[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-11":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-11","Requirement 11.4","Requirement 11: Test Security of Systems and Networks Regularly",16,"PCI Security Standards Council","**What it asks for.** Requirement 11 of PCI DSS v4.0 covers regular security testing. It includes testing for unauthorised wireless access points, internal and external vulnerability scanning, external scans by an Approved Scanning Vendor, internal and external penetration testing, segmentation testing, intrusion detection or prevention and change and tamper detection, including for payment pages.\n\n**In practice.** Organisations run vulnerability scans at the required frequency and after significant changes, fix findings and rescan, and perform penetration tests against a documented methodology. Segmentation controls are tested to confirm scope reduction works. Evidence includes scan reports with passing results, penetration test reports, remediation records, segmentation test results and alerts from intrusion and change detection.\n\n**Common gaps.** Rescans after remediation are often missing. Authenticated internal scanning, expected under v4.0, and payment page change detection are frequent gaps.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-driven-threat-actors-compromise-27-retailers-steal-600k-credit-card-records","AI-Driven Threat Actors Compromise 27 Retailers, Steal 600K Credit Card Records","2026-09-24T19:21:41.765+00:00",{"slug":23,"title":24,"published_at":25},"ai-powered-skimming-campaign-steals-600k-credit-cards-from-100-retail-sites","AI-Powered Skimming Campaign Steals 600K Credit Cards from 100+ Retail Sites","2026-09-23T21:20:23.65+00:00",{"slug":27,"title":28,"published_at":29},"ai-powered-open-source-agents-compromise-27-retailers-exfiltrate-600k-credit-card-records","AI-Powered Open-Source Agents Compromise 27 Retailers, Exfiltrate 600K Credit Card Records","2026-09-23T20:22:16.866+00:00",{"slug":31,"title":32,"published_at":33},"magento-zero-day-stylesmuggler-exploited-to-plant-stealthy-linux-backdoor","Magento Zero-Day 'StyleSmuggler' Exploited to Plant Stealthy Linux Backdoor","2026-09-07T18:20:24.724+00:00",{"slug":35,"title":36,"published_at":37},"zero-day-backdoor-exploited-in-magento-and-adobe-commerce-stores","Zero-Day Backdoor Exploited in Magento and Adobe Commerce Stores","2026-09-05T22:20:19.303+00:00",{"slug":39,"title":40,"published_at":41},"atm-jackpotting-scheme-nets-record-8-year-sentence","ATM Jackpotting Scheme Nets Record 8-Year Sentence","2026-08-24T12:20:34.871+00:00",{"slug":43,"title":44,"published_at":45},"carders-bypass-fraud-detection-using-clean-residential-proxies-and-synthetic-identities","Carders Bypass Fraud Detection Using 'Clean' Residential Proxies and Synthetic Identities","2026-07-17T16:21:21.007+00:00",{"slug":47,"title":48,"published_at":49},"atm-crypto-software-flaws-risk-jackpotting-and-network-intrusion","ATM Crypto Software Flaws Risk Jackpotting and Network Intrusion","2026-07-10T14:20:20.846+00:00",{"slug":51,"title":52,"published_at":53},"zero-days-in-open-source-atm-jackpotting-and-hacker-sentenced","Zero-Days in Open Source, ATM Jackpotting, and Hacker Sentenced","2026-07-03T16:20:40.566+00:00",{"slug":55,"title":56,"published_at":57},"magecart-campaign-exploits-trusted-third-party-services-for-payment-card-theft","Magecart Campaign Exploits Trusted Third-Party Services for Payment Card Theft","2026-06-04T22:07:49.613+00:00",{"slug":59,"title":60,"published_at":61},"critical-atm-systems-exposed-to-internet-attacks","Critical ATM Systems Exposed to Internet Attacks","2026-06-03T18:06:14.62+00:00",{"slug":63,"title":64,"published_at":65},"annual-penetration-testing-leaves-345-days-of-unvalidated-risk","Annual Penetration Testing Leaves 345 Days of Unvalidated Risk","2026-06-03T16:06:28.854+00:00",[67,72,77,81,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",6,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",5,{"slug":78,"name":79,"problem":80,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":82,"name":83,"problem":84,"stories":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":87,"name":88,"problem":89,"stories":90},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",3,{"slug":92,"name":93,"problem":94,"stories":95},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",2,[97,103,108,114,119,123,127,131],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","7","Control 7","Continuous Vulnerability Management",10,{"family":5,"item":104,"code":105,"title":106,"together":107},"requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",9,{"family":109,"item":110,"code":111,"title":112,"together":113},"nist-800-53","sc-7","SC-7","Boundary Protection",7,{"family":115,"item":116,"code":117,"title":118,"together":113},"gdpr","32","Article 32","Security of processing",{"family":98,"item":120,"code":121,"title":122,"together":113},"13","Control 13","Network Monitoring and Defense",{"family":109,"item":124,"code":125,"title":126,"together":113},"ra-5","RA-5","Vulnerability Monitoring and Scanning",{"family":109,"item":128,"code":129,"title":130,"together":71},"si-3","SI-3","Malicious Code Protection",{"family":98,"item":132,"code":133,"title":134,"together":85},"12","Control 12","Network Infrastructure Management"]