CREST-accredited penetration testing Services
PCI DSS Penetration Testing
CodeShield delivers CREST-accredited PCI DSS penetration testing that satisfies Requirement 11.4 and stands up to your QSA. Internal, external and segmentation testing, scoped to your cardholder data environment, delivered in a QSA-ready report that closes out your assessment rather than raising more questions.
No generic checklists. No scan-with-a-cover-page dressed up as a pen test. Just clear, credible results from a dedicated expert who guides you from scoping through to remediation and retesting, so your findings are closed before your assessment date.
Does PCI DSS require a penetration test?
Yes. Unlike some frameworks, PCI DSS leaves no room for interpretation.
Penetration testing is a hard, named requirement under Requirement 11.4. If you store, process or transmit cardholder data, you must perform both internal and external penetration testing, at least every 12 months and after any significant change. This is not best practice buried in a footnote. It is a control your QSA will check, and a report they can reject if it does not meet the standard.
That prescriptiveness is actually good news: there is no guesswork about whether you need testing, only about getting it done properly. We handle exactly that, scoping your cardholder data environment (CDE), running the right tests, and giving you a report built to satisfy Requirement 11.4 first time.
Not sure what falls inside your CDE? Talk it through with a tester on a 15-minute scoping call.
START HERE
Which penetration test do you need for PCI DSS?
PCI DSS testing is scoped around your cardholder data environment: the systems that store, process or transmit card data, and anything that can affect their security. Most organisations need a combination of the following, and we will help you scope your CDE properly on a short call. Requirement 11.4 expects both network-layer and application-layer coverage.
WHY TRUST CODESHIELD
Trusted & Independently verified.
PCI DSS penetration testing for merchants and service providers
If you handle cardholder data in any form, PCI DSS applies to you. We deliver PCI DSS penetration testing across:
Merchants
- Retail and E-commerce: testing the payment pages, checkout flows and platforms that process customer card data.
- Hospitality: securing multi-site networks, booking systems and point-of-sale environments.
- Subscription and Membership businesses: protecting recurring card data and the systems that store it.
Service providers
- Payment Processors and Gateways: testing the platforms other businesses trust with their transactions, to the stricter service provider standard.
- SaaS handling card data: where your platform stores, processes or transmits cardholder data on behalf of your customers.
- FinTech and Financial Services: meeting PCI DSS alongside FCA expectations, protecting payment flows and customer accounts.
- Managed Service and Hosting providers: securing the infrastructure your clients’ cardholder data depends on.
Service providers should note the stricter obligations, including six-monthly segmentation testing and the requirement to support your own customers’ testing. We build this into your programme so nothing is missed at assessment.
When to schedule your PCI DSS penetration test
Timing matters more with PCI than with most frameworks, because Requirement 11.4 expects findings to be remediated and retested before your assessment closes. You should plan a test when:
Not sure how these apply to your assessment date? A quick scoping conversation will map it out.
WHY CODESHIELD – 20+ YEARS EXPERIENCE
You work with the person doing the testing.
At CodeShield, our UK penetration testing team brings 20+ years of combined expertise delivering practical, results-driven security solutions tailored to your business.
You work directly with a fully-qualified pen tester. You meet them before you pay, so you know who you’re working with.
Our Values
What’s in your penetration testing report
The report is where a penetration test earns its value. A test is only as useful as the document that comes out of it, and ours are built to be read and acted on, not filed away. Every engagement ends with a clear, structured report that works for your technical team and your senior stakeholders alike.
See a sample report
Want to see the quality of our reporting before you commit? Download an anonymised sample penetration testing report and see exactly what you’ll receive: the structure, the depth of detail, and the clarity of our remediation advice.
Meet your PCI DSS requirements with confidence
Many organisations come to us because their QSA, or an acquiring bank, requires an independent penetration test that meets Requirement 11.4. We make that requirement straightforward to satisfy, and turn a mandatory control into genuine security improvement.
Our testing also supports the other frameworks you are likely running alongside PCI DSS:
- ISO 27001: independent testing to evidence your information security controls.
- SOC 2: assurance for the security criteria your customers and auditors expect.
- Cyber Essentials Plus: hands-on assessment beyond the self-certified baseline.
- NHS DSP Toolkit: testing aligned to data security standards for health and care organisations.
- FCA and Financial Services requirements: supporting the security expectations placed on regulated firms.
A well-scoped engagement can often generate evidence for more than one framework at once. You will receive a clear, QSA-ready report that maps findings to Requirement 11.4, with practical remediation advice to close the gaps, not just document them.
LIVE REPORTING
Stay informed throughout your penetration test with real-time access to findings through our secure client portal.
Stay informed throughout your PCI DSS penetration test with real-time access to findings through our secure client portal.
As vulnerabilities are identified, they are immediately available for your team to review, giving you complete visibility as the assessment progresses. Any High or Critical findings are communicated straight away via your agreed contact channels, so urgent risks are never left waiting until the final report.
Our collaborative approach also allows for interactive re-testing during the engagement. As fixes are implemented, our consultants validate them in real time, helping you close findings before your assessment date, exactly the remediation-and-retest cycle Requirement 11.4 expects. At the end of the engagement, your portal is updated with the final quality-assured report: a comprehensive, QSA-ready record of the assessment, findings, remediation guidance and supporting evidence.
TRUSTED UK PENETRATION TESTERS
Contact CodeShield today to get your PCI DSS pen test quote
At CodeShield, our UK penetration testing team brings 20+ years of combined expertise delivering practical, results-driven security tailored to your business.
Penetration testing FAQs
Yes. Our support doesn’t end at the report. Once you’ve addressed the findings, we can retest to confirm the fixes are effective, giving you and your stakeholders verified assurance that the risks have been closed.
Yes. Our support doesn’t end at the report. Once you’ve addressed the findings, we can retest to confirm the fixes are effective, giving you and your stakeholders verified assurance that the risks have been closed.
The cost depends on scope: the size and complexity of your network, the number of live hosts and sites, and whether you need internal testing, external testing, or both. Rather than quote a misleading flat rate, we scope every engagement individually so you only pay for testing that delivers real value. Get in touch for a tailored quote.
In black box testing the tester has no prior knowledge of the application. In white box testing they have full access to code and documentation. Grey box sits in between, with partial knowledge for a realistic yet efficient assessment. We’ll help you choose the right approach for your goals during scoping.
A vulnerability scan is automated and flags known issues. A penetration test adds expert human analysis, actively exploiting weaknesses to understand the real business impact and uncovering the misconfigurations, credential issues, and lateral movement paths that scanners simply cannot find.
Yes. Most organisations build on commercial models rather than training their own, so we focus on how you’ve implemented and integrated that model, your prompts, data connections, guardrails, and permissions, which is where the risks you can actually control live.
The cost depends on scope: the size and complexity of the application, the number of user roles and APIs, and the depth of testing required. Rather than quote a misleading flat rate, we scope every engagement individually so you only pay for testing that delivers real value. Get in touch for a tailored quote.
We start with a scoping conversation to understand your environment, objectives, and any constraints. Together we define exactly what’s being tested, the rules of engagement, and the timeline, ensuring the test aligns with your goals while minimising any risk of disruption.
