Guide · PCI DSS v4.0.1
PCI ASV scans: what they cost, and how to stop overpaying
The same certified quarterly scan is sold for $80 and for $800. The certificate is identical — the difference is packaging. Here is who actually needs one, what to expect to pay, and how to pass without a month of back-and-forth.
An ASV — Approved Scanning Vendor — is a company certified by the PCI Security Standards Council to run the external vulnerability scans PCI DSS requires. If your SAQ requires them, you need a scan from an ASV every 90 days, and the result has to actually pass.
Typical market price is $80–$800 per IP per year. Same certification, wildly different service.
Check whether you need ASV scans at all. SAQ A merchants generally do not — and a surprising number of small businesses have been sold quarterly scans they never needed. Confirm against your SAQ type first; the SAQ selector covers the common cases.
What a PCI scan actually is
A PCI scan is an external vulnerability scan: a tool, run from outside your network, probing the systems that are reachable from the internet. It looks for known weaknesses — out-of-date software, weak TLS, exposed services, misconfigurations — and reports them with severity ratings.
The part people miss: it has to be run by an ASV. A scan from a free tool, or from your hosting provider, may be perfectly good engineering. It is not evidence. Your acquirer wants a report from a vendor on the PCI SSC’s approved list, and nothing else is accepted.
“In scope” here means anything with an internet-facing IP address that is part of, or connected to, your cardholder data environment. Miss a system and you have not actually scanned your scope — which is the kind of gap that surfaces at the worst possible moment.
Do you need one? It depends entirely on your SAQ
| SAQ | ASV scans | Why |
|---|---|---|
| SAQ A | Generally no | Fully outsourced, no external systems in scope |
| SAQ A-EP | Yes | You host the page around the payment fields |
| SAQ B-IP | Yes | IP-connected terminals on your network |
| SAQ C / C-VT | Usually yes | Systems connected to the internet in scope |
| SAQ D | Yes | Full standard applies |
Level 3 merchants — 20,000 to 1 million e-commerce transactions a year — typically need quarterly scans regardless of SAQ. Confirm with your acquirer; the requirements in your merchant agreement are what actually bind you.
What it costs, and why the spread is 10x
| Model | Typical price | What you get |
|---|---|---|
| Budget specialist, per IP | ~$59–$188 / IP / year | Four quarterly scans, rescans included, self-service portal |
| Mid-market specialist | ~$185–$550 / IP / year | Scans plus some hand-holding, sometimes a compliance dashboard |
| Enterprise platform | $800+ / IP / year, or five figures | Bundled with vulnerability management, SLAs, account management |
All three produce a passing report from an approved vendor. So why pay 10x?
Sometimes there is a real reason: dozens of IPs, complex environments, compliance reporting you need to hand to auditors, or a vendor who will sit on a call while you remediate. Often there is not — a small merchant with one external IP is buying the same certificate either way.
How to choose a vendor without overpaying
- Confirm you need it. Check your SAQ type and your merchant agreement first. Do not buy quarterly scans to solve a problem you may not have.
- Count your external IPs — properly. Every internet-facing address connected to your card environment counts. This number drives the price, and getting it wrong means either overpaying or being under-scoped.
- Get three quotes, and ask the same three questions. Are rescans unlimited and included? Is false-positive dispute resolution included? What happens if a scan fails — do you get help?
- Check the vendor is on the current PCI SSC list. Not a reseller of an ASV — the actual approved vendor. The list is published and free to check.
- Fix the easy things before you scan. Disable TLS 1.0/1.1, remove unused services, patch the obvious. Most first-scan failures are things you can eliminate in an afternoon.
Why most first scans fail
A failing scan is not a disaster — it is usually a short, boring list. The recurring offenders:
- Old TLS versions still enabled. TLS 1.0 and 1.1 are the single most common finding.
- Exposed services nobody remembers running. Staging servers, old admin panels, a forgotten mail service.
- Out-of-date server or CMS versions, visible from the outside via banners and headers.
- Verbose error pages leaking version numbers and stack traces.
- Default certificates or certificates missing an intermediate chain.
If a finding looks wrong to you, use the ASV’s dispute process rather than accepting it. False positives are common, and a documented dispute with evidence is normal practice — not an argument.
Where ASV scans fit into the bigger picture
Scans are one requirement among many, and they are the easiest one to buy. The harder and more valuable work is getting your scope right first — because a scan only ever covers what you told it to cover.
If you are not sure which questionnaire you file, start with Which SAQ do I need? Then work through the PCI compliance checklist, and check the full cost breakdown so you are not comparing one line item in isolation.
Not sure whether you need scans at all?
Take the checklist — it covers scope, SAQ type and a cost worksheet, so you can see what genuinely applies before you buy anything.
No spam. Unsubscribe anytime.FAQ
What is an ASV?
An Approved Scanning Vendor — a company certified by the PCI Security Standards Council to run the external vulnerability scans that PCI DSS requires. Only an ASV's scan results are accepted as evidence of compliance; a scan from any other tool does not count, however good the tool is.
Do I need an ASV scan?
It depends on your SAQ. SAQ A generally does not require them. SAQ A-EP, SAQ B-IP, SAQ C and SAQ D typically do, as do most Level 3 and Level 4 merchants with external systems in scope. Check the current SAQ document for your type, or ask your acquirer.
How often do I need to scan?
Quarterly — at least once every 90 days — plus a scan after any significant change to your external environment. The quarterly cadence is a requirement, not a suggestion, and it is one of the things acquirers ask to see evidence of.
Why does the price vary so much?
You are buying the same certification, but different vendors package it differently: per-IP pricing versus subscriptions, unlimited rescans or none, whether dispute resolution is included, and how much support you get when a scan fails. The certified result is identical — the service around it is not.
What if my scan fails?
Most first scans fail on something fixable — an outdated TLS configuration, an exposed service, a verbose error page. Vendors normally include rescans so you can fix and re-run. If you believe a finding is a false positive, ASVs have a dispute process — use it rather than accepting a finding you can evidence as wrong.
Can I just use a free vulnerability scanner?
You can use one to find issues, and that is genuinely useful. But it will not produce the passing scan report your acquirer needs. Free tools are for remediation; an ASV scan is for evidence.
Reviewed October 2026. General information, not legal or compliance advice. Confirm your scan requirements against the current PCI DSS SAQ document and your merchant agreement. Corrections welcome.