What it asks for. Requirement 11 of PCI DSS v4.0 covers regular security testing. It includes testing for unauthorised wireless access points, internal and external vulnerability scanning, external scans by an Approved Scanning Vendor, internal and external penetration testing, segmentation testing, intrusion detection or prevention and change and tamper detection, including for payment pages.
In practice. Organisations run vulnerability scans at the required frequency and after significant changes, fix findings and rescan, and perform penetration tests against a documented methodology. Segmentation controls are tested to confirm scope reduction works. Evidence includes scan reports with passing results, penetration test reports, remediation records, segmentation test results and alerts from intrusion and change detection.
Common gaps. Rescans after remediation are often missing. Authenticated internal scanning, expected under v4.0, and payment page change detection are frequent gaps.