Home
Solutions
PCI DSS

Solutions · Compliance · PCI DSS

PCI DSS penetration testing that meets Requirement 11.4 and stands up to your QSA

PCI compliance depends on proof that your cardholder data environment holds up to an attacker. ioSENTRIX runs the internal, external and segmentation tests PCI DSS v4.0.1 Requirement 11.4 calls for, maps each result to the requirement, and includes a retest of your fixes so your QSA sees findings tracked to closure.

Scope my PCI pentest See how testing maps to 11.4

StandardPCI DSS v4.0.1 · Requirement 11.4 penetration testing

Who asksYour QSA, acquiring bank and card brands

What you getInternal, external and segmentation results, retest included, mapped to 11.4

Independently rated

★★★★★ 4.9 / 5 on G2 (12 reviews) · 5.0 / 5 on Clutch

Reviewed by Omair Manzoor, Founder & CEO, ioSENTRIX · Updated November 2026Key terms: PCI DSS, Network segmentation, Penetration testing

Trusted by security teams at

01The requirement

Is penetration testing required for PCI DSS?

Yes. PCI DSS v4.0.1 Requirement 11.4 requires internal and external penetration testing at least once every 12 months and after any significant infrastructure or application upgrade or change. If you use segmentation to reduce scope, the segmentation controls are tested every 12 months, or every six months for service providers.

Mandatory?Yes, under Requirement 11.4

For entities that store, process or transmit cardholder data, or can affect its security.

How often?Every 12 months and after change

Segmentation every 12 months; every six months for service providers (11.4.6).

Who tests?Qualified and independent

Internal or external, organizationally independent; not required to be a QSA or ASV.

What is PCI penetration testing?

PCI penetration testing is a penetration test of your cardholder data environment (CDE) and the systems connected to it, performed to a documented methodology so the results can be presented to your QSA as evidence for Requirement 11.4. It proves which weaknesses an attacker could exploit to reach card data, then confirms the fixes with a retest.

What does PCI DSS Requirement 11.4 cover?

A defined methodology (11.4.1), internal testing (11.4.2), external testing (11.4.3), correcting exploitable vulnerabilities and repeating the test (11.4.4), and segmentation testing (11.4.5, plus 11.4.6 for service providers). Read PCI DSS 4.0 penetration testing requirements.

02See it in action

From segmentation test to QSA evidence

How one segmentation control is tested like an attacker would, fixed, retested and handed to your QSA as evidence for Requirement 11.4.

Illustrative

01Requirements this test supports

11.4.1Methodology

11.4.5Segmentation

11.4.2Internal test

11.4.3External test

11.4.4Fix and retest

11.4.6Service providers

02The control, tested

Control: the CDE is isolated from the corporate networkHigh

Finding: flat network route from the corporate VLAN to a CDE host · Requirement 11.4.5

Control in scope

TestFrom a corporate VLAN host, testers probe every CDE range
ProveA database port on a CDE host answers: isolation fails
FixFirewall access control list described for your network team
RetestSame probes now blocked; isolation confirmed
QSASegmentation results and retest in the report your QSA reviews

03Evidence folder for 11.4.5

Methodology, scope and CDE boundary
Finding with proof and impact
Fix guidance and owner
Retest result (11.4.4)
Mapping to Requirement 11.4

Evidence statusEvidence folder open

Segmentation, proven

We test every segmentation control you rely on to reduce scope, from the networks that should not reach the CDE, so the result shows whether isolation actually holds.

Proof your QSA can follow

Each finding carries evidence, risk ranking and the 11.4 requirement it supports, written so a QSA can trace it without a tester in the room.

Corrected, then retested

A retest of your fixes is included, so the report shows exploitable findings corrected and the test repeated, as 11.4.4 expects.

Illustrative example. The network, host and statuses are a composite for explanation only and do not describe any client. Acceptance of evidence is your QSA's decision.

Text version of the exhibit

Control: your network diagram says the cardholder data environment is isolated from the corporate network. The test supports Requirements 11.4.1, 11.4.5, 11.4.2 and 11.4.3.
Test: from a host on the corporate VLAN, testers probe every CDE address range.
Finding: a database port on a CDE host answers, so segmentation fails. The finding is rated High, with evidence of the route.
Fix: we describe a firewall access control list for your network team.
Retest: the same probes are blocked and isolation is confirmed, as Requirement 11.4.4 expects. Service providers repeat this every six months (11.4.6).
Ready for your QSA: the evidence folder (methodology, scope, finding, fix, retest and 11.4 mapping) goes in the report your QSA reviews.

03Requirement to evidence

How does penetration testing map to PCI DSS Requirement 11.4?

This is the mapping we put in your report, so your QSA can trace each piece of evidence back to the requirement it supports.

