PCI ASV
Scanning

An ASV is a company approved by the PCI Security Standards Council to perform external vulnerability scans required under PCI DSS Requirement 11.2.2. Only ASV-approved vendors can produce scan reports that are accepted by QSAs and acquiring banks for PCI compliance validation.

PCI DSS requires ASV scans at least once per quarter (every 90 days). However, you also need a passing scan after any significant infrastructure change. Our service includes weekly scans throughout the quarter so you catch and fix issues early rather than scrambling before the deadline.

A failed scan means one or more vulnerabilities exceed the PCI threshold (typically CVSS 4.0 or higher). You will need to remediate the findings and rescan until you achieve a passing result before the quarterly deadline. We provide clear remediation guidance with every scan to help your team fix issues quickly, and rescans are included in our service.

Yes. If a scan flags a finding that is a false positive or has a compensating control in place, we work with you through the ASV dispute resolution process. You provide evidence of the compensating control or false positive, and we review and adjudicate it per PCI Council guidelines.

An ASV scan is an automated external vulnerability scan required quarterly for PCI compliance. A penetration test is a deeper, manual assessment where a tester actively exploits vulnerabilities to demonstrate real-world impact. PCI DSS requires both—ASV scans quarterly (Requirement 11.2.2) and penetration tests annually (Requirement 11.3).

Each report includes a PCI-formatted attestation of scan compliance, a full list of discovered vulnerabilities with CVSS scores, affected hosts and services, remediation recommendations, and pass/fail status per PCI Council standards. Reports are formatted for direct submission to your QSA or acquiring bank.