After Passing an ASV Scan: What Happens Next?
After passing an ASV scan, here's what to submit, how long results last, and how to set up your next quarterly compliance cycle without gaps.
If you searched “Secusy vs Evervault,” it’s worth stating the most important distinction upfront: these two products are not interchangeable for the purpose most people are comparing them for. Secusy ASV is a PCI SSC-listed Approved Scanning Vendor, built specifically to satisfy PCI DSS Requirement 11.3.2’s external scanning mandate. Evervault is a developer-oriented data encryption and payments platform. It offers a scanning feature branded “ASV Scans,” but Evervault itself does not appear on the PCI SSC’s official list of Approved Scanning Vendors.
That distinction matters because PCI DSS is explicit: only a report from a vendor on the PCI SSC’s approved list satisfies Requirement 11.3.2.1. Choosing a tool based on branding alone, without confirming its underlying accreditation, risks a report your acquirer or QSA won’t accept. This guide breaks down what each platform actually does, what they cost, and which one fits your situation.
No sales call, no back-and-forth. Enter your IP count and get a fixed annual price instantly, from a PCI SSC-accredited ASV.
Approved Scanning Vendor (ASV): An organization approved by the PCI Security Standards Council (PCI SSC) to conduct external vulnerability scanning of internet-facing systems in scope for PCI DSS compliance, required at least every 90 days under Requirement 11.3.2.1. Only scans from a vendor currently on PCI SSC's official ASV list are accepted by acquirers and card brands.
AoSC (Attestation of Scan Compliance): The document an ASV issues after a passing scan, confirming your external systems meet the vulnerability thresholds required for PCI DSS compliance. This is what you hand to your QSA or acquiring bank.
PCI DSS Service Provider Level: A separate designation from ASV status. It classifies a company's own volume and role in handling cardholder data (Level 1 being the highest). Evervault holds this as a service provider, which is not the same as being an accredited Approved Scanning Vendor.
Secure Enclave / Trusted Execution Environment (TEE): A hardware-isolated computing environment that executes code and processes data in a protected memory region, preventing the host operating system or other processes from accessing the contents. Evervault's Enclaves product uses this to enable computation on encrypted data.
PCI scope reduction: Architectural or technical changes, like encrypting or tokenizing card data before it touches your servers, that shrink the number of systems considered "in scope" for PCI DSS. Scope reduction can lower which controls apply to you, but it does not eliminate the external scanning requirement for whatever remains in scope.
Secusy ASV | Evervault | |
|---|---|---|
PCI SSC ASV listing | Yes, publicly listed | Not listed as an Approved Scanning Vendor |
Core product | Standalone PCI ASV scanning | Encryption/payments platform with an “ASV Scans” feature |
Pricing | $80 per IP/domain per year, published | $95 per IP address per year, published |
Signup | Self-serve, same-day, no sales call | “Book a demo” required |
Rescans | 6 free rescans per quarter | Unlimited scans |
Report turnaround | Within 24 hours, most under 4 | Not published; results shown live in dashboard |
Core strength | Fast, affordable, accredited compliance scanning | Application-layer encryption and PCI scope reduction |
Best fit | Any business that needs a quarterly scan accepted by an acquirer or QSA | Engineering teams already using Evervault’s encryption platform |
Secusy ASV is a PCI SSC-listed Approved Scanning Vendor that performs your quarterly external vulnerability scan and returns a submission-ready report and AoSC, with nothing else to buy or adopt.
For any business that accepts, processes, or transmits payment card data, Requirement 11.3.2 mandates that external-facing systems be scanned by an approved scanning vendor at least quarterly. Because Secusy holds that accreditation directly, a passing scan carries the weight your acquirer or QSA is actually looking for. You enter your IPs or domains, pay a fixed per-IP price, and get results back through a secure portal, typically within 24 hours, with no onboarding project and no requirement to change how your infrastructure handles payment data.
Evervault is a developer platform for encrypting and orchestrating sensitive data, primarily card data, at the application layer, with a scanning feature branded "ASV Scans" offered inside its dashboard, though Evervault itself does not appear on the PCI SSC's list of Approved Scanning Vendors.
Evervault’s core thesis is that the traditional perimeter-based approach to data security is inadequate for modern, cloud-native architectures, where sensitive data inevitably flows through multiple systems and third-party APIs. Its answer is to ensure data is never exposed in plaintext in the first place. Two products carry this out: Relay, which intercepts and encrypts data at the network edge before it reaches your application servers, and Enclaves, which provides Trusted Execution Environments where code can run against encrypted data without ever decrypting it, even within your own infrastructure.
Its ASV Scans product, at $95 per IP address per year, includes unlimited scans, monthly scheduling, exception requests, and compliance reports, accessed by booking a demo rather than an instant self-serve signup. Because Evervault is not itself a PCI SSC-accredited ASV, businesses considering it for scanning specifically should confirm directly with their acquirer or QSA that its reports satisfy Requirement 11.3.2.1 before relying on it for that purpose.
PCI DSS 4.0 changed the rules for SAQ A merchants and outsourced payment setups. Get a straight answer on whether you need quarterly ASV scanning.
Secusy is $80 per IP or domain per year with no platform or retest fees, available instantly with no sales call. Evervault lists $95 per IP address per year for its ASV Scans product, but access starts with booking a demo rather than a self-serve checkout.
Both vendors now publish a per-IP annual rate, so the $15 difference itself isn’t the deciding factor. The bigger practical differences are how fast you can start (Secusy: same-day, self-serve; Evervault: demo required) and, more importantly, which vendor’s report your acquirer will actually accept.
Choose Secusy ASV if you need a report that satisfies your PCI DSS scanning requirement without question. Choose Evervault if you're an engineering team already using its encryption platform to reduce PCI scope, and confirm separately that its scanning output meets your specific compliance obligation.
Most merchants, SaaS companies, and agencies need a passing report four times a year and nothing more, an accredited ASV is the direct, lowest-risk path to that. Evervault’s natural audience is different: fintechs issuing cards, healthcare platforms processing regulated data, and SaaS products handling PII in custom, in-house flows, where reducing plaintext exposure is a genuine architectural concern. Even for that audience, a business in scope for Requirement 11.3.2.1 still needs a report from an accredited ASV; Evervault’s own scanning feature doesn’t establish that on its own based on current PCI SSC listings.
A layered approach is still reasonable: use Evervault to encrypt data at the application layer while using Secusy ASV to independently satisfy the external scanning mandate with a report from an accredited vendor.
Secusy ASV and Evervault aren’t really competing for the same job. Secusy is a PCI SSC-accredited ASV built to deliver a report your acquirer or QSA will accept, quickly and at a published price. Evervault is a broader encryption and payments platform for engineering teams reducing PCI scope at the application layer; its ASV Scans feature is not backed by PCI SSC ASV accreditation, so businesses relying on it specifically to satisfy Requirement 11.3.2.1 should verify that with their acquirer or QSA first. If your goal is simply to check the scanning box with zero ambiguity, Secusy is the direct answer.
Run scans across every client account and earn recurring revenue on each one.
Secusy, since its accreditation removes any question about whether the report will be accepted, along with same-day setup and a report built for handing straight to your QSA or acquirer.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.