PCI DSS treats vulnerability scans (11.3), penetration tests (11.4) and application security assessments (6.4.1) as separate activities with different frequency, performers and goals. A scan finds known weaknesses automatically, a pen test tries to exploit them, and an application assessment reviews public-facing web apps. One does not replace another. This is not legal advice.
Definitions
Vulnerability scan: an automated check for known weaknesses. Requirement 11.3.1 covers internal scans and 11.3.2 covers external scans.
Penetration test: a human led attempt to exploit weaknesses, following a documented methodology (11.4.1).
Application security assessment: a review of public-facing web applications under 6.4.1, by manual or automated tools or methods, as an alternative to an automated technical solution such as the one in 6.4.2.
Comparison
| Internal scan 11.3.1 | External scan 11.3.2 | Pen test 11.4.2 and 11.4.3 | App assessment 6.4.1 | |
|---|---|---|---|---|
| Frequency | At least every three months | At least every three months | At least every 12 months and after significant change | At least every 12 months and after significant change |
| Who | Qualified, reasonably independent staff or a firm | A PCI SSC Approved Scanning Vendor | Qualified internal resource or external third party, independent | An entity that specializes in application security |
| QSA or ASV required | No | ASV required | No | No |
| Goal | Find and resolve high-risk and critical issues, then rescan | Pass per the ASV Program Guide | Test whether weaknesses can be exploited, including segmentation | Review web apps against the common attacks in 6.2.4 |
Points that trip teams up
The 6.3.1 vulnerability process is not the same as a scan. The SAQ D note says 6.3.1 is "not achieved by, nor is it the same as" the scans in 11.3.1 and 11.3.2.
The 6.4.1 assessment is also "not the same as" the 11.3 scans. And the SAQ D text for 11.4.2 and 11.4.3 says the tester does not have to be a QSA or ASV, but must be independent of the systems tested.
An ASV is, per PCI SSC, an organization whose scan solution is tested and approved by the Council. Approval does not mean endorsement.
Which should you schedule first?
- Put the quarterly scan dates on a calendar. They recur most often.
- Pick the 6.4.2 automated solution or the 6.4.1 assessment for each public web app, and record why.
- Book the annual pen test early enough to remediate and retest.
- Keep all reports and rescan evidence together.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what a web application scan reports.
Quick check
Can an internal scan replace the external ASV scan?
No. 11.3.2 requires external scans by an ASV, and 11.3.1 covers internal scans separately.
Does a clean scan mean I can skip the pen test?
No. 11.4 sets its own methodology, frequency and independence rules.
On Safeguard: its free scan at gold.safeguard.sh/scan checks dependencies for known vulnerabilities. It does not replace an ASV scan, a penetration test or an assessor's judgement.
Sources
Last reviewed: 19 October 2026.
