What is ASV scanning in plain words? ASV scanning is a regular, external check of whether your website and other internet-facing systems have known weaknesses an intruder could exploit. It is performed by an approved company (an Approved Scanning Vendor), and the result confirms that your systems are free of serious, known flaws – or points out what needs fixing.
Canonical definition: ASV scanning is an external security review of internet-facing systems, performed regularly by a company approved by the payments standards body (PCI SSC), aimed at detecting known weaknesses before an attacker finds them.
This article explains ASV scanning without jargon – for business owners, managers and anyone who needs to understand what they are paying for without being a security specialist. It also explains what a “false positive” is and why buying a service differs from access to the tool alone.
ASV scanning – key takeaways:
- ASV scanning is a regular external check of whether your internet-facing systems have known weaknesses – like a technical inspection, but for digital security.
- It is performed by a company on the official Approved Scanning Vendors list; owning a scanning tool is not enough for the result to be recognised.
- The scan checks internet-facing systems (website, servers, services) but does not actually try to break in or test business logic.
- A false positive is a false alarm – the scan reports a weakness that does not really exist or does not matter; a good service helps resolve it.
- By buying the service rather than just tool access, you get result interpretation, remediation support, false-positive handling and a formal compliance document.
- Patronusec provides ASV scanning as a service – with interpretation, support and documentation, not just access to a scanner.
Table of Contents
What is ASV scanning – in plain words?
ASV scanning is a regular security review of your internet-facing systems, performed externally by an approved company. You can compare it to a periodic vehicle inspection – only instead of brakes and lights, it checks whether your website and servers have known weaknesses an intruder could exploit.
The name comes from who performs it. ASV stands for Approved Scanning Vendor. It is a company whose tools and processes have been checked and accepted by the body that sets payment security standards (the PCI SSC), and which has made it onto the official list. The word “approved” is key: not every company with a scanning tool can perform a scan that counts.
Scanning is required if your business accepts card payments – it is part of the PCI DSS standard, which applies to everyone who processes payment card data. Even small online shops that redirect payment to an external operator may be subject to this obligation. The scan must be repeated regularly, usually quarterly, because new weaknesses appear constantly.
In the simplest terms: ASV scanning is a regular external check of whether the “doors and windows” of your internet-facing systems are closed – performed by a company officially permitted to carry out such a review.
What exactly does the scan check, and what does it not do?
The scan checks internet-facing systems for known weaknesses – like out-of-date software, badly configured protections or open “gateways” that should not be open. It does not, however, actually try to break in, nor does it judge whether your site’s logic (for example the ordering process) can be tricked.
What the scan typically detects, in plain words:
- Out-of-date software. Programs and components in versions with known flaws – like a lock known to be pickable.
- Badly configured protections. Settings that leave unnecessary openings – like a window left ajar.
- Weak encryption. Outdated ways of securing connections through which data could be intercepted.
- Unnecessarily open services. Functions accessible from the internet that should not be publicly visible.
What the scan does not do matters just as much. It does not actually break into the system – it only checks whether weaknesses exist, without exploiting them. It does not test business logic – it does not check whether, say, the payment process can be tricked with a clever workaround. It does not look inside your internal network – it sees only what is visible from the internet. A different kind of test, called a penetration test, is used for deeper checks, in which specialists actively try to break in. The scan and the penetration test complement each other – they are not the same.
The ASV scan checks “whether the locks work and the doors are closed”, not “whether you can be robbed despite the locks” – the latter is examined only by a penetration test, in which someone actually tries to get in.
What is a false positive and why does it matter?
A false positive (false alarm) is a situation where the scan reports a weakness that does not actually exist, or in your specific case does not matter. It is a normal phenomenon in automated scanning – the tool would rather warn too much than too little, so it sometimes raises an alarm where there is no real threat.
Where do false alarms come from? An automated scanner recognises patterns – for example a software version – and reports a potential flaw on that basis. But reality can be more complex: a security patch may have been applied without changing the version number, a function may be inactive, or the reported weakness may not apply to your configuration. The scanner does not know this – it sees the pattern and alarms.
Why does it matter? Because false alarms must be resolved before you obtain a passing scan result. If the scan reports a serious weakness and you believe it is a false alarm, there is a formal process: you report it to the vendor with a justification and evidence, and they verify and – if you are right – record that the item is not a real threat. Without this process, a false alarm would block your passing result even though you are genuinely secure.
