SecurityMetrics ASV scan cost 2026: the one published price, read properly

What SecurityMetrics actually publishes

SecurityMetrics publishes a list price of $399 per year for the product it calls "PCI for small businesses", checked July 2026. Its published feature list at that price runs: "External Vulnerability Scan (1 IP)", "Online PCI Self Assessment Questionnaire (SAQ)", "Online compliance reporting portal", "Non-compliance notification", "Compliance reporting to merchant processor", "Compliance certificate", "PANscan® (Card discovery software for 1 machine)", "Service warranty (Up to $100,000 reimbursement in case of a breach)", and "Security Awareness Training (1 seat)". The page carries one asterisk: "Price discounts available depending on merchant processor."

That is the entirety of what is published, and the shape of it matters as much as the number. It is a bundle, not an ASV scan rate. It covers one IP. And there is no published tier table above it: SecurityMetrics' own general pricing page says "SMB pricing varies based on packages from your acquiring bank", and its scanning material says your scope is evaluated to give you a custom quote. If you find a tier ladder by IP count attributed to SecurityMetrics anywhere, it did not come from SecurityMetrics.

So the useful way to hold this: $399 a year is a real, checkable floor for the smallest possible merchant, and it is the only public price point in the ASV market. If your footprint is one IP and a hosted checkout, it tells you what good looks like. If it is anything larger, your price is a quote and this figure is an anchor to open with rather than a number to budget against.

Above one IP, you are in the quote market like everyone else

There is no published SecurityMetrics price for a larger footprint, so this page does not print one. What decides it is the same set of drivers every ASV prices against: how many internet-facing targets are in scope, whether they are network targets or web applications, whether rescans and disputes are included in the fee or billed again, and whether you are buying scanning on its own or alongside anything else.

The rescan question is the one that most often turns a cheap headline into an expensive year. Requirement 11.3.2 wants four passing scans annually, not four attempts, so a metered rescan policy on a noisy estate can cost more than the subscription. Ask for it in writing, from every vendor, before you compare any two prices.

If you are buying for more than a handful of merchants, as a franchise network, a multi-location retailer or a payment facilitator with downstream sub-merchants, say so in the first conversation rather than the last. One contract covering many merchants is a structurally different negotiation from buying per merchant, and it is the shape this end of the market is built around. We attach no discount figure to that, because none is published.

Where SecurityMetrics fits, and where it does not

It fits the small merchant whose requirement is quarterly scanning of a small internet-facing footprint plus an SAQ, and who wants one annual purchase covering both. The published bundle is built for exactly that buyer, and the acquirer-portal channel is built to reach them at volume. If your processor already surfaces it, that is usually the path of least friction as well as least cost.

It fits less well where ASV scanning is one capability you want inside a wider vulnerability management platform. Qualys and Tenable sell ASV scanning attached to their own platforms, which is good value if you will use the platform and poor value if you are reaching past everything else to touch one feature. Neither publishes a price, so that comparison has to be made on quotes against your real target count rather than on anything either of us can look up. Note also that the ASV scan is external only by definition, so authenticated internal scanning under Requirement 11.3.1 is a separate question from whoever attests your quarterly external scan.