1per year
PCI DSS sets a minimum
PCI DSS requires external and internal penetration testing at least once every 12 months and after significant changes.
Source: PCI DSS v4.0, requirement 11.4
- Home
- Cyber Security
- Penetration testing
Find the way in before someone else does.
A penetration test is an authorised, controlled attempt to break in, so you learn where the weaknesses are on your terms. The value is not the report. It is the findings fixed and proved closed.
What it covers
Penetration testing
External testing
Internet facing systems, remote access and email defences tested the way an outside attacker would approach them.
Internal testing
What an attacker could reach after compromising one laptop or account: lateral movement, privilege escalation and data access.
Web application testing
Client portals and web applications tested for common and business logic vulnerabilities.
Cloud and Microsoft 365
Configuration and identity weaknesses in Azure, AWS and Microsoft 365.
Vulnerability scanning
Ongoing scanning between tests, so new weaknesses are found in weeks, not at the next annual test.
Remediation and retest
Every finding tracked to closure and retested to confirm it is fixed.
- PCI DSS v4.0
- OWASP
- ISO/IEC 27001
- CIMA Rule on Cybersecurity
How we do it
Scope
Targets, rules of engagement and timing agreed in writing.
Test
Testing carried out within the agreed limits.
Report
Findings ranked by risk, with clear fixes.
Retest
Fixes verified and the result recorded.
Field notes
Worth knowing
Mar2025
PCI DSS v4.0 is fully in force
The future dated requirements of PCI DSS v4.0 became mandatory on 31 March 2025.
Source: PCI Security Standards Council
What you receive
- Scoping document and rules of engagement
- Technical findings report
- Executive summary for management
- Remediation tracker
- Retest confirmation
Questions
How often should we have a penetration test?
At least annually, and after significant changes to systems or applications. Regulated and card handling businesses may have specific requirements.
Will testing disrupt our systems?
Testing is scoped and timed to avoid disruption. Higher risk tests can be run out of hours or against test environments.
What is the difference between a vulnerability scan and a penetration test?
A scan is automated and finds known weaknesses. A penetration test adds a skilled tester who chains weaknesses together to show what an attacker could really achieve.
More on Cyber Security
Talk to us about penetration testing
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.
info@gabcoenterprises.com+1 345 769 4222