PCI DSS penetration testing companies: compared

Companies that store, process or transmit card data, and service providers that support them, need penetration tests under PCI DSS. This page filters the PentestCompare dataset to providers whose pages mention PCI DSS. Rows run A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it. A PCI mention on a provider's page does not make the provider or its report acceptable to your assessor.

What does PCI DSS ask of a penetration test?#

PCI DSS v4.0.1 puts penetration testing under requirement 11.4. PCI SSC published v4.0.1 on 11 June 2024 as a limited revision with no added or deleted requirements, and v4.0 retired on 31 December 2024 (PCI SSC blog).

We do not repeat the requirement text here. The PCI DSS penetration testing requirements guide on penetrationtestservices.com explains requirement 11.4 line by line. Two points from PCI SSC's own summary of changes matter when you choose a provider. Requirement 11.4.1 asks for a defined, documented and implemented methodology, with results retained for at least 12 months. Requirement 11.4.7 is new for multi-tenant service providers, who must support their customers' external penetration tests (PCI SSC summary of changes).

Who needs a PCI penetration test, and when?#

You need one when your cardholder data environment (CDE) falls under PCI DSS validation at a level that includes requirement 11.4. Ask your acquirer which validation level applies. Your Qualified Security Assessor (QSA) or the self-assessment questionnaire you use tells you which requirements apply.

Plan the test before the assessment window, with time left to fix findings and retest. A report that lists open critical findings gives your assessor little to accept.

PCI DSS keeps scanning and penetration testing apart. Our guide to pentest versus vulnerability scan shows the split between requirement 11.3 and 11.4. SOC 2 buyers should read the SOC 2 penetration testing providers guide, because audit evidence works differently there.

What should you ask PCI pentest providers?#

Ask for written answers to these six checks.

1. Is the tester organizationally separate from the team that manages the systems under test? PCI SSC guidance says it must be.
2. Does the quote cover the whole CDE perimeter and critical systems, from outside and from inside?
3. Does it include application-layer and network-layer testing?
4. Does it include a segmentation test, if segmentation reduces your PCI scope?
5. Does the retest after fixes appear in the quote, with a date window?
6. Has your assessor seen the scope statement and a sample report?

The segmentation question matters most. A provider that tests the web application only leaves the segmentation requirement open. Ask for the segmentation method in plain words: which networks the tester starts from and which targets it tries to reach.

What drives the price?#

Scope drives price: the number of in-scope applications and networks, internal and external testing, and segmentation tests. The Published price column shows which providers list prices. As of 9 November 2026 the PCI filter includes both providers with listed prices and many that quote on request.

For price ranges and drivers, see our penetration testing cost guide. Add segmentation testing and internal network testing to the scope when you compare quotes, because a quote for one web application costs less than a quote for a CDE.

How do you read the table?#

A "PCI DSS" mention means the provider's pages talk about PCI DSS work. It is a keyword match from the provider's own text. It is not a PCI SSC listing.

PCI SSC separates roles. A Qualified Security Assessor (QSA) assesses compliance, and an Approved Scanning Vendor (ASV) runs external scans. The PCI SSC Penetration Testing Guidance has no approved-pentester list. Examples from the dataset show how providers state roles. Schellman states that it is a QSA (Schellman). Halo Security lists PCI SSC Approved Scanning Vendor status, certificate 5078-01-11 (Halo Security). Check these claims on the PCI SSC lists before you rely on them.

On certifications, the PCI guidance says the named examples (OSCP, CEH, GIAC, CREST, CHECK) "are not required certifications", and that qualifications "cannot be met by certifications alone". Ask for the tester's engagement experience as well.

What does an assessor check in the pentest report?#

PCI SSC publishes outlines for a report and a retest report. It says they "are only suggested outlines and do not define specific reporting requirements for PCI DSS penetration tests" (PCI SSC guidance). Your assessor decides what is enough. Expect these items to come up:

• The scope and the method, including internal and external testing and application and network layers.
• Evidence for each finding: the request, the response and the effect.
• Segmentation test results, if you use segmentation.
• A retest section that shows the original finding, the retest date and the result.
• The tester's independence and qualifications.

Send your assessor the provider's sample report and scope statement before you buy. Use the pentest provider question list to cover the rest, and the scoping checklist to set roles, networks and limits.