flaw.co gives you a free external scan and a letter grade on your public attack surface in minutes. Paying.co's senior testers take it from there — internal segmentation, CDE isolation, manual exploitation, and the reporting your QSA and the card brand programs actually accept.
flaw.co tells you what an attacker can see from the outside, instantly and for free. A pen test tells you what they could actually do with it. We built both, and we're clear about where one ends and the other begins.
A passive, non-intrusive scan of everything your servers publicly volunteer: TLS and certificate posture, HTTP security headers, exposed services and open ports, and information disclosure like version banners. You get a letter grade, category scores, and unredacted findings — free.
Active vulnerability testing on domains you've verified you control — CVE detection, exposed path discovery, and misconfiguration testing. Verification runs through a DNS TXT record or a well-known file, so active probes only ever touch infrastructure you own. No fuzzing, no brute force.
Where automation stops. Senior testers run internal network engagements, segmentation and CDE isolation testing, lateral movement, chained exploits, and business logic attacks — then produce the PCI DSS 11.4 evidence and card brand documentation a scanner cannot generate on its own.
Where flaw.co stops. flaw.co provides a PCI readiness signal — a clear view of where your external perimeter stands. It is not an Approved Scanning Vendor (ASV) attestation and it is not a PCI compliance certification. Formal validation, internal testing, and QSA-facing evidence come through a Paying.co engagement. We'd rather tell you that up front than have you find out during an audit.
No sales call, no procurement cycle, no credit card. Enter a domain, confirm you're authorized to scan it, and get your grade. Most teams find something in the first run.
Every plan includes the full passive external scan. Upgrade for active deep testing, unlimited runs, and continuous monitoring — or buy a single deep scan for one domain.
The free scan is non-intrusive by design — it opens normal connections and reads what your servers publicly volunteer. No payloads, no endpoints exercised. Active testing is a deliberate, gated step.
The passive scan reads your public surface the way any visitor could. Safe to run on anything, including production, without a change window.
An A–F letter grade and a 0–100 score, weighted across the four check families. Findings show only the checks that didn't pass, against the total that ran.
Deep active testing requires a DNS TXT record or a well-known file proving you control the domain. Active probes never touch infrastructure you haven't verified.
On Pro, put any scanned domain on automatic rescan. You're emailed only when something actually changes — a new finding, a resolved one, or a moved grade.
flaw.co covers your external surface. A Paying.co pen test covers the rest of the estate — and the parts of PCI DSS 11.4 that require a human tester, a documented methodology, and evidence a QSA will accept.
Simulated foothold inside the network. Lateral movement, privileged access paths, CDE isolation — PCI DSS 11.4.5 and 11.4.6 territory.
Internal enumeration, service exploitation, and validation of the segmentation your PCI scope reduction depends on.
OWASP Top 10, auth bypasses, API testing, and the chained business logic flaws automated tooling can't reason about.
iOS and Android assessment — static and runtime analysis, certificate pinning, secure storage, reverse engineering.
AWS, Azure, and GCP configuration review, IAM analysis, exposed storage, security group rules, IaC hardening.
Wi-Fi testing, rogue AP detection, WPA-2/3 weakness assessment, guest-to-corporate segmentation validation.
Phishing simulation, vishing, and pretexting to evaluate the human-factor controls PCI DSS 12 requires.
Scoped to PCI DSS 4.0 11.4.x, with the reporting Visa AIS, Mastercard SDP, Amex DSOP, and Discover DISC expect on top.
Every engagement runs against a documented Statement of Work with named owners on both sides. Focused tests land in 2–4 weeks. Full external + internal + segmentation engagements run 6–10 weeks from kickoff to retest.
Start on your own. Run the passive external scan, get your grade, and see the findings before you talk to anyone. Free, no obligation.
Bring us the scan. We map it against your compliance obligations — PCI DSS, Visa AIS, Mastercard SDP, Amex DSOP, Discover DISC — and return a fixed scope and price.
Full attack surface mapping, internal enumeration, application crawling, and cloud configuration review — with flaw.co's deep active testing on the verified external surface.
Senior testers validate findings with actual exploitation — chained vulnerabilities, segmentation gaps, business logic flaws. Proof, not theoretical risk.
Scope, methodology, findings, evidence, and a sequenced remediation path — formatted for QSA submission and card brand program reviewers.
Retest after remediation, validate every closed finding, then keep the perimeter under continuous flaw.co monitoring so next year starts from a known baseline.
Start with flaw.co — it costs nothing and takes minutes. When you're ready to scope the real engagement, pick a time that works and you'll be sitting across from a senior pen tester, not a sales rep.