PCI DSS 4.0 Penetration Testing in the AI Era: What Changes When AI Finds the Bugs

Requirement 11.4 of PCI DSS 4.0 requires penetration testing at least annually and after any significant infrastructure or application upgrade or modification. The standard requires testing of both external and internal network penetration, application-layer penetration testing for all in-scope applications, and testing of segmentation controls if segmentation is used to reduce the scope of the CDE.

The standard specifies that testing must be performed by a qualified internal resource or qualified external third party. A qualified resource is defined as someone with organizational independence from the systems being tested, specialized penetration testing expertise, and current knowledge of penetration testing techniques. The standard does not mandate specific credentials, but most QSAs look for certifications such as OSCP, GPEN, GXPN, or equivalent demonstrated competency.

PCI DSS 4.0 introduced new requirements in this area: Requirement 11.4.7 (added as a best practice in v4.0, now fully enforced) requires multi-tenant service providers to support their customers' external penetration testing by providing additional context about shared infrastructure. This matters for cloud-hosted cardholder environments where the penetration tester needs visibility into shared network architecture.

When a QSA evaluates penetration testing evidence, they are looking for a defined scope that maps to the documented CDE boundary, a methodology that addresses both network and application layers, evidence that segmentation was actually tested (not just assumed), documentation of all findings including severity ratings and remediation status, and evidence that the tester had the qualifications required by PCI DSS.

The QSA's review of the pen test report typically focuses on whether the scope matches what was depicted in the network diagrams and data flow diagrams the company provided. A common finding is that the pen test scope was narrower than the actual CDE, either because the scoping exercise was inaccurate or because the tester was not given access to the full environment.

QSAs are also looking at the finding severity classifications. A penetration test that returns only low and medium findings for a complex environment is likely to prompt follow-up questions from a QSA, because an adversarial simulation of a real CDE typically identifies at least some high-severity issues if conducted thoroughly.

AI-powered security tools fit naturally into two phases of a PCI pen test program where human capacity constraints create gaps: the discovery phase and the vulnerability analysis phase.

In the discovery phase, AI tools like Claude Mythos can enumerate the attack surface far more comprehensively than a human tester working within a time-boxed engagement. An AI system can examine thousands of services, identify non-obvious dependency chains, and cross-reference discovered components against its knowledge of known and zero-day vulnerabilities in a fraction of the time a human team would require. For a large CDE with hundreds of systems, this breadth of coverage is operationally significant.

In the vulnerability analysis phase, AI systems excel at identifying complex vulnerability chains where individual CVEs combine with configuration weaknesses to create exploitable attack paths that neither a vulnerability scanner nor a single human analyst would identify in isolation. Project Glasswing's 10,000-plus high- and critical-severity findings demonstrate this capability at scale: these findings include not just known CVEs but novel vulnerability classes discovered through AI-driven analysis.

For PCI compliance programs, the practical application is using AI-powered tools in the reconnaissance and vulnerability identification phases, then having qualified human testers validate and exploit the most critical findings, with particular focus on the CDE boundary and segmentation controls.

Current QSA practice requires human oversight and attestation for several elements of the PCI penetration test that AI tools cannot fully address. Scope confirmation requires a human to map the actual testing scope against the company's network diagrams and data flow diagrams and attest to their accuracy. This is a business and architectural judgment, not a technical scanning task.

Segmentation testing requires active validation that systems outside the CDE cannot reach cardholder data. This involves manually probing the segmentation controls from designated out-of-scope systems, attempting to traverse the segmentation boundary, and documenting the test methodology and results. QSAs scrutinize segmentation test documentation carefully because inadequate segmentation is one of the most common causes of PCI scope expansion.

Business logic testing for payment applications requires a human who understands payment workflows to attempt to manipulate the application logic in ways that could expose cardholder data or enable fraud. This type of testing requires contextual judgment about how the application is intended to work and creative identification of deviations from that intended behavior.

Finding attestation requires a human qualified tester to attest that the testing was conducted, that the methodology was appropriate, and that the findings represent their professional judgment. QSAs cannot accept an attestation from an automated system.

