PCI Compliant Checkout: Hosted, iFrame or API? Which SAQ
Hosted page, iFrame or API? See which SAQ each PCI compliant checkout option triggers, which scans and scripts you must cover, and how to choose
Choosing an ASV vendor doesn’t have to feel like a high-stakes decision, but getting it wrong can cost you time, money, and a clean compliance record. The right Approved Scanning Vendor makes quarterly PCI scans feel like a minor routine task; the wrong one turns every scan cycle into a frustrating back-and-forth with unhelpful reports and slow support.
Here’s something worth knowing upfront: every ASV on the PCI Security Standards Council’s official list has passed the same baseline certification. The tools have been tested, the processes have been reviewed, and the vendor has been approved. So far, so equal. But certification is just the entry requirement.
What actually separates one ASV scan provider from another is everything that happens around the scan, the quality of the reports, the clarity of the remediation guidance, the responsiveness of the support team, and whether the pricing makes sense for a business your size.
This guide is designed to give you a clear framework for approved scanning vendor selection without drowning you in technical detail. Whether you’re an SMB owner who just received a PCI compliance questionnaire and isn’t quite sure what you’ve got yourself into, or an IT manager comparing vendors for a mid-market organisation, the questions and criteria in this article will help you make a confident, informed choice. Let’s walk through what actually matters.
Approved Scanning Vendor (ASV): A company whose scanning tools and processes have been tested and certified by the PCI Security Standards Council (PCI SSC), authorised to perform external vulnerability scans required under PCI DSS Requirement 11.3.2.
PCI DSS (Payment Card Industry Data Security Standard): A set of security requirements established by the major card brands, Visa, Mastercard, Amex, and others that any business storing, processing, or transmitting cardholder data must comply with.
External Vulnerability Scan: An automated scan of your internet-facing IP addresses and systems, conducted from outside your network perimeter, to identify publicly exposed security vulnerabilities that could be exploited by attackers.
False Positive: A scan result that flags a vulnerability that doesn't actually exist or isn't exploitable in your environment. Handling false positives correctly through a formal dispute process is one of the key responsibilities of a good ASV partner.
The best ASV vendor for your business is the one that combines PCI SSC-approved scanning with support that matches your technical level, pricing that fits your budget, and reporting that actually helps you understand what to fix and why.
It’s tempting to assume all ASV vendors are basically the same once they’ve cleared the PCI SSC certification bar. In theory, they’ve all passed the same tests. In practice, the experience of working with them can be wildly different.
Some vendors offer rich, well-structured reports with clear remediation steps. Others produce dense, difficult-to-parse output that leaves you guessing what to do next. Some have responsive, knowledgeable support teams. Others have a ticketing system that moves at a glacial pace.
For SMBs, especially, the support dimension is where this decision really plays out. If you’re not running a full in-house security team, you need a vendor partner who will actually walk you through what a scan result means, not one who hands you a PDF and considers the job done. That’s not a nice-to-have; it’s fundamental to whether your compliance programme actually works.
Pricing is another area where vendors diverge significantly. Some charge per IP address, some charge per domain, and some offer flat annual packages. For a small business with a handful of internet-facing IPs, an annual flat-rate model typically offers the best value and the least billing-related stress.
What you want to avoid is a pricing structure where your costs unexpectedly climb as your environment grows or as you add more scan targets, so ask the question directly before you commit. A vendor worth working with will give you a straight answer.
The good news for SMBs is that ASV scanning is genuinely one of the more affordable parts of a PCI compliance programme. Getting it right early with a vendor whose pricing and support model fits your business means one less compliance headache to manage going forward.
Before selecting an approved scanning vendor, ask about their scan frequency and scheduling flexibility, how they handle disputes and false positives, what their reports include beyond the mandatory PCI SSC fields, what support is available and in what format, and how their pricing scales with your environment.
This is binary. A vendor either appears on the PCI Security Standards Council's official Approved Scanning Vendor list with Active status, or their scans don't count toward PCI DSS compliance. No workarounds exist.
The market contains scanning tools that use PCI-adjacent language, "PCI-ready," "compliance-grade scanning", and "PCI vulnerability assessment" without holding actual ASV certification. These terms are marketing copy, not regulatory standing. A QSA or acquiring bank will request the scan attestation, and if the vendor isn't on the official PCI SSC list, that document has no compliance value.
How to verify: Go to listings.pcisecuritystandards.org and search by the vendor's legal entity name, not their product name, which may differ. Confirm the status column shows Active, not Expired. Note the certificate number for your records.
Red flag: A vendor who can't immediately point you to their specific listing entry, or who describes themselves as "PCI-compliant" without linking to an active ASV certification.
