Most breaches still start with a known weakness: scanning and patching under PCI DSS 4.0.1

Attackers do not need to be sophisticated when known weaknesses stay open. In its 2026 Data Breach Investigations Report, Verizon found that “nearly a third (31%) of all breaches start with vulnerability exploitation”, making it the top entry point (Verizon, 2026). The same report found that only 26% of critical vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalogue were fully remediated during 2025, and that the median time to fully remediate rose to 43 days (Help Net Security summary).

PCI DSS v4.0.1 treats this as a cycle, not a quarterly chore. Four requirements fit together: identify and rank, patch, scan, and rescan.

1. Identify and rank (requirement 6.3.1)

You must identify new vulnerabilities “using industry-recognized sources for security vulnerability information” and assign each a risk ranking. At a minimum, the ranking must identify everything high-risk or critical to your environment, and it covers bespoke, custom and third-party software (requirement text).

In practice, that means subscribing to vendor advisories and national CERT alerts, and checking the CISA KEV catalog, which lists vulnerabilities confirmed to be exploited in the wild. A vulnerability on that list deserves a high ranking even if its base score looks moderate.

2. Patch on a clock (requirement 6.3.3)

Critical or high-security patches must be installed “within one month of release”. All other applicable patches follow a time frame you define, for example within three months (requirement text).

The one-month clock starts at the vendor’s release, not when your team notices it. Systems that can no longer be patched because the vendor stopped supporting them are a standing finding. Plan their replacement.

3. Scan from the inside (requirement 11.3.1)

Internal vulnerability scans are required at least once every three months. High-risk and critical vulnerabilities must be resolved and confirmed by rescans. The scan tool must be kept up to date, and scans are performed by qualified personnel with organizational independence (requirement text).

Two newer requirements, mandatory since 2025-03-31, raise the bar:

• 11.3.1.1: vulnerabilities below high or critical are addressed based on your targeted risk analysis, with rescans as needed.
• 11.3.1.2: internal scans must be authenticated. Systems that cannot accept credentials are documented, and scanning accounts are managed like any privileged account.

Authenticated scans see installed software and missing patches that an unauthenticated scan simply cannot. Expect more findings the first time. That is the point.

4. Scan from the outside (requirement 11.3.2)

External scans are also required at least once every three months, by a PCI SSC Approved Scanning Vendor, until the ASV Program Guide’s criteria for a passing scan are met. Both internal and external scans are also required after any significant change (11.3.1.3 and 11.3.2.1).

Where organizations slip

• Scanning without a risk-ranking process, so nobody knows which findings must be fixed first.
• Fixing without rescanning, so there is no evidence the fix worked.
• A missed quarter. Four passing scans per year are expected, and a gap is hard to explain at assessment time.
• Scanning only what is in the asset inventory, while the inventory itself is out of date.
• Treating “significant change” as rare, when cloud and network changes happen weekly.

Scans are not penetration tests

A scan checks whether a door looks unlocked. It does not try to open it. PCI DSS requires both, under separate requirements. See our comparison of scans and penetration tests and how a penetration test runs.

Ubitrak delivers ASV scans and internal scanning, tracked in the Audit Portal, and Accel PCI helps smaller merchants keep the quarterly cycle on schedule. Visit our security testing page or contact us.

Sources

• Verizon: Vulnerability exploitation top breach entry point, 2026 DBIR finds (2026-05-19)
• Help Net Security: Lessons from the Verizon 2026 DBIR
• CISA: Known Exploited Vulnerabilities Catalog
• Microsoft Learn: PCI DSS Requirement 6 (requirement text)
• Microsoft Learn: PCI DSS Requirement 11 (requirement text)
• PCI SSC: Approved Scanning Vendors
• PCI SSC: Just Published: PCI DSS v4.0.1