ASV Scanner

The ASV scan built for the modern web. Fast, low-cost, audit-ready.

Pass PCI DSS 11.3.2 with validated findings and AI-guided fixes. Set up in one business day, with no agents or code changes.

30-minute walkthrough · No commitment

COMING SOON PCI SSC ASV qualification in progress

ASV scan report · Findings

3 failing Caught before the official scan

VULNERABILITY	SEV	CVSS	FP/EXC.	STATUS
Weak TLS cipher suites 3DES-CBC / SWEET32 · 443/tcp CVE-2016-2183 64-bit block and CBC ciphers accepted.	High	7.5	None	Fail
Outdated web-server stack nginx 1.18.0 / OpenSSL 1.1.1f · 80, 443/tcp CVE-2021-23017 · CVE-2022-0778 Server banners expose versions with known NVD CVEs.	High	7.7	None	Fail
Early TLS protocols enabled TLS 1.0 / 1.1 · 443/tcp NOCVE PCI prohibits early TLS. Automatic failure.	Medium	4.3	None	Fail

Illustrative

11.3.2 in short Pass every 3 months No CVSS ≥ 4.0 ASV report + attestation

What is the Reflectiz ASV Scanner?

The Reflectiz ASV Scanner provides quarterly external vulnerability scanning for PCI DSS Requirement 11.3.2, delivered with the ASV report and attestation. It’s built on our own Offensive Hub engine: agentic, AI-powered, and founded on 10+ years of web security research. That means fewer false positives, AI-guided fixes from Atlas, and a faster, lower-cost path to a passing scan. It runs in the Offensive Hub, alongside Agentic Pentesting.

Part of	Offensive Hub, with Agentic Pentesting and Atlas AI
Requirement	PCI DSS 4.0.1, Req. 11.3.2
Status	Coming soon (PCI SSC ASV qualification in progress)
Engine	Offensive Hub engine, built in-house
Validation	Deterministic; every finding is evidence-backed
You get	ASV report and attestation, every quarter
Pricing	Usage-based credits

PCI DSS 4.0.1 · REQ. 11.3.2

Attestation of
Scan Compliance

ASV signature

Scan customer

ASV Scan Report

ScopeExternal IPs and domains

CVSS 4.0+ findingsNone

Automatic failuresNone

ResultPASS

PCI DSS 4.0.1 · Requirement 11.3.2 · Quarterly scan

PASS

The ASV scan is quarterly. The work around it never stops.

Manual work drains time and budget.

Scoping, triage, and fix tracking still happen by hand.

False positives chip away at engineering hours.

Every false positive means evidence, tickets, and waiting.

Findings arrive without fixes.

You learn what failed, not how to fix it.

HOW IT WORKS

From fire drill to background process

The cycle repeats every quarter

Map

Your external attack surface, scoped to 11.3.2.

Scan

Failing findings (CVSS 4.0+) surfaced before the official scan.

Fix

Atlas AI guides every fix.

Rescan

Retest on demand. Confirm a fix the moment it ships.

Attest

ASV report and attestation for your QSA.

CVSS 4.0+ still open

A cut above the rest

Atlas

AI remediation assistant

Weak TLS cipher suites

443/tcp · CVE-2016-2183 · CVSS 7.5

Fail

Your server still accepts 3DES, a 64-bit block cipher (SWEET32). Remove it to pass.

Update the cipher list

ssl_ciphers ECDHE+AESGCM:!3DES:!aNULL;

Reload nginx

sudo nginx -s reload

Rescan before the official scan

Rescan passed

Ready for the official scan

Lower cost

Agentic testing streamlines the work. Usage-based credits mean you pay for what you use.

Faster compliance

Catch and fix failures early, and pass your quarterly scan without last-minute fire drills.

Fewer false positives

Only validated findings reach your team, each with proof logs that show it’s real.

An AI assistant that knows the web

Atlas guides every fix and turns each finding into a ready-to-share report.

Simpler disputes

Disputes and compensating controls, documented with evidence and ready for your assessor.

Actionable alerts

New vulnerabilities flagged with severity, impact, and next steps.

SIEM/SOC integration

Stream findings into your security workflows via REST API.

Built on our own Offensive Hub engine

Findings are validated by our in-house deterministic engine, built by our own security researchers and founded on a decade of web research. You fix only what’s real and never waste a quarter disputing false positives.

Legacy ASV scanners vs. Reflectiz

Others hand you a report and a deadline. Reflectiz hands you a fix and a clean rescan.

COMPARE	Legacy ASV scanners	Reflectiz ASV Scanner
Built for	Networks and servers	Complex websites, user journeys, and checkout flows
Timing	One scan a quarter	Failures caught before the official scan
False positives	Support tickets, on their clock	Deterministic validation, evidence for every finding
Remediation	A report and a deadline	Atlas AI guides every fix
Cost	Hours lost to disputes and rescans	Usage-based credits
Coverage	External scan only	ASV scanning plus agentic pentesting

Who needs quarterly ASV scans?

