Best ASV Scanning Vendors for Small Merchants
Published
If your acquirer asks for quarterly passing scans, you need a scan tool from a company on the PCI Security Standards Council's list. PCI DSS 11.3.2 requires external vulnerability scans at least once every three months by an ASV approved by PCI SSC. An Approved Scanning Vendor is a “Company approved by the PCI SSC to conduct external vulnerability scanning services.” Every vendor below was on that list on 2026-10-22, and we judged each on what a small merchant needs from a scan vendor beyond the scan itself.
Verdict
- Best overallClone Systems
- Best for a guided SAQ plus scanVikingCloud
- Best for help after a failed scan1 Stop PCI Scan
Vendors compared6
The comparison table
Every vendor passes the first row by design. The rest is what each vendor's own site said when we read it. The Council's list also carries enterprise vulnerability-management firms and regional assessors; the full list, filterable by name and region, is in our Approved Scanning Vendors directory.
Swipe sideways for more vendors
| What you need | Our pickClone Systems | VikingCloud | Sectigo HackerGuardian | 1 Stop PCI Scan | Aperia Compliance | SecurityMetrics |
|---|---|---|---|---|---|---|
| On the Council's ASV list todayReq. 11.3.2 | Yes | Yes | Yes | Yes | Yes | Yes |
| Sells a scan straight to a merchantASV-PG §4.6 | Yes | Yes | Yes | Yes | No | Ask the vendor |
| Runs PCI programs for processors and acquirersASV-PG §7.9 | Yes | Yes | Ask the vendor | Ask the vendor | Yes | Ask the vendor |
| SAQ help in the same accountSAQ + AOC | Yes | Yes | Ask the vendor | Ask the vendor | Yes | Ask the vendor |
| Help fixing a failed scanASV-PG §7.5 | Yes | Yes | Yes | Yes | Ask the vendor | Ask the vendor |
| Rescans until you pass, statedASV-PG §7.5 | Yes | Ask the vendor | Yes | Ask the vendor | Ask the vendor | Ask the vendor |
Start with your processor
Before you buy anything, log in to your processor's PCI portal. 3 of the vendors here run PCI programs for processors and acquirers, so a scan may already sit inside the program you are enrolled in, and a second scan bought on top would cover the same requirement twice. If a PCI charge on your statement puzzles you, our guide to PCI compliance fees explains who sets it.
Which route fits you?
Two questions. The shortlist comes from the table on this page.
Ask your processor before you buy. The ASV Program Guide tells scan customers to contact their acquiring bank to find out where results go (§7.9).
ShortlistAsk your processor
Vendor by vendor
Clone Systems
A scanning and managed-security firm that sells its ASV scan online.
FitsA shop that buys its own scan and wants the SAQ in the same portal
On the Council's ASV list todayYes
Sells a scan straight to a merchantYes
Runs PCI programs for processors and acquirersYes
SAQ help in the same accountYes
Help fixing a failed scanYes
Rescans until you pass, statedYes
Its scan page offers “External vulnerability scanning, unlimited re-scans, SAQ support, exception handling, and compliance reporting in one secure portal”, and says exceptions get “an approval or rejection within 24 hours.” Its menu lists white-label scanning for payment providers.
Council list: Clone Systems, Inc. (Clone Guard PCI)
VerdictBest overall
VikingCloud
A QSA, ASV and forensic firm; controlscan.com now opens its site, and it owns SecureTrust.
FitsA small merchant who wants a guided SAQ and the scan in one subscription
On the Council's ASV list todayYes
Sells a scan straight to a merchantYes
Runs PCI programs for processors and acquirersYes
SAQ help in the same accountYes
Help fixing a failed scanYes
Rescans until you pass, statedAsk the vendor
Not stated on their site when read on 2026-10-22.
Its small-business page offers “Guided self-assessment” and an “External vulnerability scanning – ASV certified” scan, and says “SecureTrust is now a part of VikingCloud.” Its scanning page lists “Self-service or managed scanning & remediation support.”
It also runs “Programs for Processors, Acquirers, & ISOs” with “automated SAQ management”, so your processor's portal may already be built on it.
Council list: VikingCloud, Inc. (AsgardScanner; VikingCloud Advanced Intel Scanner)
VerdictBest for a guided SAQ plus scan
Sectigo HackerGuardian
The PCI scan from Sectigo, a certificate and website-security company.
