Penetration testing vs vulnerability scanning vs ASV scans: what PCI DSS actually requires

“We already run a vulnerability scan every quarter. Isn’t that a penetration test?” We hear this question often. The answer is no, and PCI DSS treats them as separate requirements. This article explains the difference between internal vulnerability scans, external ASV scans and penetration tests, and what PCI DSS v4.0.1 asks for under requirements 11.3 and 11.4.

Three different activities

• A vulnerability scan is an automated check for known weaknesses, such as missing patches or insecure configurations. It is broad and repeatable, but it does not try to break in.
• An ASV scan is an external vulnerability scan performed by an Approved Scanning Vendor. It looks at your systems the way the internet sees them.
• A penetration test is a manual, goal-driven exercise. A qualified tester tries to exploit weaknesses, chain them together and reach sensitive systems, the way a real attacker would.

Scans tell you what might be wrong. A penetration test tells you what an attacker could actually do with it.

Requirement 11.3: vulnerability scanning

Internal scans. Internal vulnerability scans are required quarterly. Under v4, they must be authenticated scans, meaning the tool has to be able to authenticate to systems so it can see more than the surface. High-risk and critical vulnerabilities must be resolved and rescanned. Other vulnerabilities are addressed on a timeline set by a targeted risk analysis. Internal scans are also required after significant changes.

External scans. External scans are also required quarterly and after significant changes. The quarterly external scans must be performed by a PCI SSC Approved Scanning Vendor. The Council describes an ASV as an organization with tools and services to conduct external vulnerability scanning to validate adherence with the external scanning requirements of PCI DSS Requirement 11.3.2. A passing result is required, which usually means fixing findings and rescanning until the result is clean.

Requirement 11.4: penetration testing

Requirement 11.4 asks for a documented penetration testing methodology and regular testing. In summary:

• Methodology. Testing must follow an industry-accepted approach. Practitioners commonly align with frameworks such as NIST SP 800-115, OWASP testing guides, PTES or OSSTMM.
• Coverage. Both external testing (from the internet) and internal testing (from inside the network) are required, covering the CDE perimeter and critical systems, at both the network and application layers.
• Frequency. At least once every 12 months and after any significant upgrade or change to infrastructure or applications.
• Who performs it. A qualified internal resource or a qualified external third party, with organizational independence from the systems tested. The tester does not need to be a QSA or an ASV.
• Remediation. Exploitable vulnerabilities must be corrected and the fix verified by retesting.
• Segmentation. If you use segmentation to reduce scope, requirements 11.4.5 and 11.4.6 add specific segmentation tests. We cover these in a separate article.

The Council’s Penetration Testing Guidance information supplement remains a useful reference for scoping, methodology and reporting.

Side by side

• Internal scan: automated; quarterly and after significant change; performed by qualified personnel.
• External ASV scan: automated; quarterly and after significant change; quarterly scans performed by an Approved Scanning Vendor.
• Penetration test: manual; at least annually and after significant change; performed by a qualified, independent tester.

Common mistakes

• Submitting an automated scan report as a penetration test.
• Missing a quarter of ASV scans, which leaves a gap that is hard to explain later.
• Testing only the external perimeter and skipping internal testing.
• Not retesting after fixing findings, so there is no evidence the fix worked.
• Forgetting to test after a significant change such as a new firewall, a data centre move or a major application release.

Beyond compliance

Even outside PCI DSS, the combination makes sense: scans for continuous hygiene, and penetration tests to understand real-world exposure. Many organizations preparing for ISO 27001 or SOC 2 use the same approach.

Learn more on our security testing page. Ubitrak provides penetration testing and ASV scans, and supports clients through PCI DSS assessments. See our PCI DSS overview for more, or contact us to scope a test.

Sources

• SecurityMetrics: A guide to new requirements in PCI DSS 4.0.1
• PCI SSC: Approved Scanning Vendors
• PCI SSC Information Supplement: Penetration Testing Guidance v1.1
• BreachLock: PCI DSS 4.0 and penetration testing