PCI Compliance for PayPal Merchants: Full SAQ Guide 2026
PCI compliance for PayPal merchants explained: which SAQ you need, when ASV scans apply, and how the 2026 PCI DSS v4.0.1 rules changed eligibility.
If you’ve been asked to produce a passing PCI ASV scan and you’re comparing vendors, Secusy vs SecurityMetrics ASV is a comparison worth slowing down for, as the two are built around genuinely different assumptions about who’s running the scan and how much hand-holding they want along the way.
SecurityMetrics has been in payment security for over 25 years. It holds QSA, ASV, PFI, and several other PCI credentials, and its customer list ranges from small merchants to large enterprises and acquiring banks. Its vulnerability scanning line splits into two separate products: ASV Scan, aimed at PCI DSS compliance specifically, and Perimeter Scan, a broader credit-based scanning tool built for organizations managing a lot of IPs across a changing environment.
That’s a lot of platform, and for the right buyer, it’s exactly what’s needed. But a merchant who just needs to clear a quarterly scan every 90 days, without a sales call, a credit-based pricing model, or a bundle of features they’ll never touch, often ends up looking for something leaner. That’s the gap Secusy was built to fill: fixed pricing, no onboarding call, and a report formatted for direct submission to a QSA or acquirer.
This article walks through where the two actually differ in pricing, setup, rescans, and support so you can match the vendor to how your team actually works, not just to which name you recognize.
ASV scan: A PCI ASV (Approved Scanning Vendor) scan is an external vulnerability scan performed by a company certified by the PCI Security Standards Council. It checks your internet-facing IPs, domains, and services for known vulnerabilities and is required under PCI DSS Requirement 11.3.2 at least once every three months, or after any significant change to your network.
PCI DSS Requirement 11.3.2: The specific clause of the Payment Card Industry Data Security Standard that mandates quarterly external vulnerability scanning by a certified ASV for any organization storing, processing, or transmitting cardholder data.
SecurityMetrics ASV Scan: SecurityMetrics' PCI-specific external scanning product. It's sold separately from Perimeter Scan, the company's broader, credit-based scanning tool aimed at organizations with larger or more frequently changing sets of scan targets.
Secusy ASV: A PCI SSC–approved scanning vendor built for SMBs, SaaS companies, and MSSPs, with self-serve setup, published per-IP pricing, and reports built for direct submission to an acquirer or QSA without a contract or onboarding call.
SecurityMetrics is built as a broad payment-security platform with ASV scanning as one piece of a much larger service catalog. Secusy is built as a focused ASV, one job, done with as little friction as possible.
That distinction matters more than it sounds like it should. Both companies will produce a technically valid, PCI-accepted scan report; approval from the PCI SSC guarantees that much. What it doesn’t guarantee is a similar buying experience.
SecurityMetrics’ broader catalogue (forensic investigation, PCI audits, HIPAA compliance, consulting, SAQ support) is genuinely useful if you already work with them on other compliance needs or if your environment is complex enough to need that depth. If your only requirement is a clean quarterly ASV scan, though, that breadth mostly shows up as extra pages to click through and a sales conversation you didn’t ask for.
Secusy skips the catalogue. It’s an ASV, full stop, which is also why its pricing, onboarding, and reporting are all built around getting one specific job done quickly.
Secusy's ASV pricing is public, $80 per IP per year, no platform fee, no quote request.
Secusy's price is on the page: $80 per IP per year, no platform fee. SecurityMetrics ASV pricing isn't published anywhere on its site; ASV Scan and Perimeter Scan both route to a "Request a Quote" or "Call for pricing" step.
This is the single biggest practical difference between the two, and it’s worth sitting with for a second. If you’re the person responsible for budgeting a compliance line item, not knowing the number until you’ve had a sales call is a real cost; it’s time, and it’s often a delay you didn’t plan for.
SecurityMetrics does publish price ranges for a handful of adjacent products, like PCI audits and HITRUST assessments, but the ASV and Perimeter scan products themselves are quote-based. Secusy’s rate is public: $80 per IP per year, flat, with no separate platform or setup fee layered on top. For a business with a handful of IPs in scope, that means you can calculate your annual PCI scanning cost in the time it takes to read this paragraph before you’ve spoken to anyone.
SecurityMetrics starts your ASV process with a Security Specialist who helps confirm your PCI validation type and sets your scanning schedule before anything runs. Secusy is a self-serve ASV scan, add your IPs or domains and launch a scan in minutes, with no agents to install and no professional-services step.
