Meet PCI DSS scan requirements
Schedule PCI ASV scans with Clone Systems, an approved scanning vendor, and get your compliance reports in your Detectify dashboard.
Where PCI ASV Scanning fits
Every product runs on the same Discovery layer. PCI ASV Scanning adds the scans and reports PCI DSS requires from your Detectify account.
Discovery
The system of record for your attack surface. Every asset flows through Discovery, so assessments read from it and findings feed back into it.
How PCI ASV Scanning works
Add your PCI scope and pick a schedule
Add the public domains, IP addresses and IP ranges that are part of your cardholder data environment, and choose monthly or quarterly scans. Detectify sets up the scan with Clone Systems, and it runs on your schedule without anyone starting it, so you don't miss the 90-day deadline and can keep accepting card payments.
- Domains, IP addresses and IP ranges
- Monthly or quarterly schedule
- No separate Clone Systems account
Scanned by an approved scanning vendor
Scans run from Clone Systems' certified ASV scanners, and the ASV certification comes from Clone Systems. They're external and unauthenticated, like an attacker on the internet, so you don't share credentials or network access.
- Certified ASV scanners from Clone Systems
- External, unauthenticated scans
- No credentials, SSH keys or VPN access needed
The reports your bank asks for
When a scan finishes, Detectify pulls in the reports and makes them available to download from your dashboard. A passing scan gives you the attestation you submit to your acquiring bank or QSA.
- Attestation of Scan Compliance
- Executive summary and detailed findings reports
- Remediation report with steps to fix each finding
Fix what fails and scan again
Findings with a CVSS score of 4.0 or higher fail the scan, with a few exceptions set by the PCI Council. Each one comes with its severity, the affected host, and remediation guidance. Fix it and rescan from Detectify.
- Severity, affected host and remediation for every finding
- Rescan as often as you need within your scan window.
- Dispute false positives for review by Clone Systems' ASV team
PCI scans next to the rest of your attack surface
PCI ASV scans live in the same dashboard, asset inventory and notifications as the rest of Detectify. With Surface Monitoring, you also see what changes between PCI scans, not just a snapshot every 90 days.
- In-app and email alerts when a scan completes
- Same dashboard and asset inventory as your other scans
- Visibility between scans with Surface Monitoring
Where security teams put PCI ASV Scanning to work
Quarterly compliance
Stay inside the 90-day window
PCI DSS requires a passing ASV scan at least every 90 days. Schedule scans once and they run on their own, with an alert when each one completes.
Customer requirements
Give customers the proof they ask for
Enterprise customers and banks can ask for a passing ASV scan before they sign. Download the attestation of Scan Compliance (AoSC) and reports from your dashboard when they do.
Tool consolidation
Drop the separate PCI portal
Run PCI ASV scans in the same place as the rest of your external security testing, instead of a separate portal with its own login and workflow.
PCI ASV Scanning took 30 seconds to set up. That’s it. Much simpler, much easier, and hands-off.
FAQs
Everything an attacker on the internet could see and probe on the systems in your PCI scope: outdated software with known flaws, weak or outdated TLS and invalid certificates, open ports and unnecessary services, web vulnerabilities like SQL injection and cross-site scripting, default or weak credentials, and misconfigurations like directory listings or exposed .git files.
Scans run from Clone Systems' certified ASV scanners, and each finding comes with its severity and the affected host. If a finding is a false positive or doesn't apply to your environment, dispute it through Detectify and Clone Systems' ASV team reviews it.
No. PCI ASV scans are external and unauthenticated, so you don't share usernames, passwords, SSH keys or VPN access. Add the public domain or IP address of every internet-facing system in your cardholder data environment, and make sure your firewall, WAF or IPS lets the Clone Systems scanners reach them. We can share the scanner IP ranges to allowlist.
PCI DSS requires a passing ASV scan at least once every 90 days, so four passing scans a year. After a significant change, like a firewall update or network reconfiguration, you also need to scan again. Achieving a pass means fixing every finding with a CVSS score of 4.0 or higher.
You get a report with every failing finding, its severity, the affected host and remediation guidance. Fix the issues and rescan from Detectify, as often as you need within your scan window. Only a passing scan gives you an attestation to submit to your acquiring bank or QSA.
PCI ASV scans are required to be non-disruptive, and they're designed to be safe to run against production. The most common problem is a WAF, IPS, or rate limiter blocking the scanner, which can make a scan fail or miss findings. Allowlist the Clone Systems scanner IPs to avoid it, or schedule scans for low-traffic hours.
Surface Monitoring continuously finds and tests everything you have on the internet. PCI ASV Scanning is the formal scan PCI DSS requires, run by an approved scanning vendor on the scope you define, and it produces the attestation for your bank. Both show up in the same dashboard.
Talk to sales about pricing for PCI ASV Scanning.
Surface Monitoring
Finds the domains, subdomains, IPs and open ports you have on the internet, and recommends which apps need a deeper scan.
Learn more about Surface Monitoring
Application Scanning
Crawls and fuzzes the web apps you build, including single-page apps and the parts behind login.
Learn more about Application Scanning
Internal Scanning
The same payload-based testing for internal apps, through an agent that only connects outbound.
Learn more about Internal ScanningSchedule your next PCI ASV scan
Scans by an approved scanning vendor, with the reports you need in your Detectify dashboard.