Best PCI Penetration Testing Companies in 2026: Requirement 11.4 Done Right

PCI DSS is the one major framework that requires penetration testing by name, in detail, on a schedule. Requirement 11.4 of PCI DSS v4.0.1 spells out a documented methodology, internal and external tests at least once every twelve months and after significant changes, correction and retest of exploitable findings, and segmentation testing on its own clock. That precision makes the buying decision simpler than for SOC 2: the tester either covers every line of 11.4 in a way your Qualified Security Assessor accepts, or you are buying the test twice.

This list is written by a penetration testing company, so Invadel is first and this is our site. Descriptions of other firms are limited to what they publicly say about themselves, and we never quote their prices. Ours are on the pricing page.

PCI penetration testing vendors compared

Firm	PCI ROC assessment	ASV scans	Published prices	Retest	Best for
Invadel	Yes	Yes	Yes	Free, included	Fixed-price 11.4 coverage with QSA-ready evidence
Trustwave (LevelBlue)	Not stated	Not stated	No	Per contract	Large merchants and processors
Coalfire	Yes	Not stated	No	Per contract	Processors and large service providers
Schellman	Yes	Yes	No	Per contract	A PCI ROC alongside SOC 2 and ISO 27001
A-LIGN	Yes	Yes	No	Per contract	Mid-market, PCI plus other frameworks
VikingCloud	Yes	Yes	No	Per contract	Merchants that want ASV scans and assessment together
NetSPI	Not stated	Not stated	No	Per contract	Banks and large enterprises
Kroll	Yes	Not stated	No	Per contract	Regulated enterprises
Rapid7	Not stated	Yes	No	Per contract	Rapid7 platform customers
Packetlabs	Not stated	Not stated	No	Per contract	Manual-first infrastructure testing

“Yes” in the ROC and ASV columns means the firm says on its own site that it delivers the PCI DSS Report on Compliance assessment or quarterly ASV scans; “Not stated” means we did not find the claim there when we checked in September 2026. “Per contract” means the retest terms are set in the quote, so ask before you sign. The PCI Security Standards Council names the firms it has qualified on its Qualified Security Assessor list and Approved Scanning Vendor list.

What Requirement 11.4 asks for, in five lines

• 11.4.1: a documented methodology covering the whole CDE perimeter, inside and outside, at the network and application layers.
• 11.4.2 and 11.4.3: internal and external tests every twelve months and after significant change, by a qualified, independent tester.
• 11.4.4: exploitable findings corrected, and the correction verified by repeating the test.
• 11.4.5 and 11.4.6: if segmentation reduces your scope, segmentation tests every twelve months, or every six months for service providers.
• 11.4.7: multi-tenant service providers support their customers’ external tests.

The line-by-line version, with the evidence your QSA expects, is in PCI DSS penetration testing requirements. Requirement 11.3 sits alongside: internal vulnerability scans at least quarterly and external scans by a PCI SSC Approved Scanning Vendor at least quarterly. A penetration test does not replace those scans, and an ASV scan is not a penetration test. Our PCI DSS penetration testing page and PCI compliance checklist cover the rest of the standard.

Who counts as “qualified” and “independent”

PCI DSS does not require a specific certification. It requires that the tester is qualified and organizationally independent of the systems under test; your QSA will ask for evidence of both. An internal team can qualify if it is genuinely independent of the CDE’s owners, which is why most merchants and service providers use an outside firm and file the firm’s qualifications with the report.

The best PCI penetration testing companies in 2026

1. Invadel

Best for: fixed-price 11.4 coverage with the QSA’s evidence built in.

Our PCI engagement covers the internal test, the external test, the application layer and the segmentation test as separate line items, each mapped to its 11.4 sub-requirement in the report, with the methodology documented for 11.4.1 and the retest of remediated findings included for 11.4.4. Tester qualifications and an independence statement are part of the attestation letter your QSA receives. A typical merchant’s external test, internal test with segmentation, and web application test start at $15,400, fixed; the component prices are in PCI penetration testing cost, and the engagement is on our PCI DSS penetration testing page. We also deliver the other two PCI DSS pieces: the quarterly ASV scans for 11.3.2 and the Report on Compliance assessment, so the test, the scans and the ROC can run on one calendar. Whether one firm should do both the test and the assessment is covered in the FAQ below.

2. Trustwave

Best for: large merchants and processors that want testing from a firm with a long PCI history.

Trustwave has been a fixture of the payments security market for many years, with its SpiderLabs research and testing team delivering penetration testing at scale. It is now part of LevelBlue, which completed the acquisition on August 19, 2025. Trustwave sold its SecureTrust PCI compliance division in 2021, and that business now sits under VikingCloud (entry 6), so confirm which company will sign any PCI assessment work.

