PCI ASV External Scanning

A named member of the engagement team reviews it and a partner approves it. Their name, title and credentials are printed on the report, and the approval is recorded against the engagement in the portal.

Passing scan reports are issued by a PCI SSC Approved Scanning Vendor. Qantid manages the programme and remediation; the ASV signs the scan report.

Both, and we are specific about the split. An automated toolchain covers known vulnerability classes — misconfiguration, known CVEs, injection, weak TLS, exposed services, dependency issues and secrets. A consultant then reproduces and confirms every critical and high finding, and performs a scoped manual pass on business logic: authentication flows, authorisation boundaries, insecure direct object references, workflow abuse and race conditions. We do not describe this as a fully manual test, because it is not.

This is not a load or stress test, not a social engineering assessment, not a physical security assessment, and not a source code review, unless you purchase those separately. Denial-of-service testing is never performed.

A signed Testing Authorisation Form from someone with authority to give it, and proof of ownership for every in-scope target. We will also give you the static IP addresses our scanners egress from so you can allowlist them.

The portal reminds you 90, 60 and 30 days before it is due, and you start a new version of this engagement pre-filled from the answers you gave last time. You update only what has changed, and you see a side-by-side of what changed before you submit.

In private storage, accessible only through short-lived signed links, with every view and download logged. Nothing is attached to email. Our sub-processors and data residency are published on the trust page.

By card through Stripe after you complete intake in the portal. You can save a draft without paying; submission happens only after payment succeeds.