Almost every merchant that takes cards online (SAQ A, A-EP, and D), plus service providers. PCI SSC FAQ 1604 confirms the requirement covers redirect and iframe checkouts.

NEEDS IT

SAQ A or A-EP merchant

Pages that redirect to, or embed, your payment provider’s checkout

NEEDS IT

SAQ D merchant or service provider

Every internet-facing system in or connected to your CDE

USES IT

Security or AppSec team

You fix the findings with Atlas guidance and stream them to your SIEM

USES IT

Compliance or GRC lead

You deliver the ASV report, attestation, and documented disputes to your QSA

Why Reflectiz?

100K+websites scanned

10+ yearsof web security research

Web-firstscripts, subdomains, infrastructure

Agentic

Our in-house Offensive Hub engine: AI-powered, faster, smarter, and lower-cost.

Web experts

10+ years of web security research means fewer false positives and faster value.

Web-native support

Expert customer success plus Atlas AI for quick, context-aware fixes.

One ecosystem

The full Offensive Hub, plus Reflectiz’s suite of web security solutions.

ONE ECOSYSTEM

All-in-one solution!

PCI DSS 6.4.3, 11.6.1, and 11.3.2, plus agentic pentesting, in one dashboard. Others cover part of this list. Reflectiz covers all of it.

6.4.3

Authorize every payment-page script

PCI Module

11.6.1

Detect payment-page tampering

PCI Module

11.3.2

Pass quarterly ASV scans

ASV Scanner · Offensive Hub

Pentest

Agentic pentesting, all year round

Agentic Pentesting · Offensive Hub

Ready to level up?

Quarterly ASV scans keep you compliant. Your site keeps changing in between. Turn on agentic pentesting from the same dashboard.

Set scope, schedule, and depth in minutes. Run on demand or continuously.

A coverage grid shows exactly what was tested across your scope.

Up to 10x testing capacity at the cost of a traditional pentest.

Explore Agentic Pentesting

Intelligence levelsDEPTH

Four levels, from deterministic scanning to autonomous agents.

Scanner

Fast baseline

Pentester

Routine testing

Senior

Deeper testing

Expert

Maximum depth

Combine levels by asset: go deep where the risk is.

ASV Scanner FAQ

Last updated: November 2026

What is an ASV scan?

An ASV scan is an external vulnerability scan of your internet-facing systems, run by a PCI SSC Approved Scanning Vendor. Passing one every quarter is how you meet PCI DSS Requirement 11.3.2.

Is the Reflectiz ASV Scanner available now?

Coming soon. PCI SSC ASV qualification is in progress.

How often do you need an ASV scan?

At least once every three months, plus after any significant change (Req. 11.3.2.1).

Does SAQ A require quarterly ASV scans?

Yes. PCI SSC FAQ 1604 confirms it, even for fully outsourced iframe and redirect checkouts.

What fails an ASV scan?

Any finding at CVSS 4.0 or higher, plus automatic failures, such as early TLS (1.0 or 1.1) or an unsupported OS.

What happens if your ASV scan fails?

You fix the findings and rescan until it passes. A late failure can cost you the attestation window. With Reflectiz, you retest on demand, the moment a fix ships.

Can you dispute an ASV scan finding?

Yes. You can dispute a false positive or show a compensating control. Reflectiz documents both with evidence, ready for your assessor.

Who can perform an ASV scan?

Only a PCI SSC-listed ASV can run the quarterly scans. Qualified, independent staff can run post-change scans.

ASV scan vs. penetration test: what’s the difference?

An ASV scan checks for known vulnerabilities every quarter (11.3.2). A pentest goes further and tries to exploit weaknesses. The Offensive Hub covers both.

How is the Reflectiz ASV Scanner different from legacy ASV scanners?

It’s built on our own Offensive Hub engine, designed for complex websites, user journeys, and checkout flows. Every finding is validated deterministically, Atlas AI guides every fix, and it runs in the same dashboard as Agentic Pentesting.

How is the Reflectiz ASV Scanner priced?

Usage-based credits. You pay for the scans and depth you use.

How long does deployment take?

One business day. No agents, no code changes, no consultants.

Does the ASV Scanner integrate with your SIEM or SOC?

Yes. Findings stream into your security workflows via REST API.

Does the ASV Scanner replace the PCI Module?

No. The PCI Module covers 6.4.3 and 11.6.1. The ASV Scanner covers 11.3.2. Both run in one dashboard.

See how fast you can pass.

One dashboard for your ASV scans and agentic pentesting.