PCI DSS v4.0.1

Enumerates IPs, ports, services, and applications to validate inbound-traffic restrictions actually hold — not just that they're on paper.

Maps your internet-facing attack surface and proves whether an external attacker can reach systems storing account data.

Proof-of-exploit evidence of overly permissive rules — what QSAs look for when assessing whether the NSC rulesets are effectively implemented and maintained.

Where the CDE runs in AWS or Azure, enumerates cloud resources and pivots on-prem to cloud, proving whether over-permissive security groups, NSC rulesets, or cloud network paths let traffic reach the CDE that Req 1 says should be blocked. AWS/Azure/Kubernetes only — no standalone GCP pentesting, so a GCP-hosted CDE stays out of scope here.

Directly hunts for weak and default credentials across Active Directory and service accounts — the classic Req 2.2.2 failure mode; internal pentesting reaches default logins on network devices.

Every reachable service is catalogued during attack-path discovery — surfaces services that should have been removed or disabled.

NodeZero surfaces whether an attacker could reach files holding cardholder data — categorised locally on your Docker host; whether stored SAD is rendered unreadable by strong cryptography is a separate encryption control.

If attack paths lead to systems holding account data, the access-control side of Req 3 has a gap — NodeZero proves it.

Probes public-facing services for unencrypted channels and weak cryptography — concrete evidence where Req 4.2.1 protections fail.

"Hosts with No EDR Detected" filter surfaces the exact coverage gaps Req 5.2.1 asks about.

Testing exercises reachable web-facing weaknesses in your applications — attack-based evidence of where secure-development principles did not hold; the SDLC, code-review and change-management obligations of Req 6.2 remain organisational work.

Fingerprints software versions and exploits known CVEs — direct evidence of where Req 6.3.3 patching is missing.

Delivers targeted tests for newly disclosed critical CVEs — often within hours of disclosure, and in some cases ahead of the public patch.

Chains access-control weaknesses into real attack paths that prove where the business-need-to-know model breaks down in practice.

Takes an insider perspective and proves the actual reach of existing privileges — evidence for the Req 7.2.2 least-privilege assessment.

Makes the over-privileged application and service account relationships Req 7.2.5 expects you to manage visible and actionable.

Where the CDE runs in AWS or Azure/Entra ID, finds IAM misconfigurations and privilege-escalation or lateral-movement paths — attack-impact evidence of over-privileged cloud access where the least-privilege model Req 7.2.1/7.2.2 requires didn't hold. AWS/Azure/Kubernetes only — no standalone GCP pentesting.

It is not uncommon for NodeZero to crack more than 50% of the passwords it tests on a first audit — direct evidence Req 8.3.6 password strength fails under attack.

Takes credentials captured by your phishing tool and proves how far they reach — surfacing CDE access paths where the MFA Req 8.4.1 mandates was not actually enforced.

Autonomously hunts credentials embedded in scripts, configuration and property files, and SYSVOL/SMB shares — proving a live application or service-account credential is hard-coded and usable, the classic Req 8.6.2 failure mode.

Decoys on high-risk assets alert the moment an attacker interacts — routed to Splunk/Sentinel/webhook, they validate whether the monitoring behind Req 10 actually detects an intruder.

Every NodeZero action is timestamped with proofs and commands — lets you validate whether the events Req 10.2 requires you to log are actually captured.

Direct fit — internal penetration testing on demand, at any cadence, producing working exploit evidence.

Covers the application-layer testing PCI's penetration-testing methodology requires on both the internal and external side — authenticated, role-based testing of in-scope bespoke applications, with SPA and REST, SOAP and GraphQL API discovery through headless-browser crawling, including after significant application changes.

Direct fit — external penetration testing against your internet-facing footprint.

Dedicated segmentation testing — purpose-built for the specific PCI 11.4.5 requirement.

Req 11.4.4 expects exploitable findings to be corrected; Quick Verify re-tests the exact attack chain to confirm the correction holds.

Quarterly scans leave a gap between them; Rapid Response covers the newly-disclosed-exploit window with targeted tests for critical CVEs.

Overlays attacker-first validation on existing scanner findings — classifies vulnerabilities as Confirmed Exploitable, Contextually Exploitable, or under Threat Actor Pressure for decision-grade risk-rating.