If you're choosing a firm for your PCI DSS penetration test, you should know exactly what you're buying before you sign anything. This is how a PCI engagement at Radical Security works, step by step, from the first email to the moment your assessor accepts the work.

I'm Marcello Duarte, and I lead PCI penetration tests at Radical Security. Every PCI engagement follows this process.

Step 1: The first conversation

It starts with an email to [email protected] and a call. We don't cold call, so the first conversation always happens because you reached out. On that call I want to understand:

  • How you're being assessed: ROC, SAQ D, another SAQ, or as a service provider.
  • When your assessment is and who your QSA is, if you have one.
  • What your cardholder data environment looks like at a high level, and whether you rely on segmentation.
  • What happened in your last penetration test, if you had one.

Sometimes the honest answer is that you need scoping work before you need a test. If so, I'll tell you.

Step 2: Written scope and fixed price

Next I review your data flow diagram, network diagram and CDE inventory, and write a proposal. The process is described in detail in how I scope a PCI DSS penetration test. The proposal includes:

  • The exact scope, with each item mapped to the part of Requirement 11.4 it satisfies.
  • The methodology we'll follow.
  • The report contents you'll receive.
  • The retest, included in the price.
  • A fixed price and what "complete" means for this engagement.

If you'd like your QSA to review the scope before we start, we encourage it. Nothing begins until you've signed off.

Step 3: Rules of engagement

Before testing, we agree on the operational details: testing windows, source IP addresses, points of contact on both sides, how to reach each other urgently, any systems that need special care, and test accounts for authenticated application testing. Production payment systems get tested carefully, and we'll work around your change freezes and peak trading periods.

Step 4: Testing

Testing is manual and led by certified practitioners. Our team holds OSCP, BSCP, CEH and CISSP certifications. Depending on scope, testing covers:

  • External testing of your internet-facing CDE perimeter, payment pages and APIs (11.4.3).
  • Internal testing from inside your network against CDE and critical systems (11.4.2).
  • Application-layer testing against the attack classes in Requirement 6.2.4, using the same techniques as our web application penetration tests.
  • Segmentation testing from every out-of-scope segment toward the CDE (11.4.5 / 11.4.6), described in PCI segmentation testing in practice.

If we find something critical, such as exposed cardholder data, a working path into the CDE or a remotely exploitable system, we tell you the same day. You don't have to wait for the report.

Step 5: Report and readout

You receive a report written for your team and for your assessor, with scope, methodology, limitations, narrative, segmentation results, findings with evidence and remediation steps, tools, cleanup and tester independence. I go through it in detail in what a PCI pentest report needs to pass your assessment.

We then hold a readout call to go through the findings with your team, answer questions and help prioritize remediation using your risk assessment process.

Step 6: Remediation and retest

Requirement 11.4.4 requires exploitable findings to be corrected and the testing repeated to verify the corrections. Once you've remediated, we retest every finding and issue a retest report showing the result for each one. The retest is part of the engagement price. If something isn't fixed on the first try, we retest again once it is.

Step 7: Supporting your assessment

Your assessor may have questions about the methodology, the scope or specific findings. We answer them directly. The engagement isn't finished until the work we agreed to deliver is something your assessment can use.

Step 8: Payment and our guarantee

We never ask for money up front, and you pay only once the work is complete. That means after the report and retest are delivered, not before testing starts.

Every engagement is also covered by our 100% money-back guarantee. If you're not satisfied, email [email protected] with "Guarantee" in the subject line within 30 days of receiving your final deliverable. A senior member of the team will propose a fix, such as additional testing, a retest or a revised report, at no cost. You decide whether to accept the fix or take a 100% refund. If you haven't paid yet, we hold the invoice while we make it right. The full terms are on the guarantee page and the How We Work page.

Key takeaways

  • Every Radical Security PCI engagement starts with a written scope mapped to Requirement 11.4 and a fixed price.
  • Testing is manual, covers external, internal, application-layer and segmentation testing as scoped, and critical findings are reported the same day.
  • Reports are written for your assessor as well as your team, and the retest is included.
  • We support your assessor's questions until the work is usable for your assessment.
  • You pay only once the work is complete, and every engagement is backed by our 100% money-back guarantee.
About the author. Marcello Duarte is a cybersecurity consultant at Radical Security and the author of this blog. He scopes and leads penetration tests for organizations working toward PCI DSS, SOC 2 and ISO 27001, and previously worked in vulnerability research, where he discovered CVE-2015-7392. To scope a PCI penetration test with Marcello, email [email protected].