External Network Penetration Testing
The CDE perimeter and internet-facing systems (Req. 11.4.3).
Compliance
PCI DSS Penetration Testing
Unlike most frameworks, PCI DSS explicitly requires penetration testing. We test to Requirement 11.4 and document it the way assessors expect.
In plain English
What PCI DSS expects from security testing
PCI DSS is one of the few security standards that explicitly requires penetration testing. Requirement 11.4 sets out what the test must cover, how often it must run and what happens to the findings.
In short: you need a documented methodology, internal and external tests at least once every 12 months and after significant changes, correction and retesting of exploitable findings, and, if you use segmentation to reduce scope, proof that the segmentation works. Service providers must test segmentation every six months.
The current version is PCI DSS v4.0.1, published in June 2024 as a limited revision of v4.0. Version 4.0 was retired at the end of 2024. Your assessor makes the final call on whether your testing meets the requirement.
Evidence
How our report supports it
- A documented methodology that addresses the elements Requirement 11.4.1 asks for
- Separate internal and external testing results, mapped to 11.4.2 and 11.4.3
- Segmentation test results showing whether out-of-scope networks are isolated from the CDE
- Retest evidence that exploitable findings were corrected, as 11.4.4 requires
- Dates, scope and tester independence stated clearly for your QSA or self-assessment
Scope
Recommended scope
Every environment is different. This is where we usually start, and we'll confirm it on a scoping call.
Internal Network & Active Directory Testing
Internal testing of the CDE and connected systems, plus segmentation testing (Req. 11.4.2 and 11.4.5).
Web Application Penetration Testing
Payment pages and applications that store, process or transmit card data.
API Penetration Testing
Payment and card-data APIs, as part of application-layer testing.
Timing
When to test
Schedule testing well before your assessment date, with time for fixes and a retest.
Retest after significant changes, not just annually. Requirements 11.4.2 and 11.4.3 call for both.
Service providers using segmentation need segmentation tests every six months. Put both dates in the calendar.
Confirm your CDE boundary and segmentation design before testing, so the scope matches what your assessor will review.
FAQ
PCI DSS testing questions
Which version of PCI DSS do you test against?
PCI DSS v4.0.1, the current version. It replaced v4.0, which was retired on 31 December 2024. v4.0.1 was a limited revision, so penetration testing requirements are the same as in v4.0.
Do we need both internal and external testing?
Yes. Requirements 11.4.2 and 11.4.3 cover internal and external testing separately, each at least every 12 months and after significant changes.
What is segmentation testing?
If you use network segmentation to keep systems out of PCI scope, you have to prove it works. We test from out-of-scope networks to confirm they can't reach the cardholder data environment.
Does the tester need to be independent?
PCI DSS requires testing by a qualified internal resource or a qualified external third party, with organisational independence from the systems being tested. An external firm such as ours meets the independence point by default.
Does a penetration test make us PCI DSS compliant?
No. Compliance is validated through your PCI DSS assessment, by a Qualified Security Assessor, an internal assessor or a self-assessment questionnaire. Our penetration test reports are evidence for that assessment.
Guides
Pentest vs Vulnerability Scan: What's the Difference?
Vulnerability scans and penetration tests both find security problems, but they answer different questions. Learn when each fits and why scans fall short.
How to Read a Penetration Test Report
How to read a penetration test report: what severity ratings mean, how to judge the evidence, which findings to fix first, and how the retest closes the loop.
Services for this framework
External Network Penetration Testing
Testing of everything you expose to the internet, from forgotten admin panels to VPN gateways, with every finding manually validated.
Internal Network & Active Directory Testing
Assumed-breach testing of your internal network and Active Directory, delivered remotely, to show how far one compromised laptop could go.
Web Application Penetration Testing
Manual testing of your web app's authentication, access control and business logic, the places scanners can't reach.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.