PCI DSS Penetration Testing Requirements: Requirement 11.4 Explained (2026)

Here is the position every payment company is in right now. Your QSA will not sign your Report on Compliance (ROC) or Attestation of Compliance (AOC) until you hand them a current Requirement 11.4 penetration test — internal and external, scoped to your entire cardholder data environment. Miss it, or scope it wrong, and the consequences are not theoretical: a failed assessment, an acquiring bank that throttles or blocks your ability to process cards, and monthly non-compliance fees that dwarf the cost of the test itself.

And since PCI DSS v4.0.1 became mandatory on 31 March 2025, the clock does not just reset once a year — it resets after every significant infrastructure or application change. Ship a new checkout flow, migrate a database, add a service inside the CDE, and you have created a new testing obligation.

Most teams answer this the expensive way: they buy a single, five-figure, point-in-time manual pentest, sweat through three weeks of scheduling and back-and-forth, then hope nothing changes for the next twelve months. It always changes. This guide breaks down exactly what the PCI DSS penetration testing requirements demand, what a QSA actually needs to see, and how to stay continuously in-scope — without a five-figure invoice every time your environment moves.

Requirement 11.4 is the section of PCI DSS v4.0.1 that mandates penetration testing. It is not a vague “test your security” clause — it is six specific, auditable sub-requirements:

11.4.1 — a defined, documented penetration-testing methodology covering the external and internal layers, the application and network layers, and segmentation. 11.4.2 — internal penetration testing. 11.4.3 — external penetration testing. Both 11.4.2 and 11.4.3 must be performed at least once every 12 months and after any significant upgrade or change. 11.4.4 — any exploitable vulnerability found must be corrected and the test repeated to verify the fix. 11.4.5 and 11.4.6 — the controls that isolate your cardholder data environment must themselves be penetration-tested.

Requirement 11.4 — sub-requirements

The scope is the cardholder data environment (CDE): every system that stores, processes, or transmits cardholder data, plus anything that can affect its security. Your test has to hit it from two directions — the external internet-facing surface and the internal surface reachable from inside your network — and at two layers: the network layer and the application layer.

This is where most first attempts fail their QSA: the pentest covered the public website but never exercised the internal APIs, the admin panels, or the segmentation controls that are supposed to keep the CDE small. If a segmentation control fails, everything on the other side of it just entered your PCI scope.

What must be in scope

The headline cadence is at least every 12 months for internal and external penetration testing, plus after every significant change. Segmentation testing is where merchants and service providers diverge: merchants test segmentation controls every 12 months; service providers must test them every 6 months. If you are a processor, gateway, or hosting provider, you are on the twice-a-year clock.

The “after every significant change” clause is the one that quietly breaks annual-only programs. A point-in-time report is a snapshot; the moment you deploy a meaningful change, that snapshot no longer reflects reality — and your compliance obligation has already re-triggered.

Cadence — merchants vs service providers

A traditional manual PCI penetration test runs roughly $10,000–$30,000 and lands as a PDF that is accurate for about a day. Then your environment changes and you are out of coverage until the next annual cycle — or you pay again for a re-test. That is a lot of money for a snapshot, and it leaves you blind for 361 days out of 365.

Pentestas is pentesting as a service: an AI penetration testing system that runs 11.4-aligned internal and external tests on your cardholder data environment continuously — automatically, after every deploy — starting at $79/month. It is penetration testing with AI at the core, orchestrated by frontier models (we run penetration testing with Claude for deep reasoning and cost-controlled penetration testing with DeepSeek for high-volume passes), delivered as a B2B SaaS pentest platform that maps findings straight to the PCI requirement they satisfy.

The cost of staying compliant

The platform exercises the external surface from the internet and the internal surface through a lightweight agent deployed inside your network, so a single engagement covers both 11.4.2 and 11.4.3. It tests the application and network layers, checks the segmentation controls that keep the CDE isolated, and — critically for 11.4.4 — re-tests every exploitable finding after you fix it, capturing the before-and-after evidence your QSA wants. Because it re-runs after every change, the “significant change” obligation is handled automatically instead of becoming a fire drill.

Every finding ships with real exploit evidence, a severity rating, and remediation steps — the audit-ready artifacts that make a QSA conversation short instead of painful.

Point-in-time vs. continuous coverage

Bottom line: PCI DSS Requirement 11.4 is not satisfied by one lucky PDF a year. It rewards continuous coverage of the whole cardholder data environment, internal and external, re-tested after every change. That is exactly the shape of the problem an AI penetration testing system is built to solve — and it costs a fraction of what you are paying to be compliant for one day out of the year.