The short answer: at ServerScan, a PCI ASV scan costs $59 per quarter or $188 per year for one IP address, with unlimited rescans included. Across the industry, prices range from about $150 to more than $3,000 per year depending on the vendor and how many IP addresses you scan. This guide breaks down what drives the price and what to watch for.
What is a PCI ASV scan?
A PCI ASV scan is an external vulnerability scan run by an Approved Scanning Vendor, a company certified by the PCI Security Standards Council. If your business takes card payments, PCI DSS Requirement 11.3.2 says you need a passing ASV scan every three months. The scan checks your internet-facing systems for security holes and produces a report your bank will accept.
How much do ASV scans cost across the industry?
Most vendors charge between $100 and $800 per IP address per year, and large enterprise platforms can run into the thousands. Pricing usually follows one of three models: a flat subscription, a per-IP rate, or an annual package. Watch the fine print, because the headline price often leaves out retest fees and platform fees.
What does ServerScan charge?
ServerScan charges $59 per quarter or $188 per year for one IP address or domain. Both options include unlimited rescans, SAQ help, attestation certificates, and US-based phone and email support. Discounts are available if you need to scan several IP addresses.
What affects the price of a PCI scan?
Three things move the price most: how many IP addresses you scan, how the vendor bills, and what comes bundled in. A vendor that charges for each rescan can end up costing far more than its list price, since almost every business fails a scan at some point and needs to scan again.
Are there hidden fees to watch for?
The common ones are retest fees, platform or account fees, and charges for disputing a false positive. Ask about all three before you sign up. ServerScan has none of them. The price you see covers everything, including as many rescans as you need.
Is quarterly or annual billing better?
Annual is cheaper if you know you need scanning all year, and most businesses do, since PCI DSS requires a passing scan every quarter. At ServerScan, annual billing saves you $48 a year compared to paying quarterly. Quarterly is a fine way to start if you want to try a service first.
How often do I need an ASV scan?
At least once every three months, plus after any significant change to your network. That is four passing scans a year at a minimum. Failed first scans are common, so unlimited rescans matter more than most people expect.
Is a cheap PCI scan good enough?
The scan itself is standardized, since every ASV is certified against the same PCI SSC requirements. What varies is everything around it: rescan fees, support quality, and how much help you get fixing what the scan finds. A low sticker price with paid retests and no support often costs more in the end.
What happens if my scan fails?
You fix the items in the report and rescan. With ServerScan, rescans are free and unlimited, and our support team will help you work through the findings. If you still can't get to a passing scan, we refund your order in full.
How do I get started?
You can sign up online in a few minutes and run your first scan the same day. See our pricing page or start scanning now.