Most merchants assume all ASV scan reports look the same. They don't, and that discovery tends to happen at the worst possible moment.
The PCI SSC specifies mandatory fields for a compliant attestation: an executive summary, per-vulnerability detail with CVSS scores, documentation of scan scope, attestation of completion, and dispute documentation where applicable. Vendors have discretion in how they format and present this.
Some produce structured reports that QSAs process without friction. Others produce exports that technically contain the required data in a layout that generates questions and delays.
Beyond format, there's a meaningful quality difference in the usefulness of remediation guidance. A report that hands you a CVSS score and a CVE number is technically a deliverable. A report that explains what the vulnerability means in the context of your environment and tells you what a fix actually looks like is what experienced compliance teams actually need, especially when findings need to be communicated to engineers without a security background.
How to verify: Request a sample pass scan report before purchasing. Any legitimate ASV will provide a redacted sample without hesitation. Check for: vendor name and PCI SSC certificate number, documentation of scanned IPs and domains, scan date and status, and formal attestation language. If you work with a QSA, ask whether they've received and accepted reports from this vendor before.
Red flag: A vendor who won't share a sample report. Also, reports that are raw CSV or data exports with no attestation language are outputs, not compliance documents.
This is the most underrated criterion on this list and the one that generates the most post-purchase frustration.
ASV scans routinely flag vulnerabilities on CDN edge nodes, WAF-protected assets, load balancer IPs, or third-party infrastructure that sits in front of your environment but isn't yours to patch. These are false positives in the compliance sense: technically detected findings that don't represent exploitable risk in your actual cardholder data environment.
Before a scan can be marked passing, any disputed findings must be formally reviewed and accepted by the ASV, per the ASV Program Guide. This process runs directly between you and your ASV, not through the PCI SSC.
How fast that process runs, and what it costs, varies significantly between vendors. Some resolve disputes in three to five business days with a straightforward documentation process. Others operate on generic support tickets with no SLA, review disputes manually weeks later, and charge per-dispute fees that appear nowhere in the original pricing.
Questions to ask before purchasing:
Red flag: No published dispute process. Disputes are routed through a general support inbox with no stated turnaround. Per-dispute fees that aren't disclosed upfront, they may be legitimate at some vendors, but should never be discovered after the fact.
A slow scan isn't merely inconvenient. It creates real operational problems.
A scan that takes six to eight hours and runs during business hours can trigger rate limiting on shared hosting environments, generate noise in application monitoring systems, or push your compliance timeline past the quarterly window if you're working close to a deadline.
The range in the market is significant: some vendors complete a standard five-IP scan in under 30 minutes; others take the better part of a day. That difference compounds across four quarters.
On-demand scheduling matters equally, and for a specific reason. When a scan fails due to a remediable vulnerability, you want to rescan immediately after the fix is deployed, not on the next scheduled calendar slot.
A vendor whose only option is a pre-scheduled monthly or quarterly window removes your ability to close the loop quickly and can push a compliance deadline past the quarterly requirement if the original scan runs late in the quarter.
Questions to ask:
Red flag: Vendors with no on-demand scan option. Scheduled-only models that can't accommodate same-day rescans after remediation.
This is the cost trap that most first-time ASV buyers miss completely.
The reality of quarterly scanning is that your first scan will almost always find something. Any CVSS 4.0 or above finding must be remediated or formally accepted before the scan is marked passing. That means at least one rescan per quarter is expected, and in complex environments, two or three is common.
Vendors structure this in fundamentally different ways. Some include unlimited rescans in the base price. Others charge a flat fee per rescan. Others charge per-IP per rescan. The sticker price is identical in all three models until you're three rescans into a challenging remediation cycle and the per-rescan fees have materially exceeded your original annual quote.
Questions to ask before purchasing:
Get the answer in writing or, at a minimum, screenshotted from their pricing page. Some vendors impose a "rescan must occur within 30 days" policy that creates deadline pressure when engineering remediation timelines slip.
Red flag: Rescan pricing that isn't published anywhere visible or that appears only in the terms of service. Per-rescan fees combined with no on-demand scheduling create genuine compliance risk.
Scan scope is the list of IPs and domains submitted to the ASV for each quarterly scan, it must reflect your actual external-facing infrastructure that touches cardholder data flows. For a small merchant, this might be three to five IPs. For a growing business, scope changes constantly: new hosting providers, updated payment pages, CDN changes, cloud infrastructure with rotating IPs.
The first question is operational: can you update the scope yourself through a self-service dashboard, or does every change require a support ticket? Vendors whose scope changes go through support turn every infrastructure update, a hosting migration, a new subdomain, a cloud IP rotation, into a compliance interaction. In a busy quarter, that overhead is real.
