doesn't satisfy this, even if they're technically skilled enough to find real issues.

The tester doesn't have to be a QSA or an ASV specifically for the pentest itself. What matters is qualification and independence, whether that's an internal team with no operational responsibility for the systems in scope, or a third party.

What "significant change" actually triggers a retest

PCI DSS deliberately doesn't give you a strict list here. A new payment integration, a major infrastructure migration, opening up a new API endpoint that touches cardholder data, these are the kinds of changes that should trigger a fresh test rather than waiting for your annual date to roll around. Treating "significant change" as "basically never happens" is how companies end up testing infrastructure that looked nothing like this a year ago.

Building in time to actually fix things

11.4.4 requires you to correct exploitable findings and retest to confirm the fix. That retest isn't optional and it isn't a formality, if a critical finding from your annual test is still open when your assessor reviews your evidence, you've got a real problem. Leave enough runway between your test date and your assessment, ideally a couple of months, to actually remediate and get a documented retest done rather than scrambling the week before.

PCI assessment coming up?

Every PCI DSS penetration test PentestPilot runs is manual, delivered by internationally certified testers with no operational stake in the systems being tested, which is exactly the independence 11.4.2 and 11.4.3 require. We test on a retainer or on-demand basis, so you're not stuck fitting your annual test and every post-change retest into a single once-a-year vendor booking. If your PCI assessment is coming up, get in touch and we'll scope it against your actual CDE.

More from the blog
Fintech & ComplianceSeptember 16, 2026 · 6 min read

Penetration Testing for Nigerian Fintechs: What CBN and NDPR Actually Require

CBN's framework demands an independent annual pentest and board-visible remediation, while NDPR covers customer data. Here's how deep a real test needs to go and how to vet a pentest company.

Read article
ISO 27001September 16, 2026 · 6 min read

ISO 27001 Penetration Testing: What the Standard Actually Requires

ISO 27001:2022 never says "penetration testing," yet auditors expect one anyway. Here's what Annex A controls A.8.8 and A.8.29 actually require, and what evidence survives a Stage 2 audit.

Read article
Security ResearchSeptember 16, 2026 · 13 min read

ERPNext Privilege Escalation: How a Low-Privilege Account Can Take Over the Whole System

A low-privilege ERPNext account was enough to become the Administrator — via server-side template injection. Here's the full chain, how Frappe fixed it, and what to do if you run ERPNext.

Read article
ComplianceSeptember 16, 2026 · 7 min read

Does SOC 2 Require Penetration Testing?

SOC 2 doesn't spell out penetration testing as a requirement, but CC4.1 names it directly and CC7.1 expects evidence your detection works. Here's what auditors look for and how timing fits a Type II window.

Read article
Penetration TestingSeptember 16, 2026 · 7 min read

The Ultimate Guide to Penetration Testing Services: Types, Process, & Benefits

Web, network, cloud, mobile, and social engineering — the key types of penetration testing, the five-step process, and why regular testing pays for itself.

Read article
Penetration TestingSeptember 16, 2026 · 6 min read

How to Evaluate the Best Penetration Testing Services for Your Business

Five criteria for evaluating a penetration testing vendor, the questions to ask before hiring, and the red flags that expose an automated scan in disguise.

Read article
ComplianceSeptember 16, 2026 · 7 min read

Top Compliance Scanning Tools vs. Manual Pentesting: What You Need for Audits

Automated scanners and manual pentesting serve different purposes. Here's how they compare, the top compliance tools, and what auditors actually require.

Read article
Threat HuntingSeptember 16, 2026 · 7 min read

Why Modern Cybersecurity Monitoring Services Require Active Threat Hunting

Passive monitoring alone leaves blind spots. Here's why modern SOC and MDR services must combine 24/7 detection with human-led, hypothesis-driven threat hunting.

Read article
Penetration TestingSeptember 16, 2026 · 7 min read

External Penetration Testing Guide: How to Secure Your Public-Facing Assets

External penetration testing simulates a remote attacker breaching your perimeter. Here's how it works, the assets it targets, and the vulnerabilities it most often finds.

Read article
Penetration TestingSeptember 16, 2026 · 8 min read

API Penetration Testing Checklist: How to Secure REST & GraphQL Endpoints

APIs expose backend logic directly, and automated scanners miss the authorization flaws that matter. Here's a checklist for securing REST and GraphQL endpoints.

Read article