Also called: ASV, External vulnerability scan, Network security scan
What an Approved Scanning Vendor is
An Approved Scanning Vendor is a company qualified by the PCI Security Standards Council (PCI SSC) to perform external vulnerability scans under PCI DSS. The scan checks internet-facing systems for known security weaknesses that could expose payment data or provide a path into your cardholder data environment (CDE).
The ASV uses a validated scanning solution, which includes its tools and procedures. This is a specific PCI compliance check, not a general review of every security control in your business.
An ASV scan checks the systems exposed to the internet, but your business still has to fix what it finds.
How the scan works
For in-scope systems, PCI DSS requires external vulnerability scans by an ASV at least once every three months and after significant changes. The ASV scans the internet-facing addresses and systems in scope, then reports findings that need attention. PCI DSS v4.0.1 is current as of 2026.
A passing scan is evidence for one part of PCI DSS validation. It does not replace your other compliance duties, such as completing the right self-assessment questionnaire or protecting cardholder data inside your network.
Which systems are in scope
The scan covers internet-facing systems that are part of your CDE or provide a path to it. That can include an e-commerce website, a payment application, or a public-facing server connected to systems that handle card data. The scope is based on how your systems connect, not just whether you take payments online or in person.
If you outsource payment handling, map how the hosted payment page and your own website connect before deciding what needs scanning. A card-present business can still have in-scope internet-facing systems if those systems connect to its CDE.
What it means for your costs and compliance
An ASV scan is not interchange, a network assessment, or processor markup, so it does not directly change your rate per card sale. Your ASV charges for a separate security service; the research does not establish a standard price or a standard merchant-statement line name.
The business consequence is compliance and security risk. Unresolved scan findings can prevent you from meeting the external-scan requirement, while regular scans give you a chance to fix exposed weaknesses before they threaten card data. The scan report identifies findings, but your team still has to remediate them and arrange a rescan when required.
What you can actually change
- Confirm your scope. List internet-facing IP addresses, websites, and payment systems connected to your CDE. Include systems that provide a path into it, not just the checkout page.
- Schedule required scans. Arrange an ASV scan at least once every three months and after significant changes to in-scope internet-facing systems.
- Fix and verify findings. Review the report with your IT team or web developer, remediate reported vulnerabilities, and arrange a rescan to confirm the fixes.
- Separate service charges. Compare ASV service invoices with your payment-processing statement. An ASV scan is a separate compliance service, not a card transaction fee.
Frequently asked questions
Does every business that accepts cards need an ASV scan?
The scan requirement applies to in-scope internet-facing systems connected to your cardholder data environment, not simply to every business that accepts cards. Map your website, payment application, and network connections to determine whether external systems are in scope.
How often do you need an ASV scan?
PCI DSS requires ASV external vulnerability scans at least once every three months for in-scope systems and after significant changes. Keep the scan reports and remediation records with your PCI compliance documentation.
Does an ASV scan replace a PCI self-assessment?
No. An ASV scan addresses the external vulnerability scanning requirement. It does not replace your other PCI DSS validation steps, including completing the appropriate self-assessment questionnaire when required.
Will an ASV fee appear on my merchant statement?
An ASV scan is a separate security service, not a card-processing fee. There is no standard merchant-statement line name established for ASV charges, so compare your scan invoice with your processing statement rather than assuming a processing fee is an ASV charge.