Neither model is objectively better; it depends on what you already know. If you’re not sure what “validation type” even means for your business, a guided conversation with a specialist has real value; that’s a reasonable thing to pay for with your time. SecurityMetrics leans into that.
But if you already know what’s in scope, you’ve done this before, or your compliance team has the answer on hand, an onboarding call is friction, not help. It’s a step between you and a scan you could otherwise start right now. Secusy’s setup is built for that second scenario: no agents, no professional-services engagement, and a scan you can kick off the same day you sign up.
Secusy includes 6 free rescans per quarter at every tier. SecurityMetrics' ASV Scan product includes unlimited rescans for the life of your contract; its separate Perimeter Scan product is credit-based, so rescans there draw down the credits you've purchased.
Rescans aren’t an edge case; they’re the norm. Most first scans come back with at least one finding that needs remediation and a follow-up scan to confirm it’s fixed. That makes rescan policy one of the more consequential line items in any PCI ASV scan comparison, because it directly affects whether “fixing what the scan found” comes with a surprise bill attached.
Both vendors solve the core problem; neither will nickel-and-dime you for confirming a fix under their flagship ASV product. The difference is where that allowance lives: inside SecurityMetrics’ quoted annual contract or inside Secusy’s published per-IP price. If you’re comparing SecurityMetrics ASV vs Perimeter Scan specifically, note that only the ASV Scan tier carries the unlimited-rescan language; Perimeter Scan’s credit model behaves differently and is worth clarifying with sales before you commit.
No agents, no onboarding call, add your IPs and get a QSA-ready report in minutes.
SecurityMetrics runs a 24/7 technical support desk with a stated 48-hour window for false-positive disputes, backed by a dedicated in-house scan-engineering team. Secusy is built to reduce how often you need to call anyone in the first place, with low-false-positive detection and reports written for direct action rather than technical translation.
A failed or disputed scan is where vendor support actually gets tested; anyone can be helpful when everything passes cleanly. SecurityMetrics’ 24/7 desk and dedicated scan team are a real asset for larger or more complex environments: more scan targets generally mean more edge cases, and having a phone number to call matters.
Secusy takes a different angle on the same problem: rather than building a large support operation around resolving false positives after the fact, it invests in scan accuracy up front and formats results so a non-specialist can act on them without needing to call anyone. For a small team without a dedicated security hire, that’s often the more practical form of support: fewer things to escalate in the first place.
Businesses researching a SecurityMetrics ASV alternative are usually running into one of three friction points: unpublished pricing, an onboarding process built for larger teams, or a support model tuned for enterprise account relationships. Secusy addresses all three directly.
If you’re an SMB, a SaaS company scanning a small number of production IPs, or an MSSP running scans across several client accounts, the enterprise model isn’t wrong so much as it’s built for someone else’s environment. Secusy’s flat pricing and self-serve setup were designed with exactly this buyer in mind, and its architecture supports isolated environments for MSSPs and multi-entity organizations managing scans for more than one client.
That doesn’t make SecurityMetrics a bad vendor; it’s a strong choice for organizations that already have compliance infrastructure and want a single partner across audits, training, and scanning. It just means the fit depends on your team, not on which name is more recognizable.
Choose SecurityMetrics if you want an established enterprise vendor with 24/7 phone support, guided onboarding, and a broader compliance portfolio beyond ASV scanning. Choose Secusy if you want a published price, a scan you can start today, and a report built for straightforward PCI submission.
Both are legitimate, PCI SSC–approved vendors, and a passing report from either is accepted the same way by your acquirer or QSA. The decision isn’t really about which vendor is “better” in the abstract; it’s about how much guidance you want in the process versus how much you’d rather just see the price and get scanning. And because PCI DSS lets you switch ASVs at the start of any quarterly cycle, trying either one doesn’t lock you into anything long-term.
Secusy and SecurityMetrics both hold PCI ASV approval and produce reports your acquirer will accept; that part of the decision is settled before you even start comparing. What separates them is everything around the scan itself: SecurityMetrics ASV pricing requires a conversation, onboarding runs through a specialist, and support leans on a large 24/7 team built for complex environments.
Secusy publishes its price, skips the sales call, and is built for teams that want to run a scan, get a clean report, and move on with their day. If you’re an SMB, SaaS team, or MSSP weighing a SecurityMetrics ASV alternative, that difference in operating model is usually the deciding factor; not the PCI SSC approval, which both vendors already have.
Talk to a compliance specialist and confirm your validation type before you run a scan.
Yes. You can switch ASVs at the start of any quarterly scan cycle, you don't need to finish out a contract with your current vendor before moving to a new one.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.