FitsA web shop with a handful of internet-facing servers
On the Council's ASV list todayYes
Sells a scan straight to a merchantYes
Runs PCI programs for processors and acquirersAsk the vendor
Not stated on their site when read on 2026-10-22.
SAQ help in the same accountAsk the vendor
Not stated on their site when read on 2026-10-22.
Help fixing a failed scanYes
Rescans until you pass, statedYes
Sectigo says its plans let merchants “validate PCI compliance quarterly on up to five servers”, with “Unlimited PCI Scans” and “ready-to-submit PCI compliance reports to send to your merchant bank.” Reports “contain actionable fixes for remediation.” Its page names no SAQ help.
Council list: Sectigo Ltd (HackerGuardian)
VerdictBest for a small web shop
1 Stop PCI Scan
The ASV scan sold by Backbone Security, Inc.
FitsA merchant who expects to need a person to talk a failure through
On the Council's ASV list todayYes
Sells a scan straight to a merchantYes
Runs PCI programs for processors and acquirersAsk the vendor
Not stated on their site when read on 2026-10-22.
SAQ help in the same accountAsk the vendor
Not stated on their site when read on 2026-10-22.
Help fixing a failed scanYes
Rescans until you pass, statedAsk the vendor
Not stated on their site when read on 2026-10-22.
Its home page says: “We Work With Our Customers To Address Failing Vulnerabilities And To Understand PCI Compliance Requirements.” It publishes guides on choosing an SAQ, but no SAQ tool is named on the page we read.
Council list: Backbone Security, Inc. (1 Stop PCI Scan)
VerdictBest for help after a failed scan
Aperia Compliance
A white-label PCI program that payment providers put under their own brand.
FitsA merchant whose processor already runs a branded PCI portal
On the Council's ASV list todayYes
Sells a scan straight to a merchantNo
Runs PCI programs for processors and acquirersYes
SAQ help in the same accountYes
Help fixing a failed scanAsk the vendor
Not stated on their site when read on 2026-10-22.
Rescans until you pass, statedAsk the vendor
Not stated on their site when read on 2026-10-22.
Its PCI Apply page offers “guided SAQ workflows, integrated ASV scanning” and is “Built for acquirers, ISOs, PayFacs, banks, and payment platforms”. You reach it through your provider, not on your own.
Council list: Aperia Compliance, LLC (Aperia Pro Scan; Aperia Pro Scan II)
VerdictCheck with the vendor
SecurityMetrics
An ASV and QSA company with two scan solutions on the Council's list.
FitsCheck with the vendor
On the Council's ASV list todayYes
Sells a scan straight to a merchantAsk the vendor
Not stated on their site when read on 2026-10-22.
Runs PCI programs for processors and acquirersAsk the vendor
Not stated on their site when read on 2026-10-22.
SAQ help in the same accountAsk the vendor
Not stated on their site when read on 2026-10-22.
Help fixing a failed scanAsk the vendor
Not stated on their site when read on 2026-10-22.
Rescans until you pass, statedAsk the vendor
Not stated on their site when read on 2026-10-22.
SecurityMetrics is on the Council's ASV list and its QSA list. Its scan pages did not open to our reader on 2026-10-22, so each line below is “Ask the vendor” until a person reads them.
Council list: SecurityMetrics, Inc. (SecurityMetrics ASV Scan I; SecurityMetrics ASV Scan II)
VerdictCheck with the vendor
When a scan fails
This is where scan vendors differ most, and where the table's last two rows matter. The Council's ASV Program Guide sets the path every listed vendor follows; a good vendor walks you through it. Our plain guide to the ASV scan itself covers what is scanned and when.
- 01
Read what failed
A passing ASV scan has no vulnerability scored 4.0 or higher on CVSS (High = 7.0–10.0, Medium = 4.0–6.9, both fail) and nothing that breaks PCI DSS. Low findings (0.0–3.9) can pass.
ASV-PG §6.2, §6.3.2
- 02
Fix it, or dispute it with the ASV
You may dispute a false positive, a CVSS score, a finding covered by a compensating control, or an inconclusive scan. The ASV must investigate any disputed false positive scored 4.0 or higher, and you send written, system-generated evidence. Disputes go to the ASV: the guide says they are “NOT to be submitted to the PCI SSC.”
