Scanning & testing
PCI ASV scanning and penetration testing cost
Two of the most-bought line items in any PCI programme. ASV scans run quarterly, pen tests run at least annually, and both are required rather than optional. Exactly one vendor on this page publishes a price. This is what that price covers, what everyone else does instead, and the drivers that decide what you are quoted.
Updated July 2026
There is no market rate for ASV scanning, and there is no rate card for PCI penetration testing. The PCI SSC's Approved Scanning Vendor list is the authority on who may perform your quarterly external scan; it lists vendors and it does not list prices. Most vendors on it publish nothing either, because an ASV fee is quoted against your target count. So this page prints one published price, names the vendors who publish none, and spends the rest of its length on the things that actually move a quote.
The one published ASV price
SecurityMetrics, published list price
$399 / year
SecurityMetrics publishes a list price of $399 per year for the product it calls "PCI for small businesses", checked July 2026. Its published feature list at that price includes an "External Vulnerability Scan (1 IP)", an "Online PCI Self Assessment Questionnaire (SAQ)", an online compliance reporting portal, compliance reporting to your merchant processor, PANscan card-discovery software for one machine, and one seat of security awareness training. The page carries an asterisk: "Price discounts available depending on merchant processor."
Read the shape of it before you anchor on it. That is a bundle for a single IP, not an ASV scan rate, and SecurityMetrics' own general pricing page says "SMB pricing varies based on packages from your acquiring bank". It is a real anchor for the smallest merchant and it is not a quote for anyone larger.
Source: securitymetrics.com/pci-small-business-pricing, checked July 2026
Every vendor, and what it actually publishes
Two entries here matter more than any price would have. Rapid7 and Intruder are commonly recommended for PCI scanning and neither is an ASV. Both say so in their own words, quoted below. If you buy scanning from them expecting an attested quarterly scan report, you do not get one from them.
| Vendor | ASV? | Published price | What to know |
|---|---|---|---|
| SecurityMetrics | Yes | $399 / year (see above) | An ASV, and the one vendor here that publishes a price. |
| Qualys | Yes | None published | Qualys states: "As an Approved Scanning Vendor (ASV), Qualys has been authorized by the PCI Security Standards Council to conduct the quarterly scans required to show compliance with PCI DSS." |
| Tenable | Yes | None published | Tenable is an ASV, and describes itself as "qualified as an Approved Scanning Vendor (ASV) to validate external vulnerability scans of internet facing environments". Worth knowing how it works: you run the scan yourself with Tenable's PCI Quarterly External Scan template and submit the report to Tenable for attestation. |
| Trustwave, now part of LevelBlue | Yes | None published | Check the name before you check the price. LevelBlue completed its acquisition of Trustwave on 19 August 2025, and Trustwave's own PCI service page now redirects to levelblue.com. Trustwave's PCI scanning ran on its TrustKeeper portal. |
| Rapid7 | No | None published | Not an ASV. Rapid7's own words: "Rapid7 partners with MegaplanIT, a third-party ASV partner, which means we can help you achieve compliance with PCI DSS." So the attestation comes from MegaplanIT, not from Rapid7. |
| Intruder | No | None published | Not an ASV, and says so plainly: "Intruder's underlying scanner, Tenable, is an ASV and while we are not, we can accelerate your audit with internal and external scans, continuous monitoring and seamless integrations, saving you time and cost when you engage an ASV." |
SecurityMetrics. That price is a bundle for a single IP, not an ASV scan rate, and SecurityMetrics' own general pricing page says "SMB pricing varies based on packages from your acquiring bank". It is a real anchor for the smallest merchant and it is not a quote for anyone larger. (securitymetrics.com/pci-small-business-pricing, checked July 2026)
Qualys. No price is published for the ASV service; the page offers a free trial and routes to sales. Qualys sells ASV scanning inside its wider platform, so what you pay depends on what else you are buying. (qualys.com/apps/pci-asv-compliance, checked July 2026)
Tenable. No price is published for Tenable PCI ASV. It attaches to Tenable Vulnerability Management, so the ASV line is rarely bought on its own. (tenable.com/products/pci-asv, checked July 2026)
Trustwave, now part of LevelBlue. No price is published. If you hold a Trustwave contract, the acquisition is the thing to raise at renewal, not a rate card that does not exist. (levelblue.com newsroom, acquisition completed 19 August 2025; redirect checked July 2026)
Rapid7. InsightVM is a vulnerability scanner and a good one; it is not the thing that signs your ASV scan report. Price the ASV engagement with the ASV. (rapid7.com/solutions/industry/retail, checked July 2026)
Intruder. Intruder does publish a price for its penetration test bolt-on, "Starting from $3,500 / test" (intruder.io/pricing, checked July 2026). Its subscription tiers render their prices only in the browser, so there is no list figure to quote here. (intruder.io/use-cases/compliance/pci, checked July 2026)
What sets your ASV quote
Ask every vendor to price the same answers to these. Quotes for the same estate differ by a multiple mostly because each firm assumed a different scope, and the fix for that is handing all of them the same one.
