PCI DSS v4.0.1 is the one framework in this series that names vulnerability scanning in explicit, scheduled terms. Requirement 11.3 splits scanning into internal and external obligations, each with its own cadence and evidence requirements. Here's what the standard actually says, and where an automated DAST tool like Vooki Pro fits — and where it doesn't.
"Start 7-Day Trial" submits a request — Vooki Pro's team reviews it and sends the trial license and installation instructions; it is not an instant self-serve activation.
At least once every three months. High-risk and critical vulnerabilities (per the risk ranking your organization defines under Requirement 6.3.1) must be resolved, and scans re-run to confirm. Testers must be qualified and organizationally independent of the systems scanned — an ASV designation is not required for internal scans.
Quarterly scans performed specifically by a PCI SSC Approved Scanning Vendor (ASV). The scan must produce a passing result per the ASV Program Guide, with rescans until vulnerabilities are resolved. This is a formal vendor designation — a general-purpose DAST tool does not satisfy it on its own.
An additional external scan is required after any significant change to the cardholder data environment, with vulnerabilities scored CVSS 4.0 or higher resolved. This off-cycle scan does not have to be performed by an ASV, but must be run by qualified, organizationally independent personnel.
Sourced from PCI DSS v4.0.1, Requirement 11.3 (PCI Security Standards Council document library) and third-party framework-mapping summaries cross-checked against it. We have not independently reproduced the standard's exact clause wording here — treat this as a faithful summary, not a verbatim quote, and confirm against the official text for an assessment.
Vooki Pro's scheduled scans can run on a quarterly (or tighter) cadence against internal application environments, and a scan triggered after a significant change covers the off-cycle requirement in 11.3.2.1, which doesn't mandate an ASV. Automated retest re-confirms that a previously-found, now-fixed vulnerability stays fixed, which supports the "resolved and confirmed" part of 11.3.1.
11.3.2's quarterly external scan must be performed by a PCI SSC Approved Scanning Vendor specifically — a formal certification Vooki Pro does not hold. Running Vooki Pro against your external-facing environment is still useful as pre-submission testing (finding and fixing issues before the ASV scan), but it does not replace the ASV requirement itself.
Exporting a scan as a PCI DSS-mapped report (HTML or PDF, via the Export menu or the CLI's compliance_framework: pci_dss config) reorganizes findings against the standard's requirements instead of a flat severity list — useful evidence to hand a QSA or to attach to a self-assessment questionnaire, alongside your ASV's own attestation.
See the scheduling docs for setting up a recurring quarterly scan · or browse other frameworks
PCI Security Standards Council — document library (PCI DSS v4.0.1)
PCI SSC — "Just Published: PCI DSS v4.0.1"
Vooki Pro: live features.html, docs/reports.html, docs/cli.html, docs/schedules.html, docs/findings.html (verified 2026-10-23).
No credit card required — submit a request and the team will send your trial license and installation instructions.