Based on current QSA practice, the penetration testing model that satisfies PCI DSS 4.0 while incorporating AI-powered tools follows a staged approach. The first stage uses AI-powered discovery tools to enumerate the attack surface comprehensively, identify all in-scope components, cross-reference against known and novel vulnerability databases, and generate a prioritized finding list. This stage produces output that is far more complete than a purely manual discovery phase.

The second stage involves human penetration testers who review the AI-generated finding list, validate the most critical findings through active exploitation, conduct business logic testing, and perform segmentation validation. The human testers focus their limited time on the highest-value targets identified by the AI discovery phase, which increases the efficiency and coverage of the human testing component.

The third stage produces the QSA-ready documentation: a pen test report authored by the qualified human tester, attesting to the methodology, scope, findings, and their professional judgment about remediation priority. The report may note that AI-assisted tools were used in the discovery phase, but the attestation is from the qualified human.

This hybrid model typically produces better coverage than a purely manual engagement of equivalent duration, at similar or lower cost, while satisfying QSA requirements for human qualification and attestation.

When a Glasswing CVD notification identifies a critical vulnerability in software present in your CDE, the PCI compliance implications are immediate. The unpatched vulnerability is a finding that the QSA must document, and it will typically be categorized as a high-severity issue that must be remediated or mitigated before the ROC can be completed.

More consequentially, if the vulnerability enables exploitation of a pathway into the CDE that your pen test did not cover, the QSA may require supplemental penetration testing to validate that the vulnerability was not exploitable in your specific environment, or to confirm that compensating controls adequately mitigate the risk.

The wolfSSL CVE-2026-5194 (CVSS 9.1) illustrates this scenario. wolfSSL is an embedded TLS library used in payment terminals, industrial controllers, and network equipment. If wolfSSL is present in systems that connect to or are part of your CDE, CVE-2026-5194 is a potential in-scope finding. The QSA will expect to see either a documented patch (wolfSSL version that includes the fix, applied to all in-scope instances) or a compensating control with documented evidence that it adequately mitigates the CVSS 9.1 risk.

PCI DSS 4.0 permits the use of compensating controls when a required control cannot be met due to legitimate technical or documented business constraints. Compensating controls must provide a similar level of protection to the original requirement and must be documented, approved by a QSA, and re-assessed annually.

For a Glasswing CVE that cannot be immediately patched (because a patch is not yet available, because the affected system is a legacy component that cannot be updated, or because patch testing cycles prevent immediate deployment), a compensating control analysis is the appropriate response.

Effective compensating controls for a high-CVSS unpatched vulnerability in a CDE component might include: network segmentation that prevents exploitation of the vulnerability from external networks; application-layer firewall rules that block the specific attack vectors identified in the CVD notification; enhanced monitoring for indicators of compromise associated with the vulnerability; and accelerated patch testing and deployment timelines with documented approval.

The compensating control documentation must be specific: it must identify the specific vulnerability, explain why the primary control cannot be implemented immediately, describe the compensating control in detail, and attest that the compensating control provides equivalent protection. Generic compensating control language does not satisfy QSA requirements.

When briefing a QSA about your AI-augmented penetration testing program, the framing matters. QSAs are not opposed to AI tools; they are concerned about ensuring that required elements of PCI testing are actually performed by qualified humans. Lead with the human attestation, not the AI tooling.

Start with who conducted the testing: a qualified penetration tester with specific credentials who scoped, planned, and attested to the test. Then describe the methodology, including the use of AI-assisted discovery tools in the reconnaissance and vulnerability identification phases. Provide documentation of the AI tooling used and its output, not as the primary deliverable but as supporting evidence.

For segmentation testing specifically, document the human-led testing methodology in detail. QSAs scrutinize segmentation test documentation more carefully than almost any other element of the pen test report, because segmentation failures are a common audit finding.

If a Glasswing CVE was identified during the testing period, include it as a finding in the pen test report with remediation status and timeline. This demonstrates that your testing program captured the relevant vulnerability, which is evidence of testing thoroughness rather than a compliance gap.

The Mythos Brief provides the practitioner toolkit for implementing a PCI DSS 4.0-compliant penetration testing program that leverages AI-powered discovery while satisfying QSA requirements.