False-positive handling is exactly where the difference between “a service” and “a tool” becomes tangible. The tool alone will raise the alarm and leave you with it. A service helps assess whether it is a real threat, prepare the report and go through the verification process.
What do you get by buying the service rather than just tool access?
By buying an ASV scanning service, you get not just the scan itself but result interpretation, support in fixing weaknesses, false-alarm handling and a formal compliance document. Access to the tool alone gives you a raw result – the rest is up to you.
What the service includes and the tool alone does not:
- Result interpretation. A raw scan report can be technical and long. The service explains what really matters, what is urgent and what can be ignored – instead of leaving you with a list of hundreds of items.
- Remediation support. Detecting a weakness is half the job – it still has to be removed. The service advises how to do it and verifies the outcome with a rescan.
- False-positive handling. The service helps assess false alarms, prepare reports and go through the formal verification process – often the most time-consuming element.
- Formal proof of compliance. After a passing scan you get an official document (the Attestation of Scan Compliance) you need to demonstrate PCI DSS compliance. The tool alone does not always issue a recognised attestation.
- Continuity and reminders. The scan must be repeated regularly. The service keeps track of the schedule so you do not miss the deadline and lose compliance.
The difference comes down to who does the work around the scan. The tool generates a result. The service turns that result into an outcome: understood, fixed, documented and maintained over time. For a business without its own security team, this difference often decides whether compliance is genuinely achievable or remains a source of frustration.
Patronusec Insight: In our project experience, businesses most often underestimate how much work separates “running a scan” from “obtaining a passing, documented result”. Running a scan is easy – the hard part is interpreting hundreds of items, resolving false alarms and remediating effectively before the deadline. Businesses that buy only tool access often come back for help when a scan fails just before the deadline and no one in the organisation knows what to do. We recommend considering upfront whether you have the resources to handle a scan result yourself – if not, the service saves far more than it costs.
FAQ – ASV scanning
Does my small business really need ASV scanning?
Probably yes, if you accept card payments – even when you redirect payment to an external operator. Since the latest version of PCI DSS, the scanning obligation also covers small e-commerce merchants whose website connects to a provider’s payment page. It is worth confirming your specific case, because the scope depends on how you accept payments.
How does an ASV scan differ from an ordinary antivirus program?
They are completely different things. Antivirus protects a single device from malicious software. An ASV scan checks externally whether your internet-facing systems (website, servers) have known weaknesses an intruder could exploit. The scan does not protect actively – it diagnoses, pointing out what to fix.
What happens when the scan detects a problem?
You receive information about the detected weaknesses with a rating of their severity. Serious weaknesses must be removed (fixed), and then a rescan ordered to confirm the problem is gone. This cycle repeats until a clean result is achieved. A good service guides you through this process and helps with the fixing.
What is a false positive and do I need to worry about it?
A false positive is a false alarm – the scan reports a weakness that does not really exist or does not matter for you. It is normal in automated scanning. You do not need to worry about it if you use a service – the vendor helps assess the alarm and go through the formal process of clarifying it, so you do not get stuck with a blocking but unreal threat.
Isn’t it cheaper to buy just the scanning tool?
Tool access can be cheaper on paper, but it leaves you with a raw result and all the work around it: interpretation, fixing, false-alarm handling and documentation. For a business without a security team, this work can cost more than the service – especially when a scan fails just before the deadline. The service turns the result into a ready, documented outcome.
How often must I run the scan?
Usually quarterly, that is every three months, plus additionally after significant changes to internet-facing systems. Regularity is necessary because new weaknesses appear constantly – a scan from six months ago says nothing about today’s state. The service usually keeps track of the schedule so you do not miss the deadline.
What exactly do I get in the end from Patronusec?
You get the scan performed, an understandable interpretation of the results, support in fixing the detected weaknesses, handling of any false alarms and a formal document (the Attestation of Scan Compliance) confirming a passing result for PCI DSS purposes. In short: not just a result, but a ready, documented outcome and support at every stage.
Recommended reading
A reading path for ASV scanning:
- What is ASV scanning and how it checks a website’s security – the same topic in technical terms.
- ASV scanning vs DORA or NIS2 testing – how the scan fits into broader security requirements.
- PCI DSS scope – where to start – how to establish what in your business is subject to PCI requirements.
ASV scanning as a service – free consultation
Patronusec provides ASV scanning as a full service – with result interpretation, remediation support, false-alarm handling and compliance documentation. Book a free consultation to check whether and to what extent your business is subject to scanning.
