A penetration test is a controlled attack on your own systems, done by professionals, so you can fix the holes before someone else finds them. Vulnerability scans check continuously for known weaknesses.
Why it applies to most businesses
- Every business with a website, a network or a cloud account has an attack surface.
- PCI DSS requires yearly penetration tests and quarterly external scans.
- Clients, insurers and auditors ask for recent test results.
Who will ask you for it
- Your acquirer and QSANeed penetration test and scan results for PCI DSS.
- ClientsAsk for a recent test summary in security reviews.
- Cyber insurersAsk whether you test and fix regularly.
- Your IT teamNeeds a prioritized list of what to fix first.
- 01
Define
We agree on what to test: internal or external network, wireless, web or mobile applications, segmentation.
- 02
Test
Certified testers attack in a controlled way, without disrupting your operations.
- 03
Report
Findings ranked by risk, explained in plain language, with how to fix each one.
- 04
Retest
After you fix, we retest and confirm the issues are closed.
What you can hand to them
Click a document to see a sample. All sample documents
- Penetration test report and executive summary
- Approved Scanning Vendor reports for PCI DSS
- Retest letter confirming fixes
- Segmentation test results
Each service produces evidence you can hand to your acquirer, your clients or your auditor.
PCI DSS 11.4
Penetration tests
A controlled attack on your internal and external networks, wireless and web or mobile applications. You get a report with risk levels and how to fix each finding, then a retest.
PCI DSS 11.4.5 · 11.4.6
Segmentation tests
Proof that the networks you keep out of scope really are isolated: every year for merchants, every six months for service providers.
PCI DSS 11.3.2
ASV scans
Quarterly external scans by an Approved Scanning Vendor, with the pass or fail report your acquirer asks for. We set them up and help with the first scan.
PCI DSS 11.3.1
Quarterly vulnerability scans
We configure, schedule and run internal scans every quarter and send you a report ranked by severity, with fixes.
Scope reduction
Card data discovery
Card Recon searches file systems and databases for unencrypted card numbers, so you can delete or encrypt them and shrink your PCI scope.
PCI DSS 12.6 · 6.2.2
Training
Online security awareness training for staff and secure coding training for developers, with completion certificates for your records.
Ubitrak has built its own test benches and works with proven commercial tools, so every test is repeatable and every finding is evidence you can use, for PCI DSS or on its own.
Application tests and load simulators
Our test benches and a commercial test robot put your web, mobile and payment applications through their paces: against PCI DSS, the OWASP Top 10 or your own requirements. Load simulators show how the application holds up under real transaction volumes.
Network intrusion tests
Internal and external intrusion tests by our own testers, as a stand-alone engagement or as part of your PCI DSS certification. We show what an attacker could reach from the internet, and from inside your network.
Wireless network tests
We bring the equipment to test your Wi-Fi on site and find unauthorized access points. We can also help you choose and deploy a wireless intrusion prevention system (WIPS).
Software inspection
Our experts review your code before release to catch security flaws early, when they are cheapest to fix. Then we can train your developers so the same flaws do not come back.
- Commercial-grade toolsProven, high-speed tools for intrusion, application and wireless tests.
- IndependentWe sell no security products, so there is nothing to push in our findings.
- Quality controlEvery test and report goes through our quality control before it reaches you.
- ASV scans worldwideThrough a leading Approved Scanning Vendor, in Canada and abroad.
Delivered by
- UbitrakPCI QSA company since 2011.
- KW ConsultingAdvisory, IT projects and remediation.
Industries
Commonly bundled with
- Card payment certificationPCI DSS assessment and certification.
- Client security reviewsISO 27001, SOC 2 and questionnaires.
- Fix what the audit foundRemediation by KW Consulting.
Related insights
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how…
Read the insight →The EU Cyber Resilience Act: what Canadian exporters must report since 2026-09-11
Selling connected hardware or software into the EU? The Cyber Resilience Act's 24-hour vulnerability reporting duty applies since 2026-09-11, and the main obligations follow…
Read the insight →Post-quantum cryptography: why your first step is a cryptographic inventory
NIST's post-quantum standards are final and Canada has a federal migration roadmap to 2035. Why the first step is a cryptographic inventory, and how…
Read the insight →