What is ASV scanning? ASV scanning is a quarterly external vulnerability scan of all internet-facing systems connected to the cardholder data environment, performed by a vendor on the Approved Scanning Vendor list maintained by the PCI SSC. It is a PCI DSS requirement (Requirement 11.3.2) and verifies that your website and connected systems have no known, exploitable vulnerabilities.
Canonical definition: ASV (Approved Scanning Vendor) scanning is an external vulnerability scan of internet-facing systems, performed at least quarterly by a PCI SSC-approved vendor, whose passing result confirms the absence of vulnerabilities scored CVSS 4.0 or higher.
The ASV scan is one of the most frequently misunderstood parts of PCI DSS. This article explains what it is exactly, what it checks on your site, what a “passing result” looks like and how it differs from other security tests.
ASV scanning – key takeaways:
- An ASV (Approved Scanning Vendor) is an organisation with a scan solution approved by the PCI SSC, authorised to perform external vulnerability scans for PCI DSS.
- The scan fulfils PCI DSS v4.0.1 Requirement 11.3.2: a quarterly external scan of all internet-facing systems within the cardholder data environment scope.
- A passing result means no vulnerabilities scored CVSS 4.0 or higher and no automatic-fail conditions – confirmed by a rescan after remediation.
- The formal evidence is the Attestation of Scan Compliance (AoSC) issued by the ASV; without it you cannot validate the external scanning requirement.
- An ordinary vulnerability scanner (for example your own instance of a tool) does not satisfy 11.3.2 – only a PCI SSC-listed vendor can issue a compliant attestation.
- Patronusec supports organisations in ASV scanning and in interpreting results and remediating within its ASV scanning service.
Table of Contents
What is an ASV and ASV scanning?
An ASV is an organisation with a set of services and tools (an “ASV scan solution”) that the PCI SSC has authorised to perform external vulnerability scans for PCI DSS. ASV scanning is the process of such a scan itself: remotely examining internet-facing systems for known vulnerabilities.
An Approved Scanning Vendor is not just any company with a scanning tool. The vendor’s scan solution is tested and approved by the PCI SSC before the vendor is added to the official Approved Scanning Vendors list – and it must be re-approved annually. This distinction is key: a capable scanner is not the same as an ASV. Tools such as popular vulnerability scanners are legitimate tools, but they cannot issue PCI-compliant attestations.
ASV scanning examines internet-facing systems: external IP addresses, domains and web applications reachable from the public network. It does not cover the internal network – that is a separate control under Requirement 11.3.1. The scan is non-disruptive (no exploitation of vulnerabilities) and focuses on detecting and classifying known weaknesses rather than exploiting them.
The key difference: ASV scanning is not a matter of owning a good scanner but of holding a scan performed by a vendor whose solution the PCI SSC has tested and listed – only such a scan counts towards PCI DSS.
Which PCI DSS requirement does the ASV scan fulfil?
The ASV scan fulfils PCI DSS v4.0.1 Requirement 11.3.2: a quarterly external vulnerability scan of all internet-facing systems within the cardholder data environment scope, performed by a PCI SSC-listed vendor. It is complemented by Requirement 11.3.2.1 on scans after significant changes.
The structure of scanning requirements in PCI DSS v4.0.1:
- Requirement 11.3.2 – external vulnerability scanning. All in-scope internet-facing systems must be scanned at least once every three months by an ASV. This is the core of the ASV scanning obligation.
- Requirement 11.3.2.1 – scans after significant changes. After any significant change to the external environment, an additional vulnerability scan must be performed. The quarterly scan must be done by an ASV; the significant-change scan may be done by qualified internal personnel, though many organisations use their ASV here to preserve independence.
- Requirement 11.3.1 – internal scanning. This is a separate control for the internal network, which the ASV does not cover. It is worth not confusing it with ASV scanning.
An important change in PCI DSS v4: the obligation for regular ASV scans now also covers merchants completing SAQ A. This applies to e-commerce merchants whose website redirects payment to a PCI DSS compliant third-party service provider (TPSP) or embeds its payment form. The intent is to limit the risk of compromise by scanning for and resolving vulnerabilities that could threaten the link to the TPSP’s payment page.
ASV scanning is not an optional add-on but a hard PCI DSS 11.3.2 requirement – and since v4 it also covers SAQ A merchants, who were previously exempt.
What exactly does the scan check on your website?
The ASV scan checks internet-facing systems for known vulnerabilities and misconfigurations an attacker could exploit remotely. It examines the externally visible attack surface: servers, services, web applications and their configuration – without exploitation and without testing business logic.
The typical areas the scan detects:
- Known software vulnerabilities. Out-of-date versions of servers, libraries and components with published vulnerabilities (CVEs) of known severity.
- Misconfigurations. Weak service configurations, unnecessarily open ports, exposure of administrative panels.
