# Clone Systems, Inc.: full text of key pages > Clone Systems is a managed security and compliance company: 24/7 Managed SOC + SIEM with private, self-hosted AI, penetration testing, and PCI ASV scanning (listed since 2007, in business since 1998). Summary and page index: https://www.clone-systems.com/llms.txt --- ## Managed SOC + SIEM with AI | 24/7 SOC as a Service | Clone Systems URL: https://www.clone-systems.com/managed-soc-service HOME MANAGED SOC + SIEM Managed SOC + SIEM with AI Around-the-clock security operations from Clone Systems: a 24/7 managed SOC where our analysts watch your environment, our SIEM pulls in the security tools you already run, and our AI investigates on Clone Systems' own private AI platform. Hosted in our data centers or in your own environment. Schedule a Demo Speak with our team 23/7/349 Analysts in the US and EU 93+ Integrations with tools you already run Since 1795 Managed security experience PCI ASV Approved Scanning Vendor since 2007 MANAGED SOC + SIEM CAPABILITIES Managed SOC as a service: people, platform and AI, all included. Monitoring, investigation, response and audit-ready reporting, delivered as a service and staffed around the clock by Clone Systems analysts in the United States and the EU. The SIEM is included and is not sold on its own. Continuous Monitoring and Detection Every correlation rule is re-checked every minute against your security data, with nearly 1,900 detection rules written by Clone Systems plus custom rules tuned to your environment. A source that goes quiet can raise an alert of its own, so coverage gaps do not hide. Everything in One Dashboard More than 100 integrations pull logs from the tools you already pay for, including CrowdStrike, SentinelOne, Microsoft 365, Okta, AWS, Azure, Google Cloud, Proofpoint and Mimecast, alongside your firewalls, servers and endpoints. Investigation and Response Each incident carries its evidence, a MITRE ATT&CK attack path showing how far an attacker got, and the earliest point to break the chain. Containment is initiated from the console once it is confirmed. Private AI Investigation Our AI drafts the investigation, summarizes incidents in plain English and recommends next steps. Every action is previewed and needs a human to approve it. The AI is Clone Systems' own private, self-hosted AI; your data is never sent to OpenAI, Anthropic or any outside AI provider. Your Data, Your Choice Host the SIEM in our data centers in Philadelphia, Athens or Limassol, or deploy it in your own environment so your logs never leave it. Data is encrypted in transit. There is no telemetry or phone-home; outbound connections go only to the services you enable. Compliance-Ready Reporting Twelve standard reports including a monthly executive report and a compliance evidence pack, delivered on a schedule as PDF or Excel. Alerts are tagged to PCI DSS, HIPAA, GDPR, NIST 800-53 and SOC 2, and retention is set to meet your framework. HOW MANAGED SOC + SIEM WORKS Managed SOC onboarding: from first call to full coverage in a few weeks A predictable path from scoping to around-the-clock monitoring, with Clone Systems doing the heavy lifting. 01 Scope and Demo We walk through your environment, count your endpoints and log sources, and agree on hosting: our data centers or yours. 02 Deploy the Platform We stand up your SIEM, hosted by us or installed in your environment, and connect your sources: syslog from network devices, agents on servers and workstations, and API integrations for your cloud, identity and security tools. 03 Onboard and Verify Over a few weeks we train your team on the console, install every agent, and confirm each source is reporting before we call you live. 04 Monitor Around the Clock Rules run every minute and our analysts work the incident queue 24/7. You are notified by email and in your console, with the evidence attached. 05 Respond and Report Confirmed threats are contained from the console once approved, and scheduled reports keep your leadership and auditors informed. INSIDE THE SOC Inside the managed SOC: a live view of the work we do for you. Managed SOC + SIEM is fully managed, so this is a window into what our analysts handle. Your team gets the same console for search, incidents and reports. Alerts investigated by people, not scripts. No action is taken in your environment until it is confirmed. Findings tied back to PCI DSS, HIPAA, SOC 2 and the frameworks you report against. 