After Passing an ASV Scan: What Happens Next?
After passing an ASV scan, here's what to submit, how long results last, and how to set up your next quarterly compliance cycle without gaps.
Holm Security ASV scanning has started showing up in PCI compliance searches as businesses look for external vulnerability scan vendors, but the company’s own published information tells a more nuanced story than the feature name suggests. If you’re comparing PCI ASV scanning vendors and Holm Security is on your shortlist, it’s worth understanding what it currently offers versus what it plans to offer; especially if you’re not sure whether you need PCI ASV scanning at all yet.
This comparison lays out Holm Security’s certification status, platform focus, and pricing model against Secusy, a vendor built specifically around PCI ASV compliance, using only what each company states publicly.
PCI DSS: The Payment Card Industry Data Security Standard the global security standard for any organisation that stores, processes, or transmits payment card data.
Approved Scanning Vendor (ASV): A company certified by the PCI Security Standards Council (PCI SSC) to perform the external vulnerability scans required for PCI DSS compliance. This is a specific, auditable certification, not a general vulnerability management capability. See our full breakdown of approved scanning vendors for how the certification works.
PCI ASV scan: A quarterly external vulnerability scan of internet-facing systems handling cardholder data, reported in an ASV-specific format that can be submitted to acquiring banks or card brands. Learn more about what an ASV scan actually covers and how scan frequency requirements work.
Not yet. Holm Security's own PCI ASV page states it "will soon be a certified ASV vendor," with availability expected in Q3 2026, and that ASV scanning is currently delivered through a partner.
This is the single most important fact in this comparison. ASV certification isn’t a marketing label; it’s a formal PCI SSC authorisation, and only a certified ASV can sign off on the scan reports merchants submit for compliance. Secusy holds that certification directly and performs scans in-house rather than through a third-party partner. If your compliance deadline is this quarter, working with an already-certified ASV removes a dependency you’d otherwise be trusting a partner relationship to cover.
Get your quarterly PCI ASV scan from a vendor certified today, not next year.
Secusy is purpose-built around PCI ASV compliance; Holm Security's ASV feature sits inside a much broader vulnerability and exposure management platform.
Holm Security’s product line spans system and network security, web application security, cloud security posture management, API security, phishing simulation, Active Directory security, OT security, and attack surface management, with PCI ASV scanning listed as a single feature page among all of these. That breadth suits security teams building an enterprise-wide exposure management program covering NIS2, DORA, ISO 27001, and GDPR requirements alongside PCI.
Secusy takes the opposite approach: the platform is structured around the PCI ASV scanning cycle, specifically scan scheduling, remediation guidance, and compliance reporting, without requiring you to adopt a full security platform to get a passing quarterly scan. If your need is PCI ASV scanning rather than a broader exposure management programme, that focus tends to mean a shorter path to a compliant scan report. For a wider view of what to weigh across any vendor, see how to choose an ASV vendor.
Secusy publishes ASV pricing information directly; Holm Security only provides pricing after a quote request, for any product line.
For a compliance requirement that most merchants need to budget for every quarter, seeing cost ranges up front is a practical advantage rather than a nice-to-have. Holm Security routes every pricing inquiry, including PCI ASV scanning, specifically to a “Request a quote” or sales call. Secusy’s ASV pricing models are published so you can compare costs before engaging sales.
Choose Secusy if PCI ASV compliance is your primary or immediate need; consider Holm Security once its ASV certification is live if you're already evaluating it for broader exposure management coverage.
Factor | Secusy | Holm Security |
|---|---|---|
ASV certification | Certified PCI SSC ASV, scans performed directly | Not yet certified; delivered via a partner; targeted for Q3 2026 |
Primary focus | Purpose-built PCI ASV scanning | Broad vulnerability & exposure management platform |
Pricing visibility | Published cost/pricing information | Quote-only |
Best fit | Merchants needing quarterly PCI ASV compliance now | Enterprises wanting unified coverage across NIS2, DORA, ISO 27001, and vulnerability management |
Platform scope | Focused on the ASV scanning and remediation workflow | System/network, web app, cloud, API, phishing, AD, OT security modules |
If you’ve already compared other named vendors, this pattern holds across the market; see how the same trade-offs play out in our Secusy vs Qualys ASV comparison.
Holm Security is a credible vendor for broad-scope vulnerability and exposure management, but as of today it is not a certified PCI-approved scanning vendor; it delivers ASV scanning indirectly through a partner while its own certification is pending through Q3 2026. For any organisation that needs a certified ASV relationship now, that gap is worth weighing carefully before committing. Secusy is built specifically to close it: direct ASV certification, transparent published pricing, and a workflow designed around the recurring PCI compliance cycle rather than a broader security suite.
Compare transparent PCI ASV pricing models instead of waiting on a quote.
ASV stands for Approved Scanning Vendor, a company certified by the PCI Security Standards Council to run the external vulnerability scans required for PCI DSS compliance.
It depends on your immediate need. A dedicated, already-certified ASV like Secusy gets you a compliant quarterly scan without extra platform overhead; a broader platform like Holm Security's may suit teams already consolidating NIS2, DORA, ISO 27001, and vulnerability management under one vendor; once its ASV certification is finalized.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.