PCI DSS

A plain-English guide to testing an online shop: what testers check, how it differs from a scan, what PCI DSS expects and how to scope the work.

A firewall that’s fully patched can still be compromised. Firewall penetration testing explained, with what it checks and how often to run one.

A web application firewall filters attack traffic in real time, but the vulnerability behind a blocked request is still there tomorrow. What it stops, why it can be bypassed, and …

PCI DSS penetration testing requirements are more than one annual test. Where the checkbox approach falls short on internal, external, segmentation and remediation obligations, and how to fix it.

Two pentest quotes, three times the price difference. Here’s how to tell a genuine manual penetration test from an automated scan with a PDF wrapper.

ISO 27001, PCI DSS and cyber insurers each treat audits and penetration tests differently. Here is what each one checks, what the frameworks require, and which to book first.

What to demand from an ecommerce penetration test, why PCI compliance alone is not enough, and the questions that separate a real test from a relabelled one.

PCI DSS treats network segmentation as a control you must prove, not assume. Here is what segmentation testing covers, how often you need it, and what auditors expect to see.

Vendors sell badges, but no accredited penetration testing certificate exists. What a proper report and attestation letter contain, and why the distinction matters at audit time.

Commissioning PCI DSS penetration testing? What Requirement 11.4 actually obliges you to buy, and the questions to ask before you sign a quote.