Topic starter
06/09/2026 9:02 am
TL;DR: PCI DSS 4.0 now expects documented methodology, annual internal and external testing, retesting after significant change, and verified remediation, while FireCompass argues that annual point-in-time pentests no longer match modern change cadence. The governance gap is not just tooling, but whether compliance evidence is continuous, exploit-validated, and tied to the real attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “PCI DSS 4.0 Penetration Testing Requirements in 2026: What You Need to Know”.
Key questions
Q: What fails when PCI DSS 4.0 programs still rely on one annual pentest?
A: They lose alignment with the control’s actual evidence requirement.
Q: Why do authenticated paths matter so much in PCI penetration testing?
A: Because many payment-app weaknesses only become real when a session, role, or credentialed state is present.
Q: What are the signs that PCI remediation evidence is too weak?
A: A weak programme usually shows spreadsheet closure without retest proof, scanner noise treated as equivalent to exploitation, and no clear record that a fix actually broke the attack path.
Practitioner guidance
- Define change-triggered retesting rules Tie retesting to material application, infrastructure, and segmentation changes so that the next test reflects the current attack surface rather than the last audit cycle.
- Require exploit-level closure evidence Close findings only when a working proof of concept no longer succeeds and the retest record shows the fix actually broke the path.
- Separate segmentation validation from general scanning Run targeted tests that specifically prove isolation of the cardholder data environment and retain evidence for assessor review.
Bottom line: PCI DSS 4.0 pushes penetration testing toward continuous proof, not annual ceremony, because exploitability and retest evidence now matter as much as the original finding.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:02 am
PCI evidence quality is now the control, not the paperwork. The article shows that annual testing alone no longer answers the governance question PCI 4.0 is asking: can you prove a live control failure is actually closed? That shifts the centre of gravity from report production to exploit validation, retest evidence, and traceability across the control lifecycle. For practitioners, the real standard is demonstrable closure, not a filed artefact.
A question worth separating out:
Q: Should PCI teams prioritise segmentation validation or broader penetration testing first?
A: Prioritise segmentation validation when the cardholder data environment depends on network or trust boundaries that could collapse scope. Broader testing is still necessary, but segmentation is the control that determines whether the CDE is truly isolated. If the boundary is wrong, every downstream test starts from the wrong scope.
👉 Read our full editorial: PCI DSS 4.0 penetration testing in 2026: where programs fail