The second question is more important: Does the vendor help you identify assets that should be in scope but aren't currently tracked? Organisations routinely undercount their external footprint, forgotten subdomains, cloud assets spun up outside the security team's visibility, and infrastructure acquired through a merger. An ASV that only scans what you hand them leaves those gaps in place. Undiscovered assets don't appear on your compliance report, but they do appear in breach reports.
Ask whether the vendor offers any discovery capability to surface untracked external assets that belong in your scan scope.
Red flag: Scope changes that require contacting support. Per-IP pricing models make scope updates expensive, discouraging merchants from accurately reflecting their environment. No guidance on identifying assets that should be in scope.
Most of the time, ASV scanning runs quietly. You schedule, review, remediate, and file the attestation, never needing to contact support.
The one time you do need it matters disproportionately. A QSA questioning a specific finding, an acquiring bank requesting documentation, a dispute requiring a signed clarification letter from the ASV, in each of these situations, support response time directly affects your audit timeline. A 72-hour response when your QSA meeting is in 48 hours is a genuine problem, not a minor inconvenience.
The practical question isn't whether a vendor has good support in general. It's whether they can respond usefully to compliance-specific questions under time pressure and whether the person responding understands what a QSA clarification letter is.
How to verify: Send a pre-sales question through their support channel and time the response. Ask something compliance-specific: "If my QSA requests a clarification letter for a disputed finding, how quickly can you produce it?" This question surfaces both the response time and the depth of the team's PCI knowledge.
Red flag: Support available only through a community forum or knowledge base with no direct contact option. A team that responds quickly but gives generic answers to compliance-specific questions — that signals limited PCI expertise, not just limited bandwidth.
Use this before signing up with any vendor. Most of these answers won’t be on the pricing page.
|
Criterion |
Question to ask |
Red flag |
|---|---|---|
|
PCI SSC listing |
“What’s your certificate number on the PCI SSC ASV list?” |
Can’t link to an Active listing |
|
Report format |
“Can I see a sample passing scan report?” |
No sample available; no attestation language |
|
Dispute process |
“What’s your average dispute resolution time?” |
No published SLA; per-dispute fees not disclosed |
|
Scan speed |
“How long does a scan of my scope take end-to-end?” |
No on-demand option; 24 hour completion |
|
Rescan policy |
“How many rescans are included if my scan fails?” |
Per-rescan fees not disclosed upfront |
|
Scope management |
“Can I update IPs and domains myself without contacting support?” |
Changes require support tickets |
|
Asset discovery |
“Can you help identify external assets I may have missed?” |
No discovery capability; scope is entirely self-defined |
|
Support quality |
Send a compliance-specific pre-sales question and time the response |
Forum-only support; generic answers to PCI questions |
Your PCI ASV provider is required by the PCI SSC to use only approved scanning tools, deliver reports in the required format, follow defined dispute resolution procedures, and maintain their certification status, giving you a baseline level of protection regardless of which approved vendor you choose.
Understanding what your PCI ASV provider is actually obligated to do, versus what they do as a differentiator, helps you evaluate them more clearly. The PCI SSC’s ASV Program Guide sets out the minimum requirements: scans must be conducted from outside your network perimeter, reports must include all mandatory data fields, disputes must be handled through a defined process, and scan results must not be altered without proper justification and documentation.
These obligations protect you as the customer. If a vendor tries to skip the dispute process, produce abbreviated reports, or cut corners elsewhere, they’re not just providing poor service, they’re potentially in violation of their ASV certification requirements. Knowing this gives you a baseline expectation you can hold any approved vendor to, regardless of where they sit on pricing or features.
What these obligations don’t cover is the quality of the service experience around compliance. A vendor can technically meet all PCI SSC requirements and still deliver mediocre support, unclear reports, and a painful onboarding experience. That’s the gap that your selection process needs to close, and why asking the right questions before you sign matters so much.
The right ASV scan provider depends on your business size, technical capability, and compliance context, SMBs typically benefit most from flat-rate, simple-onboarding vendors with strong support, while mid-market organisations should prioritise reporting depth, integration options, and multi-environment management.
One of the most common mistakes in approved scanning vendor selection is choosing a vendor built for a different type of customer. A vendor whose platform is designed for large enterprise environments with dedicated security teams is likely to feel overcomplicated and expensive for an SMB with a simple online payment setup. Conversely, a bare-bones entry-level provider might not have the reporting depth or account management capability that a mid-market IT team needs.