3. Coalfire

Best for: payment processors and service providers that need PCI QSA work and testing under one roof.

Coalfire is a PCI QSA and FedRAMP 3PAO with an offensive security practice, a common choice for large service providers whose assessment and testing programs run together.

4. Schellman

Best for: companies combining a PCI ROC with SOC 2 and ISO 27001.

A CPA firm, certification body and PCI QSA, often selected when the PCI assessment is one of several attestations drawn from the same evidence.

5. A-LIGN

Best for: mid-market companies pairing PCI with other frameworks.

A PCI QSA and licensed CPA firm with a penetration testing practice alongside its assessment work, separated for independence.

6. VikingCloud

Best for: merchants that want ASV scanning and PCI assessment from a payments-focused provider.

VikingCloud is a PCI QSA and Approved Scanning Vendor with a large base of merchant customers through acquirers and payment processors.

7. NetSPI

Best for: banks and large enterprises running PCI testing as a continuous program.

An enterprise penetration testing company with a large bench and delivery platform, strong in banking and other regulated industries with many in-scope systems. Update, September 2026: NetSPI and Synack announced on September 2, 2026 that they plan to merge, with closing expected in October 2026. See Invadel vs NetSPI.

8. Kroll

Best for: regulated enterprises that want testing from a global risk brand.

Kroll’s cyber practice pairs penetration testing with a large incident response operation, a fit where legal and compliance stakeholders all need to approve the vendor. Kroll is also a PCI QSA, so it can run the assessment as well as the test.

9. Rapid7

Best for: organizations already running the Rapid7 platform for vulnerability management.

Best known for vulnerability management products, Rapid7 also runs a penetration testing services arm; bundling can be efficient where the scanning already runs on its platform.

10. Packetlabs

Best for: manual-first internal and external testing with detailed reporting.

A manual-first Canadian firm whose infrastructure and application testing is written up for compliance audiences. See Invadel vs Packetlabs.

How to buy PCI testing without doing it twice

• Give the tester the CDE diagram and the segmentation design before scoping. Segmentation testing is the item most often missed, and it is the one that fails a ROC.
• Confirm which sub-requirements the report will cite. If the vendor cannot map findings to 11.4.2, 11.4.3 and 11.4.5 by number, the QSA will do it for them, slowly.
• Ask about the retest. 11.4.4 makes the retest part of the requirement, not an upsell.
• Ask for the qualifications and independence statement up front. Your QSA will.
• Fix the price. PCI scopes are well defined, which means a fixed price is reasonable to expect. Ours are on the pricing page.

Frequently asked questions

Should the QSA and the penetration tester be the same firm? They can be. Several firms on this list, including A-LIGN, Coalfire and Schellman, offer both the assessment and the penetration test. PCI DSS requires the tester to be qualified and organizationally independent of the systems tested; it does not require a second firm. Two firms remove any independence question and give you a second set of eyes. One firm can simplify scheduling. Either way, ask how the two teams are separated.

Does an ASV scan satisfy the penetration testing requirement? No. Requirement 11.3 (scans) and 11.4 (penetration testing) are separate requirements with separate evidence.

Which vendors are approved for PCI scanning? The ones on the PCI Security Standards Council’s Approved Scanning Vendor list. Requirement 11.3.2 says the quarterly external vulnerability scans must be performed by a PCI SSC Approved Scanning Vendor. There is no equivalent approved list for penetration testers: Requirement 11.4 asks for a qualified, organizationally independent tester, and your QSA reviews the evidence of that qualification and independence.

How often does PCI DSS require penetration testing? Internal and external at least every twelve months and after significant changes; segmentation testing every twelve months for merchants and every six months for service providers. See how often you should do a penetration test, and our penetration testing requirements by framework if PCI is one of several standards you answer to.

Do we need to test if we use a hosted payment page? Scope shrinks with SAQ type, and our guide to PCI compliance levels and SAQ types shows which questionnaires include a penetration test, but any system that could affect the security of the cardholder data environment stays in scope, and your QSA or acquirer decides where the line is. For small merchants, our small business penetration testing page covers the usual one-application scope.

Can our internal team do it? If it is qualified and organizationally independent of the systems tested, yes. Most companies use an outside firm to remove the independence question.

The short version

Hire a tester that covers every line of 11.4 by number, includes the retest, and hands your QSA an attestation letter with qualifications and independence on it. If PCI is not your only driver, our list of the top penetration testing companies covers general testing, and our comparison of PTaaS companies covers the subscription platforms. If you want PCI testing at a published price, scope a PCI penetration test.