Penetration Testing (Pen Test)

A penetration test (pen test) is a simulated cyberattack conducted by a security professional against an organization's systems, networks, or applications with the explicit goal of identifying exploitable vulnerabilities before malicious actors do. In the context of PCI DSS compliance, penetration testing is a mandatory control, PCI DSS Requirement 11.4 requires that internal and external penetration tests be conducted at least annually and after any significant infrastructure or application change.

Unlike automated vulnerability scanning, a penetration test is conducted by a human tester who actively attempts to exploit discovered vulnerabilities, just as a real attacker would. This human-led approach identifies vulnerabilities that automated tools miss: complex attack chains, logic flaws in application code, social engineering vectors, and vulnerabilities that only become exploitable in combination. The output is a detailed report of exploitable findings, ranked by severity, with remediation recommendations.

PCI DSS v4.0.1 specifies that penetration tests must cover both network-layer and application-layer testing, must validate network segmentation (confirming that systems outside the Cardholder Data Environment (CDE) genuinely cannot reach systems inside it), and must be conducted by qualified personnel with organizational independence (internal testers who are separate from the systems being tested, or external testers). Testing methodology must follow industry-accepted frameworks such as NIST SP 800-115 or the OWASP Testing Guide.

For Level 1 merchants and service providers, penetration test results and remediation evidence are reviewed as part of the QSA assessment. For merchants using SAQ A-EP or SAQ D, penetration test documentation must be maintained and available for review.