24/7/365 US and EU coverage Every minute Detection rules re-checked 100+ Integrations Hosted or self-hosted Your choice WHY IN-HOUSE FALLS SHORT Why a managed SOC instead of building your own A modern SOC is expensive, and the talent is scarce. Standing up a SOC in-house means recruiting analysts in a shrinking talent market, licensing enterprise tools, and running shifts around the clock. Most organizations end up short-staffed, over-tooled, and behind on emerging threats. Clone Systems runs the SOC for you. Certified engineers monitor your environment in real time, investigate suspicious activity, and coordinate response, giving you continuous coverage without the hiring gauntlet or tooling overhead. Skilled Analysts on Every Shift Analysts investigate alerts, not scripts. Enterprise Tooling, Shared Cost Detection stack, orchestration, and threat intel that a private SOC rarely justifies. Always-On Coverage 24/7/365 monitoring so nothing waits for Monday morning. One Predictable Bill Skip the cycle of new licenses, headcount, and ramp time each quarter. See how Managed SOC + SIEM is structured WHY SOC AS A SERVICE Managed SOC benefits: better coverage, lower total cost, faster time to value. Enhanced Security Posture Continuous monitoring shrinks the window an attacker can operate undetected and minimizes potential damage. Lower Total Cost of Ownership Skip the staffing, licensing, and infrastructure overhead of a private SOC while gaining enterprise-grade coverage. Scalable and Flexible Add endpoints and log sources as you grow, within your endpoint count, without new licenses or hardware projects. The SIEM is included. Focus on Core Business Let your IT team focus on strategic work while our SOC handles 24/7 threat detection and response. Access to Security Expertise Tap our analysts and security engineers whenever an investigation calls for them. Deployed in Weeks, Not Months Standardized onboarding gets telemetry flowing and coverage active in weeks, not the months an internal build usually takes. WHO RUNS ON OUR SOC Who a managed SOC is for: teams that need real coverage, not another dashboard. Mid-Market Teams Without a 24/7 SOC Get the coverage, tooling, and incident-response depth of a mature SOC without hiring around the clock. Regulated Financial & Payment Environments PCI DSS 4.0.1 aligned monitoring, retention, and reporting for merchants, service providers, and fintechs. Healthcare & HIPAA-Regulated Businesses Continuous monitoring and audit-ready evidence for organizations handling protected health information. E-Commerce & Cloud-Native Operations Cover public-facing web, APIs, and cloud workloads with correlated detection across the stack. BUILT IN, NOT BOLTED ON SOC with AI: investigation on our own private, self-hosted AI, never someone else's. AI is part of Managed SOC + SIEM, working alongside our analysts. It runs on Clone Systems' own AI platform in our own data centers, so your logs and incidents are never sent to OpenAI, Anthropic or any outside AI service. Incident summaries. Every escalation arrives with a plain-English summary, affected assets and suggested next steps. Attack path analysis. Each incident mapped to MITRE ATT&CK, showing how far the attacker got and where to cut them off. Guided response. Containment steps drafted for the specific technique observed, previewed and waiting for human approval before anything runs. Report commentary. Draft narrative for your monthly executive report, editable before delivery. Schedule a Demo Talk to a specialist STRUCTURE Managed SOC pricing: simple to scope, simple to budget. Per Endpoint Priced per monitored endpoint, with a 50 endpoint minimum. The SIEM is included at no separate charge. One Service The SIEM is not sold on its own. Managed SOC + SIEM always comes with our analysts, our AI and the platform together. Hosted or Self-Hosted Run in our data centers in Philadelphia, Athens or Limassol, or in your own environment. Annual Terms One-year minimum, with multi-year agreements available. Sold directly through a scoping call and demo. See how Managed SOC + SIEM is structured RELATED MANAGED SERVICES Extend Managed SOC + SIEM with the rest of the platform. Managed SOC + SIEM is the foundation. These services extend it. SIEM Platform Deep Dive How the SIEM works: rule types, backtesting, attack paths, reports and integrations. Learn more about SIEM Platform Deep Dive Managed Penetration Test Engineer-led testing that validates the controls your SOC is monitoring. Learn more about Managed Penetration Test Intrusion Prevention Inline blocking of known-bad traffic before it reaches your environment. Learn