The first setting to get right is the scan’s purpose: internal PCI DSS vulnerability management and external PCI ASV scanning are separate workflows. Scope, reachability, authentication, timing, remediation and evidence matter more than choosing a profile simply because it says “PCI.”
Separate internal scans from external ASV scans
PCI DSS Requirement 11.3 distinguishes internal vulnerability scans (11.3.1) from external scans (11.3.2). PCI SSC describes both as required at least once every three months, with remediation and rescanning as needed. An external scan that must satisfy the ASV program has to use the applicable ASV process; a general vulnerability-management scan does not become an ASV scan just because the tool has a PCI-labelled profile.
As an Amazon Associate I earn from qualifying purchases.
For a generally passing external scan, PCI SSC FAQ 1152 describes the pass characteristic as having no vulnerability with a CVSS score of 4.0 or higher and no automatic failure. Apply the full ASV program requirements and report rules rather than treating that summary as a substitute for them: PCI SSC FAQ 1152.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSet scope and reachability before choosing options
Include every in-scope internet-facing system, public address and relevant path to the cardholder data environment (CDE). Qualys recommends discovering active public IPs before scoping and checking that DNS names and assets are included. Where network controls could block probes, ensure the scanner can reach in-scope components; Qualys notes that its external scanner IP addresses may need to be trusted. A firewall or allowlist that silently prevents scanning can leave assets unassessed. See Qualys PCI merchant guidance.
#1 Best Overall
Scope depends on the merchant’s actual environment and assessment route. For example, PCI SSC FAQ 1604 says SAQ A for PCI DSS v4.x includes external ASV scanning for covered merchant e-commerce pages that redirect to a third-party processor or embed its payment iframe, even when payment processing is outsourced. This is not a blanket rule for every merchant; confirm applicability against the actual SAQ and environment: PCI SSC FAQ 1604.
Configure internal scans for authentication
PCI DSS 11.3.1.2 calls for authenticated internal vulnerability scans. Credentials need sufficient privileges to access resources required for thorough detection. Keep credentials enabled in the profile or template actually used for the scan, not merely saved in the scanner. Document systems that cannot accept credentials, and manage scan accounts appropriately where they can be used for interactive logins. The requirement became mandatory after 31 March 2025; the PCI SSC’s PCI DSS v4.0 SAQ D for Service Providers identifies that effective date.
Qualys internal authentication
In Qualys VM, create authentication records with credentials for the target IPs, then enable authentication in the scan option profile used for the internal scan. Both parts are necessary. Qualys documentation also identifies a separate Payment Card Industry (PCI) Options profile for quarterly external PCI scanning; do not confuse that external profile with the authenticated internal-scan setup. Check the current documentation for your product edition and version: Qualys VM option profiles.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Tenable internal authentication
Tenable’s Internal PCI Network Scan template is intended for internal PCI DSS 11.3.1 scanning and supports credentials to enumerate missing patches and client-side vulnerabilities. Configure suitable credentials for internal targets and confirm that they are used by the scan. Tenable’s template guidance is in its PCI compliance scan documentation.
Use a qualified ASV workflow for external scans
Applicable Requirement 11.3.2 external scans must be performed by a PCI SSC-listed Approved Scanning Vendor (ASV), using that vendor’s ASV scan solution. A generic external scan from Qualys or Tenable does not, by itself, establish that the scan was conducted under the ASV program. Verify the provider and workflow against the current PCI SSC ASV list.
Qualys external workflow
Qualys VM documentation identifies the Payment Card Industry (PCI) Options profile for the quarterly external PCI requirement. Confirm that the scan covers the correct public assets and DNS names and that the scanner can reach them. The existence of this profile does not mean every Qualys vulnerability setting is prescribed by PCI DSS; the standard sets required outcomes and assessment evidence, while the profile implements a vendor-specific workflow.
Tenable external workflow
Tenable’s PCI Quarterly External Scan template is intended for external Requirement 11.3.2 scans. Tenable’s ASV scan-creation guidance says not to configure credentials for PCI ASV scans: they are designed to assess from an external threat perspective, and credentials can change the scan intent and cause complications or PCI failures. Keep authenticated scanning in the internal workflow. Tenable also says ASV results follow their own rules, so do not assume general recast rules modify PCI ASV results. See Tenable’s PCI scan guidance.
Keep scans no more than 90 days apart
PCI SSC says “quarterly” or “at least once every three months” means scans should be as close to three months apart as possible; 90 days is the maximum interval. Schedule from the actual scan dates rather than assuming that a calendar-quarter label guarantees compliance. The guidance is in PCI SSC FAQ 1087.
Retain evidence of scan dates, scope, findings, remediation and rescans. PCI DSS requires remediation and rescanning as needed; a schedule alone does not show that identified vulnerabilities were addressed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare the settings that affect the result
| Decision | Qualys | Tenable |
|---|---|---|
| Internal scan | Use authentication records for target IPs and enable authentication in the scan option profile. | Use the Internal PCI Network Scan template with appropriate credentials. |
| External PCI scan | Use the Payment Card Industry (PCI) Options profile for the external PCI workflow; validate assets and reachability. | Use the PCI Quarterly External Scan template; do not configure credentials for the ASV scan. |
| Web application scan | Not stated in the cited Qualys workflow documentation. | Tenable provides a separate PCI web-application template where web-app scanning is appropriate. |
| Operational defaults | Not stated in the cited material. | Safe Checks is enabled by default in Advanced Settings and disables plugins that may adversely affect a remote host. Performance defaults differ between internal and external templates. |
The table describes vendor workflows, not a complete PCI DSS configuration checklist. Tenable’s Safe Checks and performance defaults are operational choices; they do not replace correct scope, cadence, ASV status or acceptable scan results. Check documentation for the edition and version in use because account-specific licensing and UI availability are not established here.
Common mistakes to avoid
- Reusing an authenticated internal profile for the external ASV scan, or adding credentials to Tenable’s PCI ASV external scan contrary to its guidance.
- Leaving internet-facing CDE systems or paths to the CDE out of scope, or allowing network controls to prevent the scanner from reaching them.
- Assuming a generic PCI-labelled scan means the vendor is acting as the ASV for that scan.
- Scheduling “quarterly” scans more than 90 days apart or failing to retain remediation and rescan evidence.
- Treating a vendor default, such as Safe Checks, as a PCI DSS requirement.
What an ASV report does—and does not—show
An ASV report documents the vulnerability scan results. PCI SSC cautions that “this scan report is not an indication that any other PCI DSS requirements have been reviewed or are in place.” A passing report therefore does not certify the merchant’s overall PCI DSS compliance. See PCI SSC FAQ 1234, updated June 2025.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
