Under PCI DSS 4.0, requirement 6.4.2 calls for an automated technical solution in front of public-facing web applications that continually detects and prevents web-based attacks. It replaced 6.4.1, which let you choose between an assessment and such a solution. The 6.4.2 text does not name a product type. This is not legal advice.
Definitions
Public-facing web application: a web app reachable from outside your network, such as a checkout or account portal.
Automated technical solution: per the SAQ D wording, one that is installed in front of public-facing web applications, actively running and up to date, generating audit logs, and configured to block attacks or raise an alert that is investigated immediately.
What changed from 6.4.1 to 6.4.2
| 6.4.1 | 6.4.2 | |
|---|---|---|
| Option 1 | Assess apps manually or with tools at least every 12 months and after significant change | Not offered |
| Option 2 | Automated solution | Automated solution is the requirement |
| Status | Superseded after 31 March 2025 | Recommended until 31 March 2025, then required for assessment |
The SAQ D applicability notes state that 6.4.2 "will replace Requirement 6.4.1 once its effective date is reached." PCI SSC's v4.0.1 announcement says the 31 March 2025 date did not change. Read FAQ 1564 on how future-dated items are reported before and after their effective dates.
What counts as meeting the intent
The text lists four properties. It does not specify a vendor or product category, so what you choose is a matter for you and your assessor. Typical elements:
- A control inline with web traffic.
- Rules that stay current.
- Logs you retain and review. Our post on application logging lists fields.
- A documented response when an alert fires.
An annual assessment is still useful because it finds logic flaws a filter will not. It is just no longer the stand-alone route in 6.4.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a scan reports web app findings.
Quick check
Is a web application scan the same as 6.4.2?
No. 6.4.2 is an automated solution that continually detects and prevents attacks. Scanning is a separate activity.
Does 6.4.2 apply to internal apps?
The text covers public-facing web applications. Check your scope with your assessor.
On Safeguard: dependency scanning and policy gates help catch known vulnerable components before release. That does not replace the inline control 6.4.2 describes. Try the free scan at gold.safeguard.sh/scan.
Sources
- PCI DSS v4.0 SAQ D for Merchants (PCI SSC, April 2022)
- Just Published: PCI DSS v4.0.1 (PCI SSC blog)
- PCI SSC FAQ 1564
Last reviewed: 19 October 2026.
