Automated Penetration Testing
An automated penetration test of up to 10 IP addresses, from outside your network, the way an attacker on the internet sees them. Testing from inside your network is an option too, from a virtual machine you deploy in your environment. It tries to exploit what it finds and gives you a report for PCI DSS Requirement 11.4. Then you get 30 days to fix what it found and test again.
Each test is quoted per project, based on what you need tested. Need a person doing the testing instead? We offer that too.
-
External, internal optional
We test from the internet. For internal testing, you deploy our virtual machine inside your network. -
10 IPs for 30 days
That's a standard test. Bigger scopes are quoted too. -
Unlimited retests
Fix a finding and test again within the 30 days. -
Report for 11.4
What was tested and what was found, for your assessor.
Do you need a penetration test?
PCI DSS Requirement 11.4 asks for a penetration test at least once every 12 months, and again after any big change to your systems. It is a different requirement from the quarterly ASV scan (Requirement 11.3.2), and one does not stand in for the other. Whether you need it depends on the Self-Assessment Questionnaire (SAQ) you file. Our SAQ guide shows which form is yours, and your acquiring bank has the final say.
| SAQ | Who it is for | Penetration test? |
|---|---|---|
| D | Merchants that store card data, service providers, and anyone who doesn't fit a shorter form. | Yes, external and internal, plus segmentation testing if you use segmentation. |
| A-EP | Online stores whose own site serves the payment page or its scripts, while the card data goes straight to the payment company. | Yes, external, plus segmentation testing if you use segmentation. |
| A | Online stores where the payment company hosts the card form, by redirect or iframe. | No. You still need the quarterly ASV scan. |
What the test covers
A vulnerability scan finds a weakness and lists it. This test goes a step further. It tries to use the weakness the way an attacker would, and where it can, it chains smaller issues together into a bigger one. Its attacks follow MITRE ATT&CK, the public catalog of what real attackers do. It runs against the addresses you give us on the quote form.
| External | Attacks what faces the internet: your public IP addresses, servers, sites, and subdomains you may have forgotten about. |
|---|---|
| Internal (optional) | Runs from a virtual machine we provide, which you deploy inside your environment. It starts from there, as if someone already got in, and tries to go further: reused passwords, open file shares, Active Directory weaknesses, and moving from one machine to the next. |
| Web applications | Tries common attacks, like SQL injection and cross-site scripting, against the sites on your IP addresses, without logging in. To test behind the login, see our web app penetration test. |
| Retesting | Unlimited for 30 days. Re-run the exact attack to prove each fix works. |
| Report | Every finding, ranked by how easy it is to exploit and how much it exposes, with proof the attack worked and plain guidance on how to fix it. |
How it works
Request a quote
Fill in the quote form with how many IP addresses and web applications to test.
Get your quote
Scope, timing and cost, usually within one business day.
Pick a time
So the test doesn't land in your busy hours. Tell us anything that's off limits.
The test runs
An automated test usually takes a few hours.
Fix and retest
Get the report, fix what it found, and test again until your 30 days are up.
Automated, or a person doing the testing?
Our default test is automated. It is software our security team builds and maintains, and that is what makes it quick to schedule and quick to finish. The trade-off is that software won't reason about your business logic the way a human tester can, and some assessors expect a person to have been involved. So we also offer a test run by a dedicated tester, who works through your systems by hand. Check with your QSA or acquiring bank which one they expect before you buy. If you need a person, say so when we come back with your quote.
Network test or web app test?
This test goes wide: every service on up to 10 IP addresses, from outside your network, and from inside it too if you add internal testing. It tells you where your overall risk is. Our web app penetration test goes deep instead. It logs in to the apps you name, as each kind of user, and checks whether one user can reach another's data or pages they shouldn't see. Many businesses need both: start wide, then test the apps that matter most in depth.
| If your question is... | Choose |
|---|---|
| "What's our overall risk across all our servers?" | Network test |
| "Do we need PCI DSS 11.4 testing of our network?" | Network test |
| "Can a customer see another customer's orders in our portal?" | Web app test |
| "Are we about to launch a new app or checkout?" | Web app test |
| "Do we want both wide coverage and a deep look at our main app?" | Both |
Penetration testing pricing
Every penetration test is quoted per project, because the work depends on scope. The quote depends on how many IP addresses you have, how many web applications, and whether you need external testing, internal testing or both. If you have more than 10 IP addresses, need longer than 30 days, or want a dedicated tester, we quote that too.
Common questions
Do I need both internal and external testing?
That depends on your SAQ. SAQ D asks for both, so add internal testing when you ask for a quote. SAQ A-EP asks for external testing, which every test includes. SAQ A asks for neither. Your bank can confirm which applies to you.
How long does the test take?
An automated test usually takes a few hours, starting at the time you pick. The 30 days are for you: fix what the test finds and run it again as often as you like.
Is it safe to run against live systems?
Yes, by default. The test proves a weakness is real without taking anything down, and checks that could disrupt a system only run if you ask for them. You can leave out hosts or whole subnets, pick the time, and pause the test at any point.
Do I need to install anything?
Not for the external test. It works over the internet. For internal testing, you deploy a virtual machine we provide inside your environment. The internal test runs from it, which is how it sees your network from the inside.
How fast do I get a quote?
Usually within one business day of sending the quote form.
Can you test more than 10 IP addresses?
Yes. Put the real number on the quote form and we will quote that scope.
Is a penetration test the same as an ASV scan?
No. The ASV scan is a quarterly check for known weaknesses, under Requirement 11.3.2. The penetration test is a yearly attempt to break in, under Requirement 11.4. Our comparison of scanning and penetration testing sets the two side by side.
Only need the quarterly scan?
If your SAQ asks for the quarterly ASV scan and not a penetration test, you can buy it now without a quote. It is $59 a quarter per IP address, or $188 a year, which works out to $47 a quarter. Unlimited rescans, the Attestation of Scan Compliance and US-based email support come with every plan. Start your scan.