Approved Scanning Vendor (ASV)

An Approved Scanning Vendor (ASV) is a company certified by the PCI SSC (PCI Security Standards Council) to conduct external vulnerability scanning services as part of PCI DSS compliance validation. ASV scans are required quarterly for all merchants and service providers in scope for PCI DSS that have internet-accessible IP addresses, effectively any business with an internet-facing payment environment.

An ASV scan is an automated security scan of a defined set of internet-facing IP addresses and domains, conducted from the public internet to identify vulnerabilities that external attackers could exploit. The scan checks for known vulnerabilities in web servers, network devices, applications, and services, comparing the discovered configurations and software versions against a database of known weaknesses and CVEs (Common Vulnerabilities and Exposures). The ASV produces a scan report indicating whether the scan passed (no high-severity findings) or failed (one or more findings that must be remediated before the scan can pass).

ASV scans are distinct from Penetration Testing: they are automated and comprehensive in breadth but limited in depth, they identify known vulnerability signatures but do not attempt to exploit them or identify complex attack chains. Passing an ASV scan is a necessary condition for PCI DSS compliance but not sufficient on its own.

For merchants validating through an SAQ (Self-Assessment Questionnaire), quarterly passing ASV scan reports must be submitted to the acquiring bank along with the completed SAQ. Failing an ASV scan triggers a remediation process: the merchant must address the findings and arrange a rescan until a passing result is achieved.