- Transmission encryption problems. Outdated protocols and weak cipher suites in connections protecting data.
- Web application vulnerabilities. Automatically detectable weaknesses in the application layer of the internet-facing site.
The boundaries of what the ASV scan does not do also matter. It does not exploit vulnerabilities (it does not actually try to break into the system). It does not test the application’s business logic. It does not cover the internal network. This distinguishes it from a penetration test, which actively tries to exploit weaknesses and also examines logic and paths an automated scan cannot reach. The ASV scan and the penetration test are complementary, not interchangeable, controls.
For a website owner, the practical point of the ASV scan is simple: it regularly confirms that internet-facing systems have no known, exploitable weaknesses – and if they do, it flags them for removal before an attacker does.
What does a passing result and the post-scan process look like?
A passing ASV scan result means no vulnerabilities scored CVSS 4.0 or higher and no automatic-fail conditions, confirmed by a rescan after any remediation. The formal evidence is the Attestation of Scan Compliance (AoSC) issued by the vendor.
The scan cycle and its result:
- The scan. The ASV scans all in-scope internet-facing systems.
- Result classification. Detected vulnerabilities are rated by CVSS severity. Any vulnerability scored CVSS 4.0 or higher, and any automatic-fail condition, means a failing result.
- Remediation and rescan. If the scan fails, the organisation removes the vulnerabilities and orders a rescan – and so on until a passing result is achieved within the same quarter.
- AoSC. Once the criteria are met, the ASV issues the Attestation of Scan Compliance – the official evidence of a passing scan.
The AoSC is the practical heart of the whole process. Merchants completing certain SAQs attach the AoSC to validate that the required scans were performed and passed. Without a passing AoSC from an ASV, an organisation cannot validate compliance with the PCI DSS external scanning requirement. Once a vendor is selected, most ASVs do not limit the number of reports generated, so remediation and rescans can be repeated until they pass.
Patronusec Insight: In our project experience, organisations most often confuse “running a scan” with “obtaining a passing scan”. The scan itself is only the beginning – the real work is interpreting the results, separating genuine vulnerabilities from noise and remediating effectively before the quarter ends. We recommend planning the scan with time to spare: the first scan early in the quarter leaves room for remediation and a rescan before the deadline. A scan ordered in the quarter’s last week leaves no room for fixes.
FAQ
How does ASV scanning differ from a penetration test?
An ASV scan is an automated, non-disruptive vulnerability scan of internet-facing systems, performed quarterly by an approved vendor. A penetration test actively tries to exploit weaknesses, examines business logic and paths inaccessible to an automated tool. PCI DSS requires both as separate controls – they are complementary, not interchangeable.
Can I use my own scanning tool instead of an ASV?
Not for Requirement 11.3.2. The quarterly external scan must be performed by a vendor on the PCI SSC Approved Scanning Vendors list, because only its solution has been tested and approved, and only it can issue a compliant attestation (AoSC). Your own tools may support the significant-change scan (11.3.2.1) or ongoing vulnerability management, but they cannot replace the ASV scan.
How often must an ASV scan be performed?
At least once every three months (quarterly) for all in-scope internet-facing systems, plus an additional scan after any significant change to the external environment (Requirement 11.3.2.1). In practice it is worth scanning with time to spare early in the quarter, to leave room for remediation and a rescan before the deadline.
What does a “passing” ASV scan mean?
A passing scan means no vulnerabilities scored CVSS 4.0 or higher and no automatic-fail conditions, confirmed by a rescan after any remediation. Only once these criteria are met does the ASV issue the Attestation of Scan Compliance (AoSC) – the formal evidence of scanning compliance.
Does ASV scanning also apply to small SAQ A shops?
Yes, since PCI DSS v4. The regular ASV scanning obligation now covers SAQ A merchants whose website redirects payment to a PCI DSS compliant third-party provider or embeds its payment form. The scan applies to the system hosting the payment-related page, to limit the risk of compromising the link to the provider’s payment page.
What do I get after a passing ASV scan?
The Attestation of Scan Compliance (AoSC) – an official document confirming the scan was performed by an approved vendor and passed. This is the evidence attached to PCI DSS validation to confirm the external scanning requirement is met. It usually comes with a report listing the detected vulnerabilities and their status.
Recommended reading
A reading path for ASV scanning:
- ASV scanning for the layperson – what it is and what a client buying the service gets – the same topic in non-technical terms.
- ASV scanning vs DORA or NIS2 testing – how to use one scan for many standards – how the ASV scan fits into the wider testing landscape.
- PCI DSS scope – where to start and how to define it – how to establish which systems are subject to scanning.
ASV scanning – free consultation
Patronusec supports organisations in ASV scanning – from defining the scope, through the scan and result interpretation, to remediation and obtaining the AoSC. Book a free consultation to check which systems are subject to scanning in your case.