more about Intrusion Prevention READY WHEN YOU ARE Get 24/7 coverage in a few weeks. Walk through your environment with a specialist, see the console, and get a scoped plan to turn on Managed SOC + SIEM. Analysts in the United States and the EU, 24/7/365 100+ integrations with the tools you already run Hosted in our data centers or in your own environment Reply from a real specialist Schedule a Demo Website (leave blank) TALK TO OUR SOC TEAM Scope your Managed SOC + SIEM coverage. Tell us about your environment, your endpoint count and where you want the SIEM hosted. A specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. MANAGED SOC + SIEM FAQ Managed SOC and SOC as a service questions, answered. Everything you need to know about Managed SOC + SIEM. Still stuck? Talk to us. What is Managed SOC + SIEM? A fully managed security operations service from Clone Systems. Our analysts monitor your environment 24/7, our SIEM collects and correlates your security data, and our AI helps investigate. You get detection, investigation and response without building a security team. Not sure how SIEM, SOC, EDR, MDR and XDR differ? Read our plain-English guide. Is the SIEM included, and can I buy it on its own? The SIEM is included and is not sold on its own. Managed SOC + SIEM always comes with our analysts, our AI and the platform together. Do we need hardware on site? Only if you want it. We can host your SIEM in our data centers in Philadelphia, Athens or Limassol, or deploy it as a small physical or virtual server in your own environment so your logs never leave it. Is the SOC really staffed 24/7? Yes. Analysts in the United States and the EU cover every hour of every day, so alerts never wait for business hours. How quickly do you respond? Correlation rules run every minute and event-level rules fire in real time, and the most serious incidents go straight to an analyst. We notify your designated contacts by email and in your console with the evidence attached, and stay engaged through remediation. What happens when you find something? We investigate, attach the evidence and attack path, and recommend a response. No action is taken in your environment until it is confirmed, and containment is fast and reversible by design. Which tools can you pull logs from? More than 100 integrations across identity, endpoint security, email security, cloud, network, SaaS and vulnerability tools, plus syslog from network devices and agents on servers and workstations. Ask us about yours. Where is our data stored, and is it shared with AI services? On your SIEM, in our data center or yours, encrypted in transit. Our Philadelphia data center is SOC 2, ISO 27001 and PCI DSS audited; Athens is PCI DSS, ISO 27001, 9001, 14001, 45001 and 50001 certified; Limassol is ISO 27001 and PCI DSS. EU hosting in Athens is available on request so data stays in the EU. Our AI is our own private, self-hosted AI and your data is never sent to OpenAI, Anthropic or any outside AI provider. What does onboarding look like? A scoping call, then platform deployment, then a few weeks of training, agent installation and verifying every source reports back. After that it is continuous monitoring, and you can add sources within your endpoint count at any time. What should be in an RFP for a managed SOC? Ask every provider to answer these five points in writing: Coverage hours and analyst locations: is the SOC staffed 24/7, and where do the analysts work? What is included: is the SIEM, endpoint coverage, reporting and onboarding in the price, or sold separately? Where data lives: which data centers, which certifications, and can the platform run in your own environment? How AI is used: whose AI it is, where it runs, and whether your data is ever sent to an outside AI service. How containment is approved: who signs off before any action is taken in your environment, and how it is logged. Is a white-label SOC the same as a managed SOC? Not always. A white-label SOC is another provider's SOC resold under a different brand; Clone Systems runs its own analysts in the US and EU. --- ## Managed SOC + SIEM Pricing: How SOC as a Service Is Priced | Clone Systems URL: https://www.clone-systems.com/managed-soc-pricing HOME MANAGED SOC + SIEM PRICING How our managed SOC is priced Managed SOC + SIEM from Clone Systems is priced per monitored endpoint with a 50 endpoint minimum on a one-year term, with the SIEM, 24/7 analysts and private AI included. The same bill covers analysts in the US and EU and compliance-ready reporting. Host it in our data centers or in your own environment. Get a quote scoped to your environment in one call. MANAGED SOC PRICING Get a Quote See What's Included Per endpoint One predictable price 39 endpoints Minimum coverage size SIEM and AI included No separate licenses One-year term Multi-year available HOW THE PRICING MODEL WORKS Managed SOC pricing: one price per endpoint, nothing hidden. Per endpoint You pay for each server, workstation or cloud workload we monitor. Add endpoints as you grow within your agreement, with no new hardware project or extra licensing. 