After Passing an ASV Scan: What Happens Next?
After passing an ASV scan, here's what to submit, how long results last, and how to set up your next quarterly compliance cycle without gaps.
If you’re comparing PCI ASV vendors, Qualys has probably come up. It’s one of the oldest, largest names in vulnerability management, and its PCI ASV scanning module is part of that broader platform. That scale is exactly why a lot of small and mid-sized businesses end up looking for alternatives: Qualys was built for enterprise security teams, not for a merchant who just needs to pass a quarterly scan and get back to running their business.
Here’s how the two actually compare, on the factors that matter when you’re the one paying the invoice.
PCI ASV (Approved Scanning Vendor): A company certified by the PCI Security Standards Council to perform the external vulnerability scans required under PCI DSS Requirement 11.3.2. Every ASV, regardless of size or price, must follow the same PCI ASV Program Guide.
Qualys ASV: A PCI ASV scanning module inside Qualys's broader vulnerability management platform (VMDR), typically bought by organizations that need cloud, on-prem, and hybrid vulnerability management alongside PCI compliance scanning.
Secusy ASV: A PCI SSC Approved Scanning Vendor built specifically for external PCI DSS scanning; no broader platform, no unrelated modules, just the scan, the report, and the Attestation of Scan Compliance.
Attestation of Scan Compliance (AoSC): The document issued after a passing scan, submitted to your acquirer or QSA as proof of PCI DSS Requirement 11.3.2 compliance.
Secusy publishes fixed pricing at $80 per IP per year with no platform fee. Qualys doesn't publish PCI ASV pricing; it's quote-based and bundled into its broader platform, with independent estimates for entry-level Qualys plans commonly starting around $1,500–$2,000+/year.
Factor | Secusy ASV | Qualys ASV |
|---|---|---|
Pricing model | Published, fixed: $80/IP/year | Custom quote; not publicly listed |
Typical entry cost | $80–$240/yr for 1–3 IPs | ~$1,500–$2,000+/yr (independent estimates, broader platform) |
Buying process | Self-serve, no sales call | Usually requires a quote/sales conversation |
A 5-IP environment runs $400/year with Secusy, and a 10-IP environment runs $800/year; there’s no base platform fee underlying either figure. See the full pricing breakdown →
Run a 2-minute check and find out before you shop vendors
With Secusy, you enter your IPs, run the scan, and get a report within 24 hours; most customers are scanning within 30 minutes of signing up. With Qualys, onboarding typically starts with a sales conversation and platform configuration, since PCI scanning sits inside a larger vulnerability management deployment.
Secusy: Sign up → enter in-scope IPs/domains → scan completes in under 4 hours → report and AoSC delivered within 24 hours → free rescans (up to 6/quarter) if needed.
Qualys: Sales conversation to scope environment and agree contract → platform onboarding (asset groups, scan profiles) → scan runs within the broader dashboard → retest terms governed by contract.
Neither process is “wrong”; they’re built for different buyers. Qualys makes sense if scanning is part of a larger security program with dedicated staff managing the platform. Secusy is built for someone who wants the PCI requirement handled and off their plate the same day.
Yes. Both are PCI SSC-approved scanning vendors, and every ASV must follow the same PCI DSS ASV Program Guide methodology. A passing report from either vendor is accepted the same way by acquirers, card brands, and QSAs; the report format and pass/fail logic come from the programme, not the vendor's brand.
Where they differ is turnaround and presentation. Secusy delivers a submission-ready report and AoSC within 24 hours through the portal. Qualys reports are live within its broader dashboard, which offers more cross-referencing with other vulnerability data, useful if you’re already using the platform for other purposes and unnecessary overhead if you’re not.
Enter your IP count and get a fixed annual price instantly; no sales call.
Secusy is the better fit if you need to pass your quarterly PCI DSS scan without adopting an enterprise security platform; you want published pricing, same-day setup, free rescans included, and no sales call standing between you and a compliant report.
Yes. PCI DSS requires quarterly scans from an approved vendor, not a specific one, so you can start your next scan cycle with Secusy at any point and let your Qualys contract lapse at its natural renewal.
Qualys and Secusy are both legitimate, PCI SSC-approved scanning vendors, and a passing report from either is accepted identically by acquirers and QSAs, so the decision comes down to fit, not compliance risk. Qualys makes sense if PCI scanning is one module inside a broader vulnerability management deployment you're already running. Secusy makes sense if you need the quarterly scan requirement handled on its own, with published pricing, same-day setup, and rescans included, without adopting a platform built for a much bigger job.
Sign up and be scanning within 30 minutes
Secusy is built for self-serve use; enter your IPs and the platform handles the rest, with support available if a finding needs explaining. Qualys's broader platform has more configuration surface area, so less technical teams often lean on a security admin or the sales/onboarding team to get set up correctly.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.