The best PCI penetration testing companies for most merchants and service providers in 2026 are White Knight Labs, for manual-heavy testing that covers the cardholder data environment, the corporate networks connected to it and cloud-hosted card systems; SecurityMetrics, for buyers who want testing from a firm that is also a PCI QSA, ASV and forensic investigator; and Schellman, for organizations that want PCI testing and a PCI assessment from one firm with deliberately separate teams. This guide to the Top PCI Penetration Testing Companies In 2026 covers seven more firms, from QSA-linked consultancies to independent boutiques in the US and Europe.
This list is for compliance, security and payments teams that need an outside tester to satisfy PCI DSS Requirement 11.4 and give their QSA usable evidence. We only included service firms that publish a named PCI DSS penetration testing offering or describe PCI segmentation testing as part of their network service. We compared what each firm says about scope, segmentation, methodology, reporting and retesting, using the companies’ own websites. If you are new to the compliance side of testing, start with our penetration testing for compliance guide.
PCI Penetration Testing Companies At A Glance
Company
Headquarters
Best For
PCI Testing Coverage
White Knight Labs
Guys Mills, Pennsylvania, USA
Manual testing of the CDE and connected networks
External, internal, segmentation, payment apps and APIs, AWS, Azure and GCP, optional pre-QSA retest
SecurityMetrics
Orem, Utah, USA
Buyers who want a QSA, ASV and PFI firm
External, internal, application, segmentation checks, retest in initial quote
Schellman
Tampa, Florida, USA
One firm for the PCI assessment and the pentest
Network, application, segmentation, one retest within 30 days, attestation letter
KirkpatrickPrice
Nashville, Tennessee, USA
Audit-led programs across several frameworks
Network, web, API, wireless, social engineering, retest after remediation
Adversim
Las Vegas, Nevada, USA
Fixed-fee, senior-led PCI engagements
11.4.2 to 11.4.7 mapping, segmentation, multi-tenant testing, QSA coordination
TrustFoundry
Overland Park, Kansas, USA
Portal-based findings and built-in retests
Network and application layers, segmentation validation, retests in portal
Blaze Information Security
Portugal and Brazil
Payments and fintech teams
Internal, external, segmentation, web and API, mapping to 11.4 and 6.4
usd AG
Neu-Isenburg, Germany
European merchants wanting one PCI provider
11.4 pentest, segmentation tests, internal and ASV scans
1. White Knight Labs — CDE, Connected Network And Cloud Card Environment Testing
White Knight Labs is a boutique offensive security firm founded in 2017, with offices in Guys Mills, Pennsylvania, and Grand Rapids, Michigan. Its PCI DSS penetration testing service is built around annual testing of the cardholder data environment and the networks connected to it. The firm frames it against Requirement 11.4, which calls for annual external and internal penetration testing and testing after significant changes, and says engagements meet PCI DSS v4.0 expectations.
The scope is broader than many PCI offerings. Testers cover the external perimeter, internal components inside the CDE, corporate network segments that connect to or from the CDE, segmentation controls, web applications and APIs that process payment data, and authentication, access control and session management. Where cardholder systems run in AWS, Azure or GCP, those environments are in scope too. The stated goal is to prove that no uncontrolled pathways exist between in-scope and out-of-scope systems, which is exactly the question a QSA will ask about segmentation.
Every engagement starts with a scoping call to define the CDE, connected networks and reporting needs. Deliverables include an executive summary and technical report, scan results and evidence, segmentation results where applicable, proof of exploitation, prioritized remediation advice and an optional retest to validate fixes before the report goes to the QSA. White Knight Labs describes its overall testing mix as roughly 20% automation and 80% manual, holds CREST Pathway+ status and is a Service-Disabled Veteran-Owned Small Business.
Best for: Merchants and service providers that want mostly manual PCI testing covering the CDE, connected corporate networks and cloud-hosted card systems, with a retest before QSA review.
2. SecurityMetrics — PCI Testing From A QSA, ASV And Forensic Investigator
SecurityMetrics was founded in 2000 and is headquartered in Orem, Utah. It describes itself as an Approved Scanning Vendor, Qualified Security Assessor and Certified Forensic Investigator, with staff holding PCI Forensic Investigator certification.
Its testing menu covers external, internal, application and mobile tests plus segmentation checks, run as customized gray-box engagements that combine automated and manual work, with testers holding credentials such as CISSP, OSCP and BSCP.
The firm says reports arrive within six weeks and include a narrative of the testing, the vulnerabilities found and remediation steps. One differentiator is pricing structure: SecurityMetrics says retesting is included in the initial quote, which avoids a surprise invoice after remediation.
Best for: Small and mid-sized merchants that want PCI testing from a long-standing payments security specialist with retesting built into the price.
