PCI Penetration Testing Cost: What Drives the Quote

Published 2026-10-2216 min read

Required byPCI DSS Req. 11.4
Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.1–11.4.5, read on 2026-10-22
How oftenat least once every 12 months
Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.2, 11.4.3, read on 2026-10-22
Tested bya qualified, independent tester
Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.2, 11.4.3, read on 2026-10-22
Price set bythe scope you hand the tester
Source: PCI SSC, Penetration Testing Guidance v1.1, §2.1, read on 2026-10-22

A PCI penetration test has no set price, and you will not find one here. What PCI DSS Requirement 11.4 fixes is what you are buying: an internal and an external test at least once every 12 months and after any significant change, a test of any segmentation you rely on, and a repeat test once the findings are fixed, all by a qualified tester who is independent of your systems. The Council's pen test guidance names no figure either; it explains what makes the job longer or shorter. Your scope sets the quote.

Dithered print of a laptop cabled to a router on a back-office shelf — The tester plugs in where an attacker would: the back-office network beside the terminal.

Who needs a PCI pen test

The pen test lives in Requirement 11.4 of PCI DSS. Whether it lands on your desk depends on the SAQ your acquirer lets you file. SAQ D for Merchants covers “All merchants not included in descriptions for the above SAQ types,” with examples such as “E-commerce merchants that accept account data on their website” and “Merchants with electronic storage of account data.” SAQ D covers all requirements, so 11.4 is on it. Service providers file SAQ D for Service Providers, the only SAQ a service provider can use, and carry a shorter segmentation cycle on top.

Pen test on your form?

SAQ D for MerchantsYes, Req. 11.4

SAQ D for Service ProvidersYes, plus 11.4.6

Any other SAQCheck your form

Decided byyour SAQ

Source: SAQ Instructions and Guidelines v4.0.1 r1, pp. 4–5, 23, read on 2026-10-22

For the other SAQs, read the testing questions in your own form or ask your acquirer; this site does not rule on them. The PCI compliance checklist for SAQ D shows where the pen test sits beside everything else that form asks, and the SAQ D guide walks through who ends up on it.

What a PCI pen test must cover

A pen test bought for PCI is not a generic “hack us” job. Requirement 11.4.1 says you define, document and implement a testing methodology, and it lists what that methodology must include. Whoever you hire tests against it, so it is the first page of any quote.

Your written method must include

11.4.1Industry-accepted penetration testing approaches
11.4.1Coverage for the entire CDE perimeter and critical systems
11.4.1Testing from both inside and outside the network
11.4.1Testing to validate any segmentation and scope-reduction controls
11.4.1Application-layer testing for, at a minimum, the attacks listed in Requirement 6.2.4
11.4.1Network-layer tests of all components that support network functions, and operating systems
11.4.1Review of threats and vulnerabilities experienced in the last 12 months
11.4.1A documented approach to the risk of exploitable findings
11.4.1Results and remediation kept for at least 12 months

Written byyou

Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.1, read on 2026-10-22

“Testing from inside the network (or ‘internal penetration testing’) means testing from both inside the CDE and into the CDE from trusted and untrusted internal networks.”

Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.1 applicability notes, read on 2026-10-22

The tests, how often, and by whom

Swipe sideways for the full row

PCI DSS Requirement 11.4 tests, their cadence and who may perform them
Req.	Test	How often	Who
11.4.2	Internal penetration test	At least once every 12 months, and after any significant infrastructure or application upgrade or change	Qualified internal resource or qualified external third party, organizationally independent
11.4.3	External penetration test	At least once every 12 months, and after any significant infrastructure or application upgrade or change	Qualified internal resource or qualified external third party, organizationally independent
11.4.4	Fix and retest	After each test that finds exploitable weaknesses	You fix by your own risk ranking (6.3.1); the test is repeated
11.4.5	Segmentation test, if you segment	At least once every 12 months, and after any change to segmentation controls	Qualified internal resource or qualified external third party, organizationally independent
11.4.6	Segmentation test, service providers	At least once every six months, and after any change	Same as 11.4.5
11.4.7	Multi-tenant hosts support your external test	Whenever you test	Your host: evidence on your infrastructure, or prompt access

Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.2–11.4.7, read on 2026-10-22

11.4.7 is one of the requirements that started as best practice. The new requirements that PCI DSS v4.0 introduced as best practices became mandatory on 31 March 2025. If your shop runs on a shared cloud or hosting platform, that host now owes you either evidence of external testing on the infrastructure you subscribe to, or prompt access so you can test it yourself.

