$ pentest --compliance=pci

PCI DSS v4 Requirement 11.4 mandates pen testing of the cardholder data environment annually and after any significant change. Scope and cost both follow CDE size.

$ answer --question="What does a PCI pen test cost?"

A PCI pen test for a mid-market CDE typically runs $15,000 to $50,000 in 2026 from a PCI-experienced vendor. Segmentation testing (proving the CDE is isolated from non-CDE network segments) adds $5,000 to $15,000. SAQ level dramatically affects scope: a Level 1 merchant has a wider obligation than an SAQ-A e-commerce site.

Last verified June 2026

$ stat --slot=1

$15-50K

Mid-market CDE band

PCI-experienced vendor

$ stat --slot=2

+$5-15K

Segmentation testing

Common add-on

$ stat --slot=3

Annual

Required cadence

Plus after significant change

$ stat --slot=4

11.4

Requirement section

PCI DSS v4

$ drivers --price

CDE size
Number of in-scope systems handling card data. The primary cost driver.
Segmentation scope
Each declared isolation boundary needs testing.
Internal AND external coverage
PCI requires both, not either.
Application-layer coverage
Web-app pen test of any in-scope CDE applications.
QSA coordination
Pen-test report feeds the QSA assessment. Bundle-with-audit pricing common.