ASV-PG §7.5, §7.7
- 03
Rescan until a report passes
Fix the failures and rescan until a report passes. A passing report for the quarter can be built from several failed scans that together show every finding from the first scan was dealt with.
ASV-PG §7.4
- 04
Send only the passing report
“Scan customers only submit passing scan reports.” Who receives it is set by the card brands; the guide tells you to contact your acquiring bank to find out.
ASV-PG §7.4, §7.9
Two limits apply whichever vendor you pick. You can start a scan from the vendor's portal, but “only authorized ASV Employees are permitted to configure any settings” or change a result. And the Scan Customer Attestation is yours to sign: it “may not be outsourced to a third party” (ASV-PG §5.2).
What an ASV does not cover
An ASV scan answers one requirement. The other testing jobs in Requirement 11 can be done by qualified, independent people who are not an ASV, so a penetration test is a separate job with its own tester. To keep all of these on one schedule, see the PCI compliance software compared.
| Job | How often | Who may do it | ASV needed |
|---|---|---|---|
| External vulnerability scanReq. 11.3.2 | At least once every three months | A PCI SSC Approved Scanning Vendor | Yes |
| External scan after a significant changeReq. 11.3.2.1 | After any significant change | Qualified, independent staff | No |
| Internal vulnerability scanReq. 11.3.1 | At least once every three months | Qualified, independent staff | No |
| Penetration test, internal and externalReq. 11.4.2, 11.4.3 | At least once every 12 months and after significant change | A qualified, independent tester | No |
ControlScan and Trustwave alternatives
Two names that searchers still look for do not appear on the Council's list as companies today, so neither gets a column here.
Questions
Can I run the quarterly scan myself with a free scanner?
Not for Requirement 11.3.2. The ASV Program Guide says merchants “must use only ASVs to perform external vulnerability scans at least once every three months” and “the ASV scan solution must be managed by the ASV” (§5.2). Your own tools are fine for internal scans and for the scan after a significant change.
Does a shop on SAQ A still need ASV scans?
Usually yes. SAQ A for v4.x includes Requirements 11.3.2 and 11.3.2.1 (external vulnerability scans) for merchants whose pages redirect to, or embed, a processor's payment page. Our SAQ A guide covers the rest of that form, and the SAQ type finder tells you which form is yours.
How many passing scans do I need in my first year?
In the first year, you do not need four passing scans if the most recent scan passed, a written policy requires scans at least every three months, and fixes were confirmed by rescan. After the first year, the Council expects passing scans at least every three months. The PCI deadline calendar lays the quarters out.
Where do I send the passing scan report?
Wherever your acquirer or the card brand says. The guide tells scan customers to “contact their acquiring bank or each Participating Payment Brand to determine to whom results should be submitted” (§7.9). It usually travels with your SAQ and its Attestation of Compliance.
Does the scan vendor have to be in my country?
The Council's list gives each solution a region, and most read “Global”. A few are limited to one country or region, so check the region column in our Approved Scanning Vendors directory.
Sources
- PCI SSC: Approved Scanning Vendors list (CSV export) (pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: ASV Program Guide v4.0 r2 (December 2022) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Prioritized Approach Tool for PCI DSS v4.0.1 (Req. 11.3.1, 11.3.2, 11.4) (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: SAQ Instructions and Guidelines v4.0.1 r1 (docs-prv.pcisecuritystandards.org), read on 2026-10-22
- PCI SSC: Glossary (Approved Scanning Vendor) (pcisecuritystandards.org), read on 2026-10-22
- VikingCloud: PCI compliance for small businesses (vikingcloud.com), read on 2026-10-22
- VikingCloud: Programs for processors, acquirers and ISOs (vikingcloud.com), read on 2026-10-22
- VikingCloud: Vulnerability scanning (vikingcloud.com), read on 2026-10-22
- Clone Systems: PCI ASV scan (clone-systems.com), read on 2026-10-22
- Sectigo: HackerGuardian PCI scanning (sectigo.com), read on 2026-10-22
- 1 Stop PCI Scan (Backbone Security): home page (1stoppciscan.com), read on 2026-10-22
- Aperia Compliance: PCI Apply (aperiacompliance.com), read on 2026-10-22
- controlscan.com (opens vikingcloud.com) (controlscan.com), read on 2026-10-22
- trustwave.com (opens levelblue.com) (trustwave.com), read on 2026-10-22