SCANNING
Managed
Vulnerability Scanning
End-to-end vulnerability scanning to meet PCI DSS requirements.
Who it’s for
Organisations with internet-facing systems in scope for PCI DSS, particularly those without a dedicated security team.
At a glance
Service overview
Scanning is mandatory. Managing it does not
have to be your problem.
Our Managed Vulnerability Scanning service ensures your organisation
meets PCI DSS scanning requirements without the operational overhead. We manage the full lifecycle of vulnerability scanning, from execution to reporting
and attestation.
Our approach
All aspects of
PCI-required vulnerability scanning.
Scanning is mandatory, but managing it does not
have to be your problem. We run the cycle and
hand you findings that are already triaged.
01
Scan configuration and execution
We configure and perform internal and external scans using Approved Scanning
Vendor (ASV) tools where required.
02
Results analysis
Our specialists analyse scan outputs, validate findings, and prioritise
vulnerabilities based on risk and PCI impact.
03
Remediation guidance
We provide clear, actionable recommendations to address identified
vulnerabilities efficiently.
04
Rescanning and validation
We manage rescans to confirm remediation efforts and achieve passing results.
05
Reporting and attestation
All required PCI artefacts and attestation reports are produced and maintained.
Why Confide
Why organisations
hand scanning to us
We run the full scanning cycle so your team does not
have to, and because we assess against the Standard
ourselves, we know exactly what evidence your next
assessment will ask for.
Qualified Security Assessor, certified by
the PCI Security Standards Council.
Nothing missed
Scans run to schedule and tracked, with rescans until the
result passes.
Less noise
Findings validated and prioritised by people who assess,
before they reach your team.
Evidence ready
Attested passing scans, filed and ready for your
next assessment.
Common questions
Straight answers, before
you commit.
Ask us anything you would rather not put in
an email.
At minimum quarterly for in-scope internet-facing systems, and again after any significant change to the environment. We schedule and track both.
A failing scan is normal and expected. We triage the findings, tell you what actually needs fixing and in what order, then rescan until the result passes and can be attested.
Yes, where internal scanning applies to your scope. We confirm what is required as part of setting the service up.
Other services
Assurance across your whole programme.
-
Read More: Assessment & attestation
Assessment
Assessment & attestation
End-to-end support to achieve and validate PCI DSS compliance.
-
Read More: PCI DSS managed assurance
Programme
PCI DSS managed assurance
An ongoing programme that keeps you compliant between assessments.
-
Read More: Cardholder data scanning
Discovery
Cardholder data scanning
Identifying and reducing cardholder data risk.
-
Read More: Policies, procedures & training
Capabilty
Policies, procedures & training
Building a strong compliance and security foundation.
-
Read More: Security consulting
ADVISORY
Security consulting
Expert guidance to strengthen your security posture.
Why Confide
Related reading.
Practical guidance from our assessors on what the Standard actually asks of you, written for New Zealand merchants and service providers.
Hosted checkout, iframe or direct post: what each does to your scope
Most organisations we assess have chosen their online payment integration for commercial…
Let us take the
scanning off your plate.
Book a call with a Qualified Security Assessor. You will speak
to the person who would run your assessment, not an
account manager.