PCI Penetration Testing Requirements (11.4): What Assessors Expect
What 11.4 requires
PCI DSS requirements 11.4.1 through 11.4.5 mandate annual penetration testing covering both the network and application layers, plus testing that validates network segmentation. This is not a vulnerability scan -- it is adversarial testing by qualified testers, and your QSA will review the methodology and findings.
Network vs application testing
- Network-layer testing covers the CDE perimeter and critical systems from both external and internal perspectives.
- Application-layer testing covers payment applications and other in-scope applications -- including the custom code around your checkout.
- Social engineering is not required by 11.4, but many testers include it; clarify scope with your provider.
Segmentation testing
If you segment the CDE to reduce scope (see our scoping guide), the pen test must prove the segmentation works -- attempting to pivot from out-of-scope networks into the CDE. Failed segmentation testing collapses your scope back open, so test it before the assessor does.
The report
Your QSA needs a formal report: scope, methodology, tester qualifications, findings with severity, remediation, and re-testing evidence. An email saying "we pen tested, all good" will not survive the assessment.
Costs and timing
Published ranges put pen tests at $5,000–$30,000 per test (Akurateco, 2026), climbing with applications, APIs, environments, and mobile surfaces. Schedule the test before assessment fieldwork so findings are remediated and re-tested in time -- a fresh critical finding during fieldwork delays the ROC.
Questions
Can our QSA do the pen test?
Only with strict separation -- and many QSAs won't, to preserve independence. Most buyers hire a separate testing firm and hand the report to the QSA.
Do SAQ merchants need pen testing?
SAQ D merchants have pen-testing requirements; narrower SAQs generally don't. Your acquirer may still ask -- confirm what's expected for your SAQ type.
Related reading
Get quotes from PCI QSA firms
Tell us about your environment once -- matched assessors reply with scoped quotes. Free, 2 minutes.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.