If you’re preparing for a PCI-DSS assessment, you already know penetration testing is part of the deal. But not all pentests are created equal — and not every provider actually helps you get through the process without confusion or rework.
At Asteros, we help businesses meet PCI-DSS Requirement 11.3 with penetration testing that’s clear, compliant, and actually useful to your team — not just the auditor.
Here’s what that looks like.
What PCI Requires (and What That Means for You)
PCI-DSS requires:
- External and internal penetration testing at least annually and after significant changes (Requirement 11.3)
- Segmentation testing every six months if you’re isolating your Cardholder Data Environment (CDE) (Requirement 11.4.5)
This isn’t optional — and vulnerability scans don’t meet the requirement.
A vulnerability scan is not a penetration test. PCI expects manual exploitation, validation of risks, and clear evidence of your testing process.
How We Run PCI Penetration Tests
We use automated tools for breadth, but rely on manual testing for depth — where the real risk lives.
We follow the Penetration Testing Execution Standard (PTES) and apply human logic to:
- Chain findings together to show impact
- Simulate realistic attacker behavior
- Uncover risks that scanners miss
Our reporting uses the OWASP Risk Rating Methodology, so you get severity ratings based on actual likelihood and impact — not just CVSS numbers.
We also tailor deliverables for both your QSA and your internal team.
Segmentation Testing
If you’re reducing PCI scope by segmenting your network, PCI-DSS requires segmentation testing every six months to prove your boundaries are holding.
This isn’t just ping tests or basic port scanning. We simulate lateral movement from out-of-scope zones into the CDE and validate whether your segmentation controls actually block access.
Segmentation testing is one of the most commonly overlooked parts of PCI — and one of the most common reasons assessments get delayed. We’ll make sure you get it right the first time.
Does My Web App Need to Be Tested?
If your application:
- Accepts or processes cardholder data
- Uses hosted payment fields (e.g. embedded iFrames or scripts)
- Or connects to systems within the CDE
…it may be in scope for PCI.
We’ll help you figure that out during scoping. If testing is required, we use the OWASP ASVS to ensure a thorough, standards-based review of your app.
What You’ll Get
✅ External and internal penetration testing
✅ Segmentation testing (every 6 months if needed)
✅ Manual testing with real-world attacker methodology
✅ Reporting for both auditors and engineers
✅ Risk ratings, steps to reproduce, and remediation guidance
✅ Free retesting of remediated issues
We don’t outsource. You’ll work directly with experienced testers who understand PCI and know how to move fast without cutting corners.
Let’s Make This Simple
You don’t need a PDF farm that dumps scanner results and disappears. You need a team that knows what QSAs look for — and helps your team stay ahead of real threats.
If you’re ready for a PCI pentest you can actually trust, let’s chat 👇.