50 endpoint minimum Managed SOC + SIEM is built for organizations with at least 50 endpoints. Below that, our vulnerability scanning and penetration testing services, available online, are usually the better fit. SIEM included The SIEM is part of the service and is not sold on its own. It is fully managed by our SOC, and our private AI comes with it. There is no separate SIEM or AI license to buy. WHAT'S INCLUDED AT EVERY SIZE Managed SOC pricing includes everything a mature SOC delivers, in the per-endpoint price. 24/7/365 monitoring by Clone Systems analysts in the United States and the EU Analysts investigating alerts, not scripts The SIEM, hosted in our data centers or deployed in your environment, with log collection and retention Private AI investigation on Clone Systems' own private AI platform: incident summaries, attack path analysis, guided response and report commentary, every action approved by a person Threat intelligence and event correlation across network, endpoints, identity and cloud Incident response: triage, notification with evidence attached, containment from the console once confirmed, and coordinated remediation Scheduled reports for leadership and auditors, aligned to PCI DSS, HIPAA, SOC 2 and the frameworks you report against Standardized onboarding, with coverage active in a few weeks WHAT CHANGES THE PRICE SOC as a service cost: four things that shape your quote. Endpoint count The main driver. More endpoints, more telemetry, more coverage. Environment mix Cloud workloads, on-premises servers, and remote endpoints each bring different log sources. Compliance scope If you need evidence packaged for a specific audit such as PCI DSS or HIPAA, we scope the reporting to match. Hosting choice Hosted by us in Philadelphia, Athens or Limassol, or deployed in your own environment so your logs never leave it. Either way the service, the analysts and the AI are the same. MANAGED SOC VS. BUILDING YOUR OWN Managed SOC vs in-house SOC: why per-endpoint pricing wins. Standing up a SOC in-house means recruiting analysts in a shrinking talent market, licensing enterprise tools, and staffing shifts around the clock. Most organizations end up short-staffed, over-tooled, and behind on emerging threats. Clone Systems runs the SOC for you at a per-endpoint price, so the cost scales with your environment instead of with headcount. In-house SOC Clone Systems Managed SOC + SIEM Analysts on shift 24/7 Hire and retain a full rotation Included SIEM, detection tooling and AI License and maintain separately Included, fully managed Threat intelligence feeds Buy separately Included Time to coverage Months Weeks Cost model Headcount plus licenses plus infrastructure One per-endpoint price GET A QUOTE Get managed SOC pricing for your environment. Tell us roughly how many endpoints you have, which compliance frameworks matter, and whether you want the SIEM hosted by us or in your environment. A specialist will come back with a scoped quote and a plan to turn on coverage. Per-endpoint pricing, SIEM and AI included Analysts on shift 24/7/365 in the US and EU Hosted in our data centers or in your own environment One-year term, multi-year available Get a Quote Website (leave blank) TALK TO OUR SOC TEAM Scope your Managed SOC + SIEM coverage Tell us about your environment and what you want covered. A senior specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. MANAGED SOC PRICING FAQ Managed SOC pricing questions, answered. Everything you need to know about how Managed SOC + SIEM is priced. Still stuck? Talk to us. How is Clone Systems managed SOC priced? Per monitored endpoint, with a 50 endpoint minimum and a one-year term. The price includes 24/7 analysts, the SIEM, our private AI and compliance-ready reporting. Multi-year agreements are available. What counts as an endpoint? Any server, workstation, or cloud workload we monitor and collect telemetry from. Is there a minimum contract size? Yes. Managed SOC + SIEM starts at 