SecurityMetrics ASV scan cost 2026: SMB quarterly scanning pricing read

The SecurityMetrics ASV pricing model in plain English

SecurityMetrics publishes a transparent retail rate card for PCI ASV scanning on the public website. The pricing tiers are tied to internet-facing IP count rather than to vague "asset count" definitions, which makes budget planning straightforward. Entry tier covers up to 5 IPs at roughly $99 to $199 per year. Small business tier covers 5 to 25 IPs at $200 to $500 per year. Mid-market tier covers 25 to 100 IPs at $500 to $1,200 per year. Enterprise scoping (100+ IPs) crosses into custom quotes that typically remain competitive with Qualys standalone at that tier.

The bundled SAQ-plus-ASV product is where SecurityMetrics' commercial differentiation genuinely lands. For a typical Level 4 e-commerce merchant on SAQ A with 1 to 5 internet-facing IPs, the bundled annual fee of $200 to $400 covers SAQ A attestation, quarterly ASV scanning, attestation submission to the acquirer, and basic compliance portal access. The unbundled equivalent of buying SAQ attestation assistance from a consultant plus standalone PCI ASV scanning would run $500 to $1,500. The bundle saves materially and removes coordination overhead between two vendors.

Multi-year terms typically discount the year-one fee 10 to 15 percent for a three-year prepay on portal-tier products. For volume buyers (franchise networks, multi-location retailers, payment facilitators with downstream sub-merchants), volume pricing is genuinely competitive versus per-merchant ASV purchasing through other ASVs.

Three concrete cost scenarios

Anchored to the SecurityMetrics published rate card. The bundled SAQ-plus-ASV pricing is the most accessible PCI compliance path for Level 4 merchants.

The acquirer-portal pricing context

Many SMB merchants encounter SecurityMetrics not through direct purchase but through their acquiring bank's PCI compliance portal. Acquirer banks (TSYS, Worldpay, Global Payments, Heartland, Elavon) frequently white-label the SecurityMetrics compliance portal as part of the merchant agreement, with the SAQ-plus-ASV product priced into the merchant's monthly processing fee rather than as a discrete annual invoice. This is genuinely the cheapest legitimate path to PCI compliance for SMB merchants and is fundamentally the same SecurityMetrics product delivered through a different channel.

The acquirer-portal channel typically prices lower than the direct-buyer rate card because the acquiring bank subsidises a portion of the cost to drive merchant compliance throughput. For merchants on TSYS, Worldpay, or similar acquirers, using the acquirer's bundled portal is essentially always the cheapest option. The trade-off: portal customisation is limited, and merchants who want unusual configurations may need to fall back to direct SecurityMetrics purchase.

Merchants who switch acquirers periodically find this is a meaningful coordination friction: the SecurityMetrics relationship resets each time the acquirer changes, and SAQ workflow history does not always carry forward. For merchants stable on a single acquirer, the acquirer-portal channel is operationally smooth.

When SecurityMetrics ASV wins and when it does not

SecurityMetrics ASV wins for SMB merchants with up to 25 internet-facing IPs (cheapest mainstream ASV at this tier), for Level 4 merchants who want the bundled SAQ-plus-ASV product (genuinely the most cost-effective PCI compliance path), for merchants whose acquirer surfaces SecurityMetrics via portal partnership (typically the lowest total cost), and for merchants who value the failed-scan remediation experience over enterprise-grade vulnerability management reporting.

SecurityMetrics ASV does not win for enterprises with broader vulnerability management needs (Qualys VMDR, Tenable.io, or Rapid7 InsightVM consolidate VM stacks better), for buyers who need authenticated internal scanning alongside ASV (SecurityMetrics ASV is external-only; the SecurityMetrics broader product does include internal scanning but is priced for SMB rather than enterprise), or for buyers who want integration with enterprise SIEM platforms (the standalone ASV product does not have meaningful SIEM integration depth).

Negotiating with SecurityMetrics on ASV

Negotiation room is minimal on direct-buyer SAQ-plus-ASV pricing because the rate card is published and SMB economics genuinely depend on volume throughput rather than per-account margin. For volume buyers (franchise networks, payment facilitators, multi-location retailers), genuinely competitive volume pricing is available and can produce 25 to 40 percent below the per-merchant rate card for 100+ merchant deals.

For merchants moving from another ASV to SecurityMetrics, mention the existing-vendor relationship explicitly during the initial quote conversation. SecurityMetrics will often waive the first-year setup cost or include a free re-scan allowance for new customers transitioning in mid-cycle from Qualys or Tenable. This is not advertised but is consistently offered to credible competitor-migration buyers.