How many targets
The unit almost every ASV prices in: external IP addresses, hostnames or domains in scope. Count yours before you call anyone. It is the number that moves the quote most, and the one you can shrink.
Network targets or web applications, or both
An application scan is a different product from a network scan at most vendors, and is usually the more expensive one.
Retest and dispute policy
A failed scan must be fixed and rescanned before it passes. Ask whether rescans are unlimited or metered, and whether disputing a false positive is included. This is where a cheap headline price stops being cheap.
Scan frequency above the quarterly minimum
Requirement 11.3.2 sets four passing scans a year as the floor. Teams that ship often scan more, and pay for it.
Bundled or standalone
Several ASVs sell scanning only inside a wider platform or an acquirer package. The standalone price may not exist as a product.
Who attests
Confirm the company signing the report is on the PCI SSC ASV list. Two vendors commonly recommended for PCI scanning are not ASVs and subcontract or defer the attestation.
Penetration testing
Requirement 11.4 makes penetration testing mandatory. It does not price it, and pen test firms do not publish rate cards, so there are no ranges in the table below. The one published price we could find for any of this is Intruder's pen test bolt-on at "Starting from $3,500 / test" (intruder.io/pricing, checked July 2026), and that is a starting price for a scoped product rather than a market rate. What the table gives you instead is the test set the standard actually asks for, how often, and what a firm prices each one against.
| Test type | Requirement | Frequency | What a firm prices it against |
|---|---|---|---|
| External network penetration test | PCI DSS Requirement 11.4.3 | At least annually, and after any significant infrastructure or application change | Count of external IPs and exposed services, how many are bespoke, whether retesting after remediation is included in the fee or billed again |
| Internal network penetration test | PCI DSS Requirement 11.4.2 | At least annually, and after any significant change | Size of the internal estate in scope, number of VLANs and segments, whether the tester works from a supplied foothold or starts blind |
| Application layer penetration test | PCI DSS Requirement 11.4.2 and 11.4.3, at the application layer | At least annually, and after significant change | Number of applications and APIs, count of distinct user roles, authentication flows, whether source code is provided |
| Segmentation validation test | PCI DSS Requirement 11.4.5 (all entities, 12 months) and 11.4.6 (service providers only, six months) | Where segmentation is used to reduce scope: at least every 12 months for merchants, and at least every six months for service providers. Also after any change to segmentation controls or methods | Number of segments and the number of paths between them. This is the bill that arrives because you segmented, and it is still cheaper than not segmenting |
| Wireless access point testing | PCI DSS Requirement 11.2.1 | At least quarterly for detection of unauthorised access points | Number of physical sites, whether detection is automated or a walkthrough |
How to make pen test quotes comparable
- Ask for the price with retesting included and again without it. Remediation retests are the most common line that is not in the headline number
- Ask how many tester days the fee buys. A firm that will not say is not comparable to one that will
- Ask whether the report includes an attestation letter your QSA or acquirer will accept
- Give every firm the same scope document. Different assumed scopes are why three quotes for the same estate can differ by a multiple
- Ask who actually performs the test, and whether it is subcontracted
Check your vendor is on the list first
The PCI SSC publishes a public directory of every Approved Scanning Vendor. It is the only thing that settles whether a vendor can attest your scan. Use it as your filter before you compare anyone on price, and note that it publishes no pricing at all.
Frequently asked
One vendor on this page publishes a price. SecurityMetrics publishes a list price of $399 per year for the product it calls PCI for small businesses, checked July 2026, and its published feature list for that price includes an external vulnerability scan for one IP, an online SAQ, a compliance portal, and reporting to your merchant processor. That is a bundle for a single IP, not an ASV scan rate. Every other ASV named here quotes per engagement and publishes nothing, so we do not print a range for them: a made-up figure next to a company name reads as that company's price, and we do not have it. What decides your quote is mostly how many internet-facing targets you put in scope, because that is the meter this product runs on, followed by whether rescans and disputes are included in the fee or billed again.
Continue reading