50 endpoints and a one-year term. Smaller environments are usually better served by our vulnerability scanning or penetration testing services, which can be purchased online. Is SIEM an extra cost? No. The SIEM and our private AI are included and fully managed by our SOC. The SIEM is not sold on its own. Do I need to buy hardware? Only if you want the SIEM in your own environment. We can host it in our data centers in Philadelphia, Athens or Limassol, or deploy it as a small physical or virtual server on your side so your logs never leave it. How fast can coverage start? A scoping call, then platform deployment, then a few weeks of training, agent installation and verifying every source reports back. Can I get an exact price without a call? Not yet. Because pricing depends on endpoint count and environment mix, we scope each quote individually. Most quotes come back within one business day of the first conversation. How much does a managed SOC cost? Managed SOC + SIEM is priced per monitored endpoint, with a 50 endpoint minimum and a one-year term, and the SIEM, 24/7 analysts and private AI are included. What moves the price is the number of endpoints, the mix of servers, workstations and cloud workloads, the log sources and integrations you connect, how long logs must be retained for your compliance framework, and whether the SIEM is hosted in our data centers or in your own environment. --- ## Managed SIEM Provider with EDR Integration | How the Clone Systems SIEM Works URL: https://www.clone-systems.com/managed-siem-edr-service HOME SIEM PLATFORM The SIEM behind Managed SOC + SIEM Clone Systems is a managed SIEM provider: this is the platform our analysts work in every day, and it is included with Managed SOC + SIEM. It collects your security data from more than 100 tools, checks every correlation rule every minute, maps each incident to MITRE ATT&CK, and runs in our data centers or yours. It is not sold on its own. Schedule a Demo Speak with our team 95+ Integrations out of the box Every minute Detection rules re-checked MITRE ATT&CK Attack paths on every incident Hosted or self-hosted Your logs, your choice SIEM PLATFORM CAPABILITIES Managed SIEM: everything a modern SIEM should do, run by people who do it all day. Correlated detection, endpoint agents, threat hunting and audit-ready reporting, managed by Clone Systems analysts with full visibility for your team in the same console. Detection Rules, Checked Every Minute Nearly 1,900 detection rules written by Clone Systems run against your data, with correlation rules re-checked every minute and event-level rules firing in real time, plus six custom rule types your analysts can tune: too many events in a window, too many different values, a source that goes quiet, a number crossing a limit, a sudden spike, or a value never seen before. Rules Proven Before They Go Live Test any rule against the last 24 hours of your real data in the console, or up to seven days through the API, to see exactly how often it would have fired before you turn it on. The same replay answers "would we have caught that?" after an incident. Endpoint Agents Lightweight agents on Windows and Linux servers and workstations collect security logs, file changes and process activity. On Linux, our own agent can also block an address, deny a host, disable an account, collect evidence remotely and isolate the host, each confirmed before it runs. Windows response actions run through your existing endpoint tool, which we integrate with. Threat Hunting and Watch Lists One search on any IP, user, host or file hash returns everything the platform has seen: first and last seen, activity timeline, related hosts and users, and matching incidents. Sweep a whole threat report of indicators in one pass, and put anything suspicious on a watch list. Attack Paths and Incident Cases Every incident carries its evidence, timestamped analyst notes, a nine-stage MITRE ATT&CK attack path showing how far the attacker got, and the earliest point to break the chain. Repeat alerts do not open new incidents while one is being handled, and incident rules can fold repeat incidents for the same user, host or address into one case. Reports, Dashboards and Retention Twelve standard reports, from a daily critical threat digest to the monthly executive report, the monthly compliance evidence pack and a log source health and coverage report, on a schedule as PDF or Excel. Live dashboards for threat posture, triage queue and risky accounts. Retention is set to meet your framework, including 12 months for PCI DSS. HOW THE SIEM WORKS How the managed SIEM works: from log source to incident, in five steps. A predictable pipeline from your tools to a worked incident, wired in with collectors, agents and API integrations. 