Watch Bishop Fox’s CISO Christie Terrill, Adam Bush, Managing Director at Schellman, and Zach Fasel, Managing Partner at Urbane Security for a discussion on how PCI DSS 4.0 is impacting offensive security practices, including penetration testing and segmentation testing.

With the new requirements fully in effect as of March 31, 2025, this session delivers practical insight for organizations navigating compliance and adapting their testing strategies accordingly.

Topics Covered

Offensive Security Requirements in PCI DSS 4.0

1. Overview of offensive security expectations in PCI DSS 4.0
2. Clarification on internal, external, and application-layer penetration testing
3. Differences between standard penetration tests and more advanced offensive security approaches

Segmentation Testing Requirements

1. Evolution of segmentation testing requirements, especially in modern cloud and hybrid environments
2. Validation of logical segmentation, network segmentation, and trust boundaries
3. Implications for organizations using AWS, Azure, GCP, SaaS platforms, and on-prem infrastructure

Vulnerability Management and Remediation

1. Expanded requirements to remediate all vulnerabilities, including low and medium severity
2. How penetration test results must be integrated into the organization’s vulnerability management program
3. The importance of remediating findings on a defined schedule, regardless of how they are discovered

Newly Effective Requirements as of March 31, 2025

1. Service providers must now conduct segmentation testing twice per year in multi-tenant environments
2. External-facing web applications must use a web application firewall or equivalent dynamic application security solution
3. Clarification on the need to validate customer isolation in shared environments
4. Script management and injection protections for hosted payment pages are now in scope for many organizations

Penetration Testing Methodology

1. Organizations are required to define their own penetration testing methodology
2. Leveraging a third-party tester’s methodology is acceptable if the organization adopts and formalizes it
3. Methodologies should align with frameworks such as OWASP Top 10, NIST SP 800-115, or PTES
4. Requirements include documenting testing cadence, testing vectors (internal, external, trusted, untrusted), and scoping segmentation tests

Summary

PCI DSS 4.0 introduces more prescriptive guidance and closes gaps that previously allowed organizations to meet minimum compliance without strong security practices. Offensive security testing under PCI DSS now requires more comprehensive validation of all potential attack paths and integration of those findings into broader vulnerability management efforts.

Whether dealing with internal or external penetration testing, cloud segmentation, or validating the scope of cardholder data environments, organizations are expected to demonstrate clear intent, consistent execution, and measurable remediation efforts.