What makes the quote bigger or smaller

The Council's guidance names no price, but it is plain about what makes the job longer or shorter. Set the two kinds of testing side by side and the difference in size is clear:

Vulnerability scan

“several seconds to several minutes per scanned host”

Penetration test

“days or weeks depending on the scope of the test and size of the environment”

Source: PCI SSC, Penetration Testing Guidance v1.1, §2.1, read on 2026-10-22

So the levers on a quote are the levers on scope: how much of your network touches card data, how much of the software is your own, how well the fence around card systems holds, and how much the tester has to discover alone. Each line below cites the section of the guidance that says so.

Grows the job

More systems in scope§2.2
Scope is the whole CDE perimeter and any critical systems, including what staff use to manage card systems.
Software written for you§2.3
It gets an application-layer test as well as a network-layer one.
Logins with several roles§2.3.1
Testing runs against every role or type of access.
Each segmentation method§2.4
Firewall rules, VLAN access lists: every method in use is tested.
A leaky segment§4.2.3
An out-of-scope network that reaches the CDE means fixing the fence or a full network-layer test.
Black-box testing§2
With no details shared it “may require more time, money, and resources.”
Live systems, business hours§2.3.4
Avoiding disruption “may increase the time, resources and complexity.”
Scope found mid-test§2.1
“Tests may grow in time and complexity if efforts uncover additional scope.”
Slow fixes§4.3.2
A long gap before the retest “may require a new testing engagement.”

Effectmore tester time

Source: PCI SSC, Penetration Testing Guidance v1.1, read on 2026-10-22

Shrinks the job

A smaller card data environment§2.2
Fewer systems that store, process or transmit card data means less perimeter to test.
Documents handed over§4.1.2
Network and data-flow diagrams, expected ports and services, how staff reach the CDE, isolated segments.
Grey-box or white-box§2
Partial or full details up front; these “yield more accurate results.”
Off-the-shelf web apps§2.3.3
Usually a network-layer check of setup and patching, not an application-layer test.
Identical locations§6.3
The Council's retail example tested two of six identical stores and applied findings to all.
A matching test copy§2.3.4
Used “to avoid disruptions and to speed up testing,” if it matches production.
Your host's own infrastructure§4.1.4
The scope may not include infrastructure the host provides; its management portals belong to the host's own PCI DSS work.

Effectless tester time

Source: PCI SSC, Penetration Testing Guidance v1.1, read on 2026-10-22

“PCI DSS penetration tests are typically performed as either white-box or grey-box assessments.”

Source: PCI SSC, Penetration Testing Guidance v1.1, §2, read on 2026-10-22

Build the scope sheet you send for quotes

Answer in plain terms and the sheet lists the tests a PCI pen test needs for your setup, what will grow or shrink the job, and what to ask. Copy or print it and send the same sheet to every tester, so the quotes compare like with like.

Your scope sheet

Describe your setup. Pre-filled with a small online shop on a hosted server. Nothing here asks for card data.

Web software in the payment flow

Does it have logins with different roles?

Public IP addresses (your own count)

Do you fence card systems off from the rest of the network?

How (each method in use)Locations that take cards (your own count)

Where card systems run

What the tester gets up front

What gets tested

External test, network layerTest
Req. 11.4.3: Every public IP address and domain you list, plus remote access such as VPN.
Application-layer test of your own codeTest
Req. 11.4.1: Software written by or for you that touches the payment flow, tested at a minimum for the attacks in Req. 6.2.4.
Internal testTest
Req. 11.4.2: From inside the card data environment, and into it from your other internal networks.
Segmentation testTest
Req. 11.4.5: Each method you use to fence off card systems (firewall rules), every 12 months and after any change to it.
Your host's approval and its shareAsk
Req. 11.4.7; Pen test guidance §4.1.4: Get approval first if your contract needs it. The host's own infrastructure is not your scope; a multi-tenant host must give you test evidence or access.
Diagrams and details sharedShrinks it
Pen test guidance §2, §4.1.2: Network and data-flow diagrams, expected ports and services, how staff reach card systems.
Tested on live systemsGrows it
Pen test guidance §2.3.4: Working around business hours “may increase the time, resources and complexity.”
Retest after fixesAsk
Req. 11.4.4: The test is repeated to verify the corrections. Ask whether the quote includes it.

Grows it1
Shrinks it1
Ask the tester2

Tests to quote4

Dithered print of a coiled network cable beside a closed laptop — The internal test starts from a cable on your own network, so every segment it can reach is in play.