3. Schellman — QSA And Pentest Under One Roof With Separate Teams
Tampa-based Schellman is a large attestation and compliance firm that performs both PCI DSS assessments and penetration testing. It addresses the obvious independence question directly: its PCI QSA team and its penetration testing teams are separate, with different management structures, which the firm says avoids perceived bias when one company does both for the same client.
Schellman’s network testing covers internal, external and wireless networks and includes network segmentation testing. Its published PCI guidance describes segmentation tests as typically taking about a week including reporting, with a tester connecting a VM or device to an untrusted network and attempting host discovery and TCP and UDP port scans against the CDE. Its application service covers web applications, APIs and client-side applications, which fits the application-layer testing PCI DSS expects.
For PCI engagements, Schellman says findings are shared as they are identified through its AuditSource platform, and one retest of original findings is included within 30 days, with a separate retest report and attestation letter. Listed tester certifications include OSCP, OSEP, OSWE, CISSP and GPEN.
Best for: Service providers and larger merchants that want coordinated scoping between their PCI assessment and their penetration test.
4. KirkpatrickPrice — Audit Firm With A Broad Manual Testing Menu
KirkpatrickPrice is a licensed CPA firm, PCI QSA and HITRUST CSF assessor with its corporate office in Nashville, Tennessee. Its penetration testing practice offers network, web application, mobile application, API, IoT, wireless, code review, continuous and social engineering testing, so PCI buyers can bundle CDE testing with payment application and API work.
The firm emphasizes manual work, saying testers use manual techniques, human intuition and experience to attack the vulnerabilities they discover. Its methodology draws on OSSTMM, information systems audit standards, CERT/CC, SANS, NIST and OWASP. Deliverables include a report with a narrative explaining the testing techniques, plus remediation guidance, and the team retests after remediation.
Best for: Organizations that already run several audits and want a single compliance partner that can also test their payment environment.
5. Adversim — Requirement-By-Requirement PCI Testing With Fixed Fees
Adversim is a Las Vegas firm whose PCI penetration testing page maps its work to each part of Requirement 11.4: internal testing under 11.4.2, external testing under 11.4.3, post-change testing, segmentation testing under 11.4.5, six-monthly segmentation tests for service providers under 11.4.6 and tenant isolation testing for multi-tenant providers under 11.4.7. It notes that segmentation testing is often where engagements find the most surprising results.
Methodology is aligned to PCI DSS v4.0, NIST SP 800-115, the OWASP Top 10 and API Security Top 10, and OSSTMM. Reports include a scope statement, methodology section, tester qualifications, findings mapped to PCI requirements with CVSS v3.1 severity, a separate segmentation results section, a retest report and direct coordination with your QSA.
Best for: Merchants and service providers that want a transparent, requirement-mapped PCI test with a fixed price and direct QSA coordination.
6. TrustFoundry — Hand-Tested PCI Engagements Delivered Through A Portal
TrustFoundry, based in Overland Park, Kansas, has done penetration testing only since 2014 and says it has completed more than 1,000 assessments for over 200 organizations. Its PCI service tests the CDE and systems that could affect its security from outside and inside the network, at both the network and application layers.
Each test is performed by hand and reviewed by a second consultant. Findings appear in the TrustFoundry platform with severity, evidence and reproduction steps, and retests are built into engagements: clients request them in the portal and verification is recorded against the original finding. The final report covers scope, methodology, tester qualifications, findings and remediation results.
Best for: Teams that want independent, hand-tested PCI work with retest evidence tracked in one place.
Blaze Information Security was founded in 2016 and has offices in Portugal and Brazil. The firm says it has roots in testing for the financial sector, including banking and payments, and that it has performed dozens of PCI pentests. It describes its engagements as CREST-accredited.
Its PCI service maps work to specific requirements: a documented methodology under 11.4.1, internal and external testing under 11.4.2 and 11.4.3, remediation and retest under 11.4.4, and segmentation testing under 11.4.5 and 11.4.6. It also covers custom software and internet-facing application testing tied to Requirement 6, while being honest that a pentest does not replace the ongoing controls in 6.4.2, 6.4.3 or 11.6.1.
Best for: Fintech and payments companies that want application-heavy PCI testing with careful mapping to individual requirements.
8. usd AG — European QSA With An In-House Testing Lab
usd AG, founded in 1994 with locations in Neu-Isenburg, Cologne and Munich, describes itself as one of the leading Qualified Security Assessors in Central Europe, with more than 20 years of auditing complex PCI environments. Its technical PCI work is delivered by the analysts at usd HeroLab.
The PCI security analysis offering bundles the Requirement 11.4 penetration test, segmentation tests that verify the CDE is isolated from other networks under 11.4.5 and 11.4.6, internal vulnerability scans and external ASV scans. That lets European merchants and service providers buy all of their Requirement 11 technical testing from one provider.
