[For PCI DSS 4.0 Requirement 11.4]
One pentest report, written against 11.4.1 to 11.4.7, by a dedicated security research team.
Trusted by Insurers to Fortune 100
Built for payment teams facing a first assessment, a renewal or a significant change.
Your PCI date is public.
Before your validation date, PCI DSS 4.0 asks for four things.
11.4.3
External Pentest
Every 12 months, and after any significant change.
11.4.2
Internal pentest
An internal penetration test on the same cadence
11.4.4
Fix and retest
Every exploitable finding closed before the report goes in.
11.4.5–6
Segmentation
Every 12 months. Every 6 for service providers.
We test your systems.
Your QSA assesses your compliance.
[Codeant ai]
We test what could break
Autonomous agent run test and security researchers verify findings and document the evidence.
[YOUR QSA]
The assess what meets PCI
Your assessor reviews the report as part of your PCI DSS assignment and reviews the evidence.
11.4.1 Testing method and independent testers
11.4.2 Internal test every year and after major changes
11.4.3 External test every year and after major changes
11.4.4 Fix and retest exploitable findings
11.4.5 Test network segmentation yearly
11.4.6 Service providers: test segmentation every six months
Method, qualifications, and independence statement
Dated internal test report
Dated external test report
Proof of retesting
Segmentation test results
Two dated tests per year
What we provide
All documented in the report
All documented in the report
Testing beyond scanner results
Verified fixes, logged by finding
Included in every engagement
Scheduled twice a year
What CodeAnt test
[CUSTOMER STORIES]
Teams trust CodeAnt
to prevent breaches
[SINGLE ENGAGEMENT]
One external penetration test
Internal & segmentation testing, if scope needs them
Retest included
Report mapped to 11.4.1 to 11.4.7
Three weeks from scope to report
Four penetration tests, one each quarter
Segmentation testing, including the six-month test
Retests, always included
365-day attack-surface monitoring
One report format your assessor already knows
[HOW IT WORKS]
Scope to Report in Three weeks
DEPTH
Test the path, not just the endpoint
Trace exposed and authenticated path to real impact
PROOF
Show how it was verified
See the tested path, proof, impact and reproduction steps
JUDGEMENT
Human review on top
Researchers verify each finding before it reaches your team
SOC 2 Type II
Gartner Cool Vendor 2026
HIPAA Compliant
[FAQ]
Frequently Asked
Questions
Will my QSA accept your report?
Is this a pentest or a scan?
Our assessor already does our pentest.
Do you test production?
We're a merchant, not a service provider.
What about significant changes mid-year?
[GET STARTED]
Report in 3 Weeks
Book a Call