Requirement	What it asks	What ioSENTRIX tests	Evidence for your QSA
11.4.1Methodology	A defined, documented methodology: industry-accepted approach, whole CDE perimeter and critical systems, inside and outside, segmentation, application and network layers.	Our written penetration testing methodology, aligned with NIST SP 800-115 and the OWASP testing guides, applied to your scope.	Methodology document and scope
11.4.2Internal test	Internal penetration testing at least once every 12 months and after significant change.	Internal network penetration test of CDE and connected systems.	Internal results with proof
11.4.3External test	External penetration testing at least once every 12 months and after significant change.	External perimeter, exposed services and payment web apps and APIs.	External results with proof
11.4.4Correct and retest	Exploitable vulnerabilities corrected according to your risk ranking, and testing repeated to verify the corrections.	Retest of your fixes, included in the engagement.	Retest results per finding
11.4.5Segmentation	If segmentation isolates the CDE, test it at least once every 12 months and after changes, covering every control in use.	Tests from each out-of-scope network that confirm the CDE is isolated. See network segmentation.	Segmentation results by network
11.4.6Service providers	Service providers only: segmentation tests at least once every six months and after changes.	The same segmentation tests on a six-month cadence, or through PTaaS.	Six-monthly segmentation results
6.4.3 · 11.6.1Payment page scripts	Manage scripts loaded on payment pages, and detect unauthorized changes to those scripts and to security-impacting HTTP headers.	Payment page review during web app testing: third-party scripts, injection paths and headers an attacker could abuse.	Script and header findings (your inventory and detection stay yours)
11.3.2External scans	External vulnerability scans at least once every three months by a PCI SSC Approved Scanning Vendor.	Not performed by ioSENTRIX. We can review and validate scan findings during the pentest.	ASV only; ioSENTRIX is not an ASV

Requirement wording summarized from PCI DSS v4.0.1. ioSENTRIX is not a PCI Approved Scanning Vendor (ASV) or Qualified Security Assessor (QSA): we perform the penetration testing and write reports your QSA can review. Your QSA decides what evidence is sufficient.

04Timing

When should you run a PCI DSS penetration test?

Early enough to fix and retest before your assessment, then again every 12 months and after significant change.

Scope the CDE
Confirm the cardholder data environment, connected systems and critical systems.
Written scope
Map segmentation
List every control that isolates the CDE and each network that should not reach it.
Segmentation map
Test
Internal, external, application and segmentation testing by certified engineers.
Manual testing
Fix and retest
Fix guidance for each finding, then a retest of your fixes (11.4.4).
Retest included
QSA review
We answer your QSA's questions about the report and method.
Evidence pack
Repeat
Every 12 months and after any significant infrastructure or application change.
Next cycle

MerchantsEvery 12 months

Internal, external and segmentation tests at least once every 12 months and after significant changes or changes to segmentation.

Service providersSegmentation every six months

The same internal and external cadence, plus segmentation tests at least once every six months and after changes (11.4.6).

05Evidence pack

What's in a PCI DSS penetration test evidence pack?

What your QSA, acquiring bank and customers' security teams ask for, in one place.

Methodology
The documented approach Requirement 11.4.1 asks for, matched to your environment.
NIST SP 800-115OWASP
Scope and CDE reference
Systems, networks, dates and testers, tied to your CDE and network diagrams.
Findings with proof
Each finding with evidence, risk ranking, business impact and the steps to reproduce it.
Retest letter
Fixes retested and recorded, so exploitable findings are shown corrected (11.4.4).
Segmentation results
Results from each out-of-scope network, every 12 months or six for service providers.
11.4.511.4.6
Requirement mapping
Each result mapped to the 11.4 requirement it supports.
11.4.111.4.211.4.311.4.4

06Independently verified

★★★★★

“Unlike other providers, Omair and his team truly dive deep into our infrastructure, delivering findings that go well beyond the surface level.”

Jesus B.Cybersecurity Manager, Banking · Verified G2 review ↗

★★★★★

“The team at ioSENTRIX is professional and highly skilled at their craft.”

Awwab A.SVP, Chief Information Security Officer · Verified G2 review ↗

4.9 / 5 on G212 reviews · High Performer, Fall 2026↗

5.0 / 5 on ClutchPremier Verified↗

Penetration Testing Solution of the Year2026 CyberSecurity Breakthrough Awards↗

CREST-accredited firmPenetration testing↗

ISO/IEC 27001 certifiedOur own information security management system↗

SOC 2 Type 2 attestedOur own controls, independently examined↗

07How we help

Services that support a PCI DSS program

From the first scoping call to six-monthly segmentation tests.

Case study · Hospitality

Network segmentation and password weaknesses found in a hotel room automation system

Real-world attack scenarios against a guest-facing tablet system, without source code
Critical weaknesses in network segmentation and password policies identified
Remediation plan to improve segmentation and protect management and billing systems

Read the case study

Services for PCI DSSNetwork penetration testingInternal, external and segmentation testing of the CDE.Web application and API penetration testingCheckout, payment pages and APIs, typically 1–2 weeks.Cloud security assessmentAWS, Azure and GCP configuration review around cloud-hosted CDEs.Penetration testing as a service (PTaaS)Testing and retests on one platform, for six-monthly cadences.Application security as a service (ASaaS)Secure development support for payment software.Banking and fintechTesting for banks, lenders and payment companies.E-commerce and retailStorefront, checkout and in-store systems.