Best for: European organizations that want PCI pentests, segmentation tests and scans from an experienced regional QSA.
9. Pentest Ltd — CREST-Accredited UK Testing Scoped By Your QSA
Pentest Ltd is a CREST-accredited UK firm that also holds Cyber Essentials Plus and offers PCI DSS penetration testing as part of its compliance testing line. Its approach starts from the QSA: the firm says the scope and level of testing are determined by your Qualified Security Assessor and can include internal and external infrastructure, applications and segmentation controls.
Segmentation testing uses host discovery and port scanning to find possible access points, checks that isolated LANs cannot reach each other and reviews firewall configurations. Application work is aligned with OWASP and can run as black, white or gray box, with gray box preferred. Testing is manual and expert-led, with automated tools in support.
Best for: UK merchants and service providers that want CREST-accredited testing built around their QSA’s scope.
10. Tevora — CREST-Accredited Testing Backed By A Payments Practice
Tevora was founded in 2003 and is headquartered in Irvine, California. Its penetration testing is CREST accredited and covers internal, external and cloud networks, network segmentation, WiFi, web applications, APIs, mobile and desktop apps, plus device, IoT and AI testing. Tevora states plainly that PCI DSS sets explicit pen testing requirements at defined intervals and after significant changes.
What makes Tevora relevant for PCI buyers is the payments expertise behind the testers. The firm runs a separate PCI compliance practice with QSA staff, and its webinars on PCI DSS 4.0 testing requirements pair payments QSAs with its threat practice leadership. Reports are written for both executives and technical staff.
Best for: Enterprises that want CREST-accredited PCI testing from a firm that also advises on wider payments compliance.
How To Choose A PCI Penetration Testing Company
Does The Scope Match Your CDE And Connected Systems?
A PCI test has to cover the CDE perimeter, critical systems and anything that can affect CDE security, at both the network and application layers. Ask the vendor how it defines connected systems and whether corporate segments, payment APIs and cloud-hosted card systems are included. White Knight Labs, Adversim and Blaze all spell this out on their service pages.
How Do They Test Segmentation?
If you rely on segmentation to shrink PCI scope, the segmentation test is the part your QSA will scrutinize most. Under PCI DSS v4.0.1, merchants test segmentation controls at least every 12 months and after changes to them, while service providers test at least every six months under 11.4.6. Ask how the tester proves isolation, what tools they use and whether results appear in a separate section of the report.
Are They Independent Of The People Who Run Your Systems?
PCI DSS requires organizational independence for the tester, not a QSA or ASV badge. If your QSA firm also offers testing, ask how the teams are separated. Schellman, for example, says its QSAs and testers sit under different management structures.
What Happens After The Report?
Requirement 11.4.4 expects exploitable findings to be fixed and the fixes verified by repeat testing. Check whether a retest is included, how long you have to request it and whether you get a retest report or attestation letter. SecurityMetrics includes retesting in its quote, Schellman includes one retest within 30 days and TrustFoundry tracks retests in its portal.
Will The Report Work For Your QSA?
Ask for a sample. A QSA-ready report shows scope, methodology, tester qualifications, findings with evidence, segmentation results and remediation status. Our guide to the penetration testing report covers what good looks like.
Frequently Asked Questions
What Does PCI DSS Requirement 11.4 Require?
Requirement 11.4 requires a defined, documented penetration testing methodology, internal and external penetration tests at least once every 12 months and after significant infrastructure or application changes, correction and retesting of exploitable findings, and segmentation testing where segmentation is used to reduce scope. Multi-tenant service providers also have to support customer testing under 11.4.7, which moved from best practice to a requirement after 31 March 2025.
Is A Vulnerability Scan Enough For PCI Compliance?
No. Quarterly internal and external vulnerability scans fall under Requirement 11.3, while penetration testing under 11.4 is a separate obligation that involves actively exploiting and chaining weaknesses. Our vulnerability scanning vs penetration testing guide explains the difference.
How Often Should Service Providers Test Segmentation?
Service providers that use segmentation must test those controls at least once every six months and after any changes to segmentation methods, according to the PCI Security Standards Council. Merchants test at least every 12 months.
Conclusion
The right PCI penetration testing company depends on how your card environment is built and who your QSA is. White Knight Labs suits teams that want mostly manual testing across the CDE, connected corporate networks and cloud card systems, SecurityMetrics suits smaller merchants that want a payments specialist with retesting included, and Schellman suits organizations that want their assessment and test coordinated by one firm with separate teams. KirkpatrickPrice, Adversim, TrustFoundry, Blaze, usd AG, Pentest Ltd and Tevora each fit specific needs, from fixed-fee boutiques to European QSAs.
