PCI DSS Penetration Testing
Plan penetration testing and supporting evidence for the applicable PCI DSS v4.0.1 Requirement 11.4 scope.
PCI DSS v4.0.1 includes penetration-testing requirements under Requirement 11.4. Start by agreeing the cardholder-data environment, connected systems and any segmentation being relied on with your assessor. Testing is scoped to the applicable requirements; it does not replace the full PCI DSS assessment or required vulnerability scanning.
Scope, evidence and next steps.
Agree the assessment boundary
Discuss the cardholder-data environment, connected systems, application and network scope, and the segmentation controls relevant to your assessment.
Separate testing from scanning
Penetration testing assesses exploitable paths within agreed rules of engagement. Vulnerability scans and ASV services are different activities and are not implied by this offer.
Plan remediation evidence
Agree how findings, corrective work and retesting will be documented. The testing agreement defines the included retest work; confirm remaining obligations with your assessor.
Support the review
Discuss a risk-ranked technical report, executive summary, methodology and scope evidence. Informational mapping is not a PCI compliance attestation.
The testing behind this solution.
This program draws on our certified bench across these services.
External Network Penetration Testing
Perimeter testing from the attacker’s vantage point across your internet-facing estate.
Internal Network Penetration Testing
Assumed-breach testing of lateral movement and privilege escalation inside the perimeter.
Web Application Penetration Testing
Manual, exploit-driven testing of your web apps — auth, access control, and business logic that scanners miss.
API Penetration Testing
Deep testing of REST, GraphQL, and gRPC APIs against the OWASP API Security Top 10.
Sources
This page describes scoped testing support for the framework. It is informational control mapping — not an audit, certification or assessor decision.
PCI DSS Penetration Testing — questions buyers ask.
Which PCI DSS version is this page based on?
PCI DSS v4.0.1. Confirm the applicable validation route, requirement scope and timing with your assessor before the engagement.
Does this include ASV scanning or a QSA assessment?
No. This page describes penetration testing. It does not claim TrekShield is a QSA or ASV, or that a penetration test replaces those activities.
Can we scope segmentation testing?
Discuss the segmentation boundaries and evidence your assessor needs during scoping. Authorized methods, access and testing windows must be agreed before work begins.
Prove what an attacker could actually do.
A short scoping call, no obligation.