PCI DSS v4.0.1 is the one framework in this series that names vulnerability scanning in explicit, scheduled terms. Requirement 11.3 splits scanning into internal and external obligations, each with its own cadence and evidence requirements. Here's what the standard actually says, and where an automated DAST tool like Vooki Pro fits — and where it doesn't.
At least once every three months, performed via authenticated scanning (11.3.1.2), and again after any significant change (11.3.1.3). High-risk and critical vulnerabilities (per the risk ranking your organization defines under Requirement 6.3.1) must be resolved, and scans re-run to confirm. Testers must be qualified and organizationally independent of the systems scanned — an ASV designation is not required for internal scans.
Quarterly scans performed specifically by a PCI SSC Approved Scanning Vendor (ASV). The scan must produce a passing result per the ASV Program Guide, with rescans until vulnerabilities are resolved. This is a formal vendor designation — a general-purpose DAST tool does not satisfy it on its own.
An additional external scan is required after any significant change to the cardholder data environment, with vulnerabilities scored CVSS 4.0 or higher resolved. This off-cycle scan does not have to be performed by an ASV, but must be run by qualified, organizationally independent personnel.
This is a summary of PCI DSS v4.0.1 Requirement 11.3, not the standard's text. Use the official document from the PCI Security Standards Council document library for an assessment.
Vooki Pro's scheduled scans can run quarterly or more often against internal web applications and APIs, and you can run an additional scan after a significant change (11.3.1.3 internal; 11.3.2.1 external, which doesn't require an ASV). Automated retest re-runs the detector that raised a finding and records what it found at the time of the retest, supporting your evidence that vulnerabilities were resolved and rescanned. DAST covers the web-application and API portion of vulnerability testing only: PCI DSS scanning also covers the other system components in scope, and the authenticated internal scanning in 11.3.1.2 applies to those components — so Vooki Pro supports part of your scanning programme rather than replacing it.
For applicable PCI DSS requirements, quarterly external vulnerability scans must be performed by a PCI SSC Approved Scanning Vendor (ASV). Vooki Pro's vulnerability reports do not replace a required ASV scan. Running Vooki Pro against your external-facing environment is still useful as pre-submission testing — finding and fixing issues before the ASV scan.
Exporting a scan as a PCI DSS v4.0-mapped report (HTML or PDF, via the Export menu or the CLI's compliance_framework: pci_dss config) reorganizes findings against the standard's requirements instead of a flat severity list — useful evidence to hand a QSA or to attach to a self-assessment questionnaire, alongside your ASV's official scan report. The report generator labels its output PCI DSS v4.0; the requirement summary on this page follows PCI DSS v4.0.1, a limited revision of v4.0 with no added or deleted requirements.
See the scheduling docs for setting up a recurring quarterly scan · or browse other frameworks
PCI Security Standards Council — document library (PCI DSS v4.0.1)
PCI SSC — "Just Published: PCI DSS v4.0.1"
PCI SSC — Summary of Changes, v3.2.1 to v4.0 (11.3.1.1–11.3.1.3, 11.3.2.1)
PCI SSC — resource guide: vulnerability scans and ASVs
Vooki Pro documentation: Reports & Compliance · Scheduled Scans · Scan Results & Findings · CLI & CI/CD
Last reviewed 23 October 2026.
No credit card required — submit a trial request; the team reviews it, then sends your trial license and installation instructions.