08Insights

Read before you scope your PCI test

July 7, 2026

PCI DSS 4.0 Penetration Testing: New Requirements for 2026

Learn the PCI DSS 4.0 penetration testing requirements for 2026, including internal and external testing, segmentation testing, remediation, retesting, and CDE scope.

May 30, 2025

Comprehensive Payment System Security: Application & Network Penetration Testing Solutions by ioSENTRIX

Protect your payment ecosystems with ioSENTRIX’s expert application and network penetration testing. Identify vulnerabilities and safeguard sensitive transaction data to protect your digital payment systems.

January 20, 2025

Implementing Secure SDLC Practices to Meet PCI DSS Standards

Learn how to implement Secure SDLC practices to meet PCI DSS standards and protect payment data.

October 4, 2024

How To Prevent POS (Point-of-Sale) Hacking?

This article explains various methods to enhance the security of your kiosks. These techniques focus on functional adjustments that improve kiosk security.

09FAQ

PCI DSS penetration testing questions

Short answers to what merchants, service providers and QSAs ask us most.

Ask us something else

Is penetration testing required for PCI DSS?

Yes. PCI DSS v4.0.1 Requirement 11.4 requires internal (11.4.2) and external (11.4.3) penetration testing at least once every 12 months and after any significant infrastructure or application upgrade or change, following a documented methodology (11.4.1). Exploitable vulnerabilities found must be corrected and the testing repeated to verify the corrections (11.4.4).

How often is PCI DSS segmentation testing required?

If you use segmentation to isolate the cardholder data environment (CDE), Requirement 11.4.5 requires penetration tests of the segmentation controls at least once every 12 months and after any changes to segmentation controls or methods. Service providers must test them at least once every six months and after any changes (11.4.6).

Is ioSENTRIX a PCI ASV or QSA?

No. ioSENTRIX is not a PCI Approved Scanning Vendor (ASV) or Qualified Security Assessor (QSA). We perform the penetration testing required by PCI DSS v4.0.1 Requirement 11.4 and write reports your QSA can review. Quarterly external scans under Requirement 11.3.2 must come from an ASV.

Does a PCI penetration tester have to be a QSA?

No. Requirements 11.4.2, 11.4.3 and 11.4.5 allow a qualified internal resource or a qualified external third party, as long as the tester is organizationally independent. The tester is not required to be a QSA or ASV.

What is the difference between an ASV scan and a PCI penetration test?

An ASV scan (Requirement 11.3.2) is an external vulnerability scan performed at least once every three months by a PCI SSC Approved Scanning Vendor. A penetration test (Requirement 11.4) follows a documented methodology, covers the CDE perimeter and critical systems from inside and outside the network, tests segmentation, and includes application-layer and network-layer testing. Most entities need both.

What should a PCI DSS penetration test report include?

Enough for your QSA to trace each test back to Requirement 11.4: the methodology, scope and CDE boundary, dates and testers, findings with evidence and risk ranking, segmentation results, and the remediation and retest results that Requirement 11.4.1 asks you to retain.

How long does a PCI penetration test take?

A web application penetration test typically takes 1–2 weeks. Internal, external and segmentation testing depends on the size of your CDE. After a short scoping call you receive a written scope and timeline before testing starts, so you can plan it before your assessment.

Ready when you are

Get Requirement 11.4 evidence your QSA can review

Tell us whether you are a merchant or service provider, how your CDE is segmented and when your assessment is due. We will help you scope the right test.

Written scope and timeline before testing starts
Retest of fixes included
Report mapped to PCI DSS v4.0.1 Requirement 11.4

Scope your PCI DSS penetration test

Takes about a minute.

PCI DSS penetration testing that meets Requirement 11.4 and stands up to your QSA

Is penetration testing required for PCI DSS?

What is PCI penetration testing?

What does PCI DSS Requirement 11.4 cover?

From segmentation test to QSA evidence

Segmentation, proven

Proof your QSA can follow

Corrected, then retested

How does penetration testing map to PCI DSS Requirement 11.4?

When should you run a PCI DSS penetration test?

Scope the CDE

Map segmentation

Test

Fix and retest

QSA review

Repeat

What's in a PCI DSS penetration test evidence pack?

Methodology

Scope and CDE reference

Findings with proof

Retest letter

Segmentation results

Requirement mapping

Services that support a PCI DSS program

Network segmentation and password weaknesses found in a hotel room automation system

Read before you scope your PCI test

PCI DSS penetration testing questions

Is penetration testing required for PCI DSS?

How often is PCI DSS segmentation testing required?

Is ioSENTRIX a PCI ASV or QSA?

Does a PCI penetration tester have to be a QSA?

What is the difference between an ASV scan and a PCI penetration test?

What should a PCI DSS penetration test report include?

How long does a PCI penetration test take?

Get Requirement 11.4 evidence your QSA can review