PCI Approved Scanning Vendor (ASV) List

The list

Search a company or product name, or narrow by the region it serves and where it is based. Rows keep the Council's order and spelling.

How to read a row

Before you hire an ASV

The order below follows the ASV Program Guide, the Council's rulebook for scan vendors and their customers.

1. 01

   Ask your acquirer what it expects

   The ASV Program Guide says: “Scan customers should contact their acquiring bank or each Participating Payment Brand to determine to whom results should be submitted.” Your processor's PCI portal may already include a scan. Our comparison of ASV scanning vendors for small merchants covers that route.

2. 02

   Pick a vendor from the Council's list

   Choosing is your job: scan customers are responsible for “Selecting an ASV from the list of Approved Scanning Vendors from the Website to conduct external vulnerability scanning in accordance with PCI DSS Requirement 11.3.2.” Confirm the company and its solution on the Council's live list on the day you sign.

3. 03

   Let the ASV run the scan

   You cannot run the 11.3.2 scan yourself: merchants “must use only ASVs to perform external vulnerability scans at least once every three months as required by PCI DSS Requirement 11.3.2, and the ASV scan solution must be managed by the ASV.” The guide to what an ASV scan checks explains what passes and what fails.

4. 04

   Fix, rescan, and take disputes to the ASV

   Disputes go to the ASV: the ASV “must explicitly inform the scan customer that disputes in scan results are NOT to be submitted to the PCI SSC.” Fix the failing findings and rescan until a report passes.

5. 05

   Send the passing report where you were told

   “Scan reports must be submitted according to each Participating Payment Brand's requirements.” Put the quarters on your calendar with the PCI deadline calendar.

What this list does not tell you

A row here is not a recommendation, and the order is not a ranking. The Council says approval and re-approval “indicate only that the applicable ASV has successfully met all PCI Security Standards Council requirements to perform PCI data security scanning, and the PCI Security Standards Council does not endorse these security solution providers or their business processes or practices.” We hold this page to the same line: no verdicts, no scores, no picks.

If you want a shortlist judged on what a small shop needs, such as help after a failed scan or a guided SAQ, read our ASV scanning vendors compared for small merchants. Every vendor there comes from this list.

The list also says nothing about the rest of your PCI work. An ASV covers the quarterly external scan; a penetration test is a separate job. Qualified Security Assessors are a different Council listing, explained in the guide to the AOC, ROC and QSAs. For outside help with the whole year, see PCI compliance consultants compared, and to learn which questionnaire you file, the SAQ type finder. More on scans and fees sits in the Scans, Audits & Fees hub.