I'm hoping to find a piece of software to assist me in catching PCI compliance failures in advance of the actual ASV scans. I would much prefer to run the scans against myself before I request another company to do so. Is there any software out there that is written to do this sort of thing?

  • @Those who marked this as "not constructive", exactly where am I soliciting opinions? I'm trying to find specific pieces of software that fill a specific need. I am not looking for "what's your favorite". I am new to this exchange, can someone please explain?
    – Mythril
    May 3, 2012 at 3:11

4 Answers 4


You could look at running Nessus or OpenVAS from outside your network. This is about what the ASV scans do. From the alerts raised on my monitoring systems there are few differences between my OpenVAS scans and the scans performed by our vendor.


Managed Engines Security Manager Plus can do this. However like most things in life, it's not free


You can perform PCI scans with quite a few tools. Even though these will not be "official", due to an official PCI scan having to be done by an ASV (approved scanning vendor). A few of the more popular tools that you have probably heard of and are very easy to work with are Saint and Nessus. They both have PCI specific scans and will show you if a vulnerability will pass or fail. Since not every vulnerability is significant enough to to fail you.


Unfortunately it's a little more than one single test. For PCI scans you have to combine a lot of different tools, tests and scenarios. Even if you can use for every test an open source tool I'm pretty sure after finishing your test run you won't give it away for free.

Anyway you can browse this list of different vendors providing tools or services regarding the PCI certification.

I'm deeply contented with Qualys. They also provide some free or trial checks.

Not the answer you're looking for? Browse other questions tagged .