Pen test or ASV scan: two separate purchases

The quarterly ASV scan and the yearly pen test both sit in Requirement 11, and they are easy to confuse on an invoice. One does not stand in for the other. A scan lists known weaknesses; a pen test is a person trying to use them, and others, to get in.

Swipe sideways for both columns

ASV scan and penetration test compared under PCI DSS
Detail	ASV scan	Penetration test
Requirement	11.3.2	11.4.2, 11.4.3
Looks from	The internet	Inside and outside
How often	At least once every three months	At least once every 12 months and after significant change
Who may do it	A PCI SSC Approved Scanning Vendor	A qualified, independent tester
Done when	Nothing scored 4.0 or higher, per the ASV Program Guide	Exploitable findings corrected, then the test repeated
Purpose	Find, rank and report known vulnerabilities	Find ways to exploit weaknesses and defeat security features
How	Mostly automated tools, with manual checks of what they flag	A manual process that may use scanning tools
Takes	Seconds to minutes per host	Days or weeks, by scope

Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.3.2, 11.4.2–11.4.4; Penetration Testing Guidance v1.1, §2.1, read on 2026-10-22

The guidance gives an example of what only a pen test catches: “credentials obtained through manipulation of a web-application error message that was not flagged during an ASV scan due to a low CVSS base score.” The scan passed; the door was still open. For the scan side, read what an ASV scan is and how it passes.

Retesting after fixes

A pen test is not finished when the report lands. Requirement 11.4.4 says exploitable findings are corrected by your own risk ranking and then:

“Penetration testing is repeated to verify the corrections.”

Source: PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.4, read on 2026-10-22

The Council's guidance expects fixes “within a reasonable period of time after the original test,” and warns that letting them drag “may require a new testing engagement.” Whether the retest is part of the first quote is the single line most worth reading twice. The retest has its own short report:

Retest report

Executive summary
Date of original test
Date of retest
Original findings
Results of retest

Keep resultsat least 12 months

Source: PCI SSC, Penetration Testing Guidance v1.1, §5.2.2; PCI DSS v4.0.1 Prioritized Approach Tool, 11.4.1, read on 2026-10-22

Who may test, and how to judge them

The tester can be your own staff or an outside firm. Requirements 11.4.2 and 11.4.3 ask for “a qualified internal resource or qualified external third party,” with organizational independence, and the tester is “not required to be a QSA or ASV.” The guidance spells out independence: the tester must be “organizationally separate from the management of the target systems.”

Certifications help, experience decides

The guidance lists common pen-test certifications as examples (OSCP, CEH, GIAC certifications such as GPEN, GWAPT and GXPN, CREST penetration testing certifications, and CHECK) and adds that “The PCI SSC does not validate or endorse these certifications.” None is required. It is blunter about experience:

“Appropriate penetration testing experience and qualifications cannot be met by certifications alone.”

Source: PCI SSC, Penetration Testing Guidance v1.1, §3.2, read on 2026-10-22

For who signs what among consultants, assessor firms and managed programs, see PCI consultants and assessor firms compared.

Questions to ask a tester before you sign

Every question below comes from the Council's guidance or the requirement text. Print it with your scope sheet and ask each tester the same set.

Before you sign

The testerReq. 11.4.2–11.4.3; guidance §3

Who will do the testing, and what qualifies them?
How are they independent of the people who install, run and support our systems?
Have they tested setups of our size, on the technologies we run?

The scopeGuidance §2.1, §4.1.1–§4.1.2

Which tests are in the quote: external, internal, segmentation, application layer?
What do you need from us before you start?
If you find systems we did not list, how is that handled and quoted?

The rules of engagementGuidance §4.1.3–§4.1.5, §4.2.4

What time window will you test in, and what happens on live systems?
What is the success criterion: when does the test stop?
What happens if you reach card data, or find signs of an earlier break-in?
Do we need our host's written approval first?

The report and the retestReq. 11.4.4; guidance §4.3.2–§5.3.2

Is a retest of fixed findings in the quote, and how long do we have to fix?
Will the report state scope, method, segmentation results and how each finding was scored?
How long do you keep evidence, and does any of our data leave with you?
Will you list every account and tool to remove afterwards?

Askevery tester, same list

Source: PCI SSC, Penetration Testing Guidance v1.1, §3–§5, read on 2026-10-22

The PCI pen test on one receipt

Quick reference

RequirementPCI DSS 11.4

On your formSAQ D for sure; others, check the form

External and internalat least once every 12 months

Also afterany significant infrastructure or application change

Segmentationevery 12 months and after changes (11.4.5)

Service providerssegmentation every six months (11.4.6)

Testerqualified, independent; QSA or ASV not required

After fixesthe test is repeated