Penetration Testing Cost for PCI DSS v4 (2026)

PCI DSS v4 Requirement 11.4 mapped to scope

PCI DSS v4.0.1 Requirement 11.4 has five sub-requirements, each driving specific testing scope and cost.

Cardholder Data Environment scope

The single most important question for PCI pentest cost is what scope the Cardholder Data Environment (CDE) actually covers. The CDE is everything that stores, processes, or transmits cardholder data, plus any system that could affect the security of the CDE. Scope sprawl is the most common cost driver and the most common compliance failure mode.

Reputable PCI pentest firms will start the engagement with a CDE scope validation step, comparing your declared CDE against actual network traffic, log analysis, and configuration review. This step frequently identifies systems that should be in CDE but are not declared (most often: cloud-hosted payment-processing components, third-party JavaScript libraries on payment pages, internal admin tools that touch cardholder data).

Scope validation is usually 1-2 days of consultant time, well worth doing because mid-engagement scope expansion is much more expensive than upfront validation.

Segmentation testing in detail

Segmentation testing is the most cost-relevant PCI-specific testing component. If your CDE scope is reduced through segmentation controls (which most modern PCI deployments do, because the alternative is testing your entire network as CDE), Requirement 11.4.5 mandates that you test those segmentation controls annually. Service providers that rely on segmentation for customer separation must test every six months under Requirement 11.4.6.

The segmentation test itself involves: enumerating every documented allowed pathway between non-CDE networks and the CDE, attempting to use undocumented pathways from each non-CDE network zone, verifying that segmentation enforcement points (firewalls, ACLs, VPC routing) actually block the expected traffic, and producing evidence that no unauthorised path exists.

Across our buyer corpus, roughly 35% of first-time segmentation tests find at least one previously unknown path into the CDE. The test cost ($3,000-$7,000) is almost always paid back by avoiding a QSA finding that would expand scope, plus the genuine risk reduction from closing the discovered path.

Sample annual PCI pentest budgets

PCI-specific report-format requirements

PCI pentest reports have specific structural requirements that QSAs check against. The report should include: explicit scope statement that maps to the CDE, methodology used (PCI expects industry-recognised standards like NIST 800-115 or OWASP), all findings with CVSS scores, evidence of how each finding was identified, remediation status for each finding, and retest results for any high or critical findings.

The retest piece is particularly important. PCI requires that exploitable vulnerabilities found in the pentest be corrected and the correction verified through retesting. The retest evidence must be in the final report; a pentest report that only documents findings without retest evidence is incomplete from the QSA's perspective.

Most boutique firms include retesting in the engagement quote and produce a final report after retesting. Some Big 4 firms charge separately for retest. Always clarify whether retest is included before signing the SoW.