"Automated external penetration test" gets used for two different things. Sometimes people mean an ASV vulnerability scan, which tests your servers from outside your network without a person driving every step. Sometimes they mean an automated penetration test, which goes further and tries to break in using what it finds. ServerScan sells both, and they meet different PCI DSS requirements: the ASV scan is Requirement 11.3.2 and the penetration test is Requirement 11.4. Steps 1 to 5 below happen in both. Step 6 only happens in a penetration test.
Step 1: Finding What's Exposed
The scan starts by mapping out what's actually reachable from the public internet. It checks every IP address you give it and looks at every port, not just the common ones, to build a full picture of what an outside attacker could see.
Step 2: Identifying What's Running
For every open port, the scan figures out what service is running behind it and what version. A web server, a mail server, a database listening somewhere it shouldn't be. This step is what lets the scan know which checks are even relevant to your setup.
Step 3: Checking Against Known Vulnerabilities
Once it knows what's running, the scan compares each service and version against databases of known vulnerabilities (CVEs), plus checks for weak SSL/TLS settings, default files, exposed admin panels, and other common misconfigurations. This is the bulk of the test, and it's where most findings come from.
Step 4: Testing Your Web Applications
If your scope includes web applications, the scan also runs safe, non-destructive versions of attacks like SQL injection and cross-site scripting against your forms and URL parameters. This mirrors the kind of testing a human attacker would try first, just automated and repeatable.
Step 5: Filtering Out False Positives
Not every raw result belongs in your report. Before anything gets flagged as a finding, it goes through validation to weed out results that look like a vulnerability but aren't actually exploitable in your environment. This step matters, because a report full of noise is just as useless as one missing real issues. It's also why we back our scans with a money-back guarantee: if you can't get a passing scan and our support team can't get you there, we refund your order, as long as you ask in writing within 30 days of purchase.
Step 6: Trying to Break In (Penetration Test Only)
This is where a penetration test parts ways with a scan. A scan stops at a list of findings. A penetration test takes those findings and tries to use them, the way an attacker would. Where it can, it chains smaller issues together into a bigger one, like using an exposed admin panel and a weak password to reach something no single finding would. It runs against the IP addresses and applications you name, from outside your network or inside it, at a time you pick.
What You Get at the End
A finished report lists every vulnerability found, ranked by severity, with plain-language guidance on how to fix each one. You can rescan as soon as you've made a fix, since unlimited scanning is included on every ServerScan plan, so you're not stuck waiting until your next quarterly window to confirm it worked. A penetration test ends with a written report of what was tested and what was found, which you can give your assessor as evidence for Requirement 11.4. A standard ServerScan test covers 10 IP addresses for 30 days, with unlimited rescans in that window.
What ServerScan Offers
ServerScan runs ASV-certified automated external scans on the schedule PCI DSS requires (see our scanning requirements guide), with unlimited rescans included and US-based support if a finding doesn't make sense. If you need a penetration test as well, our automated penetration testing covers Requirement 11.4 and is quoted per project. Some assessors expect a person to be involved, so ask your QSA whether an automated test meets their bar. Our comparison of scanning and penetration testing sets the two side by side.
Questions about how a scan works against your specific setup? Contact our support team. We're happy to walk through it.