01 Collect Syslog from firewalls, switches and appliances; agents on servers and workstations; and API integrations for cloud, identity, email security, endpoint security and SaaS tools. More than 100 integrations are ready to connect. 02 Normalize and Enrich Events are parsed into one common format and enriched with MITRE ATT&CK tactics, compliance tags, and vulnerability context ranked by real-world exploitation. 03 Detect Correlation rules run every minute and event-level rules fire in real time. Matches raise an incident, send an email to your notification group, or both. 04 Investigate Our analysts and our AI work the incident queue with the evidence, attack path and related incidents attached. You see the same case in your console. 05 Respond and Report Confirmed threats are contained from the console once approved, and scheduled reports go to leadership and auditors. ARCHITECTURE SIEM data collection: one pipeline, every signal, your choice of where it lives. Your SIEM is a dedicated instance, not a shared cloud tenant. We host it in our data centers in Philadelphia, Athens or Limassol, or deploy it as a physical or virtual server in your own environment so your logs never leave it. Either way, your data is encrypted in transit, there is no telemetry or phone-home, and outbound connections go only to the services you enable. Cloud, on-prem and hybrid sources AWS, Azure, Google Cloud, Microsoft 365, Google Workspace, identity providers and on-premises networks land in one investigation view. MITRE ATT&CK aligned detections Every alert carries attacker tactics and techniques, not just a signature name. Confirmed-first containment Block an address, deny a host, isolate on Linux, disable an account or collect evidence, all at the endpoint from the console, each previewed and approved before it runs, and reversible by design. Continuous tuning Whitelists, time-limited suppressions and rule backtesting keep noise down without losing coverage. INSIDE THE CONSOLE SIEM platform tour: see the platform your SOC runs on. A sample of the Clone Systems SIEM: correlated detections, MITRE-mapped evidence, and the case, tuning and containment actions our analysts use. One console Network, cloud, identity, endpoint MITRE-mapped Evidence tied to ATT&CK AI-assisted Investigation by our private AI Confirmed-first Contain, tune, close WHY THIS SIEM Managed SIEM benefits: better signal, faster response, your data where you want it. One Correlated View Endpoint, network, cloud, identity and email events land in a single timeline, no stitching investigations across five consoles. Absence Is a Finding A quiet-source rule set for any host, feed or collector raises an incident when it stops reporting, and the log source health report lists silent agents, so coverage gaps do not hide. Noise Handled Properly Rules start disabled, are backtested on your real data, and are tuned with narrow whitelists instead of being switched off. Compliance Evidence Built In Alerts tagged to PCI DSS, HIPAA, GDPR, NIST 800-53 and SOC 2, plus a compliance evidence pack and CIS hardening checks on your endpoints. Vulnerabilities Ranked by Real Risk Findings prioritized by CISA's known-exploited list and exploit probability, so an exposed server with an actively exploited flaw rises to the top. Live in a Few Weeks Standardized onboarding gets sources connected, agents installed and every feed verified in a few weeks. WHO RUNS ON OUR PLATFORM Who a managed SIEM is for: teams that need real detection, not another dashboard. Mid-Market Teams Without a Full SIEM Program Get correlated detection and EDR without hiring engineers to run the platform. Regulated Financial & Payment Environments PCI DSS 4.0.1 aligned collection, retention, and reporting for merchants, processors, and fintechs. Healthcare & HIPAA-Regulated Businesses Audit-ready log retention and endpoint monitoring for organizations handling protected health information. E-Commerce & Cloud-Native Operations Correlated visibility across web servers, APIs, cloud workloads, and workforce endpoints. BUILT IN, NOT BOLTED ON SIEM with AI: our own private, self-hosted AI reads every log line. AI is part of the platform, working alongside our analysts. It is our own private, self-hosted AI, so your logs and incidents are never sent to