PCI DSS requires regular penetration testing of the cardholder data environment and its connected systems. We test the way a threat actor would, and report what to fix first.
Core-Infosec provides penetration testing and PCI readiness support. We do not perform PCI validation assessments. Your acquirer, card brand or assessor decides which validation applies to you. Our job is to give you testing evidence and a clear remediation path.
Beyond PCI, we also test internal and external networks, web applications and APIs, and cloud and Microsoft 365 environments, including red team exercises. See Penetration Testing. Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.
Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day. Ask us about incident response retainers as well.
Penetration testing is performed only with written authorization.