If you're a small business owner who just needs to tick the PCI compliance box and get on with running your business, look for a vendor who explicitly serves SMBs. That means transparent flat-rate pricing, a simple sign-up process, scan scheduling that takes minutes rather than days to configure, and a support team you can actually reach when you have a question. The scan itself doesn't need to be complicated, and neither does the vendor relationship.
If you're managing compliance for a larger organisation or multiple client environments, your evaluation criteria shift. You want a vendor with robust multi-account management, detailed reporting that can be customised or white-labelled, API access for workflow integration, and a genuine account management relationship rather than just a support queue. For MSPs especially, the ability to manage multiple client scans from a single dashboard and deliver professionally formatted compliance reports to clients is a meaningful differentiator in your own service offering.
The key in either case is matching the vendor to your actual operational context, not choosing based on name recognition or headline price alone.
Choosing an ASV vendor is one of those decisions that feels minor until you’re in the middle of a compliance cycle with an unhelpful report, a slow support queue, and a deadline approaching. The good news is that getting it right isn’t complicated, it just takes a bit more diligence than picking the first name on the PCI SSC list. Every approved vendor meets a baseline standard. What you’re really evaluating is the quality of the partnership, the clarity of the reporting, the fairness of the pricing, and whether the vendor’s support team will actually help you succeed.
Take the time to ask the right questions, match the vendor to the size and complexity of your environment, and treat this as a working relationship rather than a one-off transaction. The right ASV partner makes quarterly compliance feel routine. That’s exactly what it should be.
Choosing the right ASV vendor requires looking beyond PCI SSC certification to evaluate support quality, report clarity, pricing transparency, and onboarding simplicity. Every approved scanning vendor meets the same baseline requirements set by the PCI Security Standards Council, but the operational experience varies significantly. SMBs should prioritise simple, affordable, well-supported solutions, while mid-market organisations and MSPs should focus on reporting depth, integration capabilities, and multi-environment management. Asking the right questions before signing is the most reliable way to identify the best ASV vendor for your specific needs.
SecusyASV is PCI SSC-approved, SMB-friendly, and built to make quarterly scanning simple from day one. Get your first scan scheduled today
An Approved Scanning Vendor (ASV) is a company certified by the PCI Security Standards Council to conduct external vulnerability scans on internet-facing systems. ASVs must pass rigorous testing before receiving approval. These scans are required quarterly under PCI DSS Requirement 11.3.2 for businesses that process, store, or transmit cardholder data through internet-connected systems.
An ASV is responsible for running quarterly external vulnerability scans, delivering reports that meet PCI SSC formatting standards, validating and documenting scan results accurately, supporting customers through the dispute process when false positives arise, and providing guidance on what remediation steps are required to achieve and maintain a passing scan result.
ASV scans are automated, run quarterly, and test externally reachable systems against a database of known vulnerabilities. Penetration tests are manual, conducted by security professionals, and probe for business logic flaws, authentication weaknesses, and chained vulnerabilities that automated scanning can't detect. PCI DSS requires both for different reasons — ASV scans satisfy Requirement 11.3.2; penetration testing satisfies Requirement 11.4.
PCI DSS requires ASV scans at least once every quarter — a minimum of four times per year. A scan must also be run after any significant changes to your internet-facing infrastructure: new systems, updated configurations, or network changes that expand the attack surface.
A failing scan result means one or more CVSS 4.0 or above vulnerabilities were found that require remediation or formal exception before the scan can be marked passing. You remediate the issue, then run a rescan through your ASV. The scan is marked passing once all unresolved findings are either remediated or formally disputed and accepted by the ASV. The key question to ask your vendor upfront is how many rescans are included and what they cost.
No. Tools like Nessus, OpenVAS, or any other scanner not on the PCI SSC's official ASV list cannot produce a compliant attestation. Regardless of how capable they are technically, only a PCI SSC–certified ASV can issue the documentation your acquiring bank or QSA needs to confirm compliance with Requirement 11.3.2.
A false positive is a scan finding that flags a vulnerability that either doesn't exist in your environment or isn't exploitable given your specific configuration — for example, a vulnerability flagged on a CDN node that sits in front of your actual systems. Disputed false positives must be formally submitted to your ASV, who reviews the evidence and either accepts or rejects the dispute. How quickly and fairly your ASV handles disputes is one of the most important practical factors in the vendor selection decision.
A compliant ASV scan report must include the vendor's name and PCI SSC certificate number, documentation of the scanned scope, scan date and status, per-vulnerability details with CVSS scores, and formal attestation language. Beyond the mandatory fields, the most useful reports include plain-language remediation guidance — what the finding means and what a fix looks like — rather than just a list of CVE numbers.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.