If you store, process or transmit payment card data, the PCI Data Security Standard requires regular penetration testing of your cardholder data environment (CDE). PeakCyber’s PCI DSS penetration testing meets that requirement while giving you real security value, not just a compliance report.
What does PCI DSS require?
PCI DSS Requirement 11 calls for penetration testing at least annually and after significant changes to the environment, covering both the network and application layers, and testing both from inside and outside. If you use network segmentation to reduce the scope of your CDE, the standard also expects segmentation controls to be tested to confirm they are effective.
Because requirements evolve between versions of the standard, we align testing with the version applicable to your assessment and confirm details with you during scoping.
What our testing covers
- External penetration testing: internet-facing systems that are part of or connected to the CDE
- Internal penetration testing: attacks from inside the network, including attempts to reach cardholder data
- Application testing: web applications, payment pages and APIs in scope
- Segmentation testing: verifying that out-of-scope networks cannot reach the CDE
- Exploitable vulnerability validation: manual verification of findings, not only scanning
- Retesting: confirming that identified issues have been corrected
Our approach
- Scoping workshop to define the CDE, connected systems and segmentation controls
- Testing against a documented methodology based on recognized industry standards
- Manual exploitation to demonstrate real risk
- Reporting suitable for your QSA or acquiring bank, including scope, methodology, findings and evidence
- Remediation support and retesting to close findings
What you receive
- Executive summary
- Detailed technical report with scope, methodology and results
- Segmentation test results, where applicable
- Prioritized remediation guidance
- Retest report once issues are fixed
Who needs it
Merchants, payment service providers, fintechs, e-commerce platforms, banks and any organization that handles cardholder data or can affect its security.
Frequently asked questions
Meet the requirement and reduce real risk
Talk to us about a penetration test scoped to your cardholder data environment.