OpenAI, Anthropic or any outside AI service. Anyone on your team can ask it questions in the same console our SOC uses. Investigate with AI. Hand any search or incident to the AI for a plain-English summary of what happened and what to check next. Attack path analysis. Each incident mapped to MITRE ATT&CK, with the next likely attacker step and where to cut them off. Guided response. Containment steps drafted for the specific technique observed, previewed and waiting for human approval before anything runs. Report commentary. Draft narrative for your monthly executive report, editable before delivery. Schedule a Demo Talk to a specialist RELATED MANAGED SERVICES Pair the SIEM with the rest of the platform. The SIEM is included with Managed SOC + SIEM. These services sit around it. Managed SOC + SIEM The full service: analysts 24/7, this platform, and private AI, sold together. Learn more about Managed SOC + SIEM Managed Penetration Test Engineer-led testing that validates the controls this platform monitors. Learn more about Managed Penetration Test Intrusion Prevention Inline blocking of known-bad traffic before it reaches your environment. Learn more about Intrusion Prevention See how Managed SOC + SIEM is structured READY WHEN YOU ARE See the SIEM running against real telemetry. Walk through your environment with a specialist, see the console, and get a scoped plan to turn on Managed SOC + SIEM. 100+ integrations with the tools you already run Rules checked every minute, proven before they go live Hosted in our data centers or in your own environment Reply from a real specialist Schedule a Demo Website (leave blank) TALK TO OUR SIEM TEAM Scope your Managed SOC + SIEM coverage. Tell us about your environment, your endpoint count and where you want the SIEM hosted. A specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. SIEM PLATFORM FAQ Managed SIEM questions, answered. Everything you need to know about the platform behind Managed SOC + SIEM. Still stuck? Talk to us. Can I buy the SIEM without the SOC? No. The SIEM is included with Managed SOC + SIEM and is not sold on its own. You get the platform, our analysts and our AI together. Which log sources and tools do you support? More than 100 API integrations across identity (Okta, Microsoft Entra ID, Duo and more), endpoint security (CrowdStrike, SentinelOne, Microsoft Defender and more), email security (Proofpoint, Mimecast and more), cloud (AWS, Azure, Google Cloud), network and SaaS (Microsoft 365, Google Workspace, Salesforce, Slack), plus syslog from any network device and agents on Windows and Linux systems. See the full sample list on our integrations page. Where does the SIEM run? As a dedicated instance in our data centers in Philadelphia, Athens or Limassol, or as a physical or virtual server in your own environment. EU hosting in Athens is available on request so data stays in the EU. How does EDR fit in? Agents on your Windows and Linux servers and workstations stream logs, file changes and process activity into the same platform, so endpoint activity is correlated with network and identity events in one investigation. Our own agent on Linux can contain the host from the console once it is confirmed; on Windows, containment runs through your existing endpoint tool, which we integrate with. How are alerts prioritized? By severity, attack-path depth (how far the attacker got), threat intelligence context and known exploitation. Noise is handled with whitelists, time-limited suppressions and rule backtesting rather than switching rules off. How long are logs kept? Retention is configurable and set to meet your framework, including 12 months for PCI DSS. Reports and exports are included. Can we see and search the data ourselves? Yes. Your team gets the same console our analysts use, with search, dashboards, incidents, reports and the AI assistant, scoped to your organization only. Is our data isolated and encrypted? Each customer has a dedicated SIEM instance; no other customer can see your data. Data is encrypted in transit. Our AI is our own private, self-hosted AI, running on Clone Systems' own AI platform, and nothing is sent to OpenAI, Anthropic or any outside AI provider. What does onboarding look like? A scoping call, then platform deployment, then a few weeks of training, agent installation and verifying every source reports back. After that it is continuous monitoring, and you can add sources within your endpoint count at any time. How does the SIEM integrate with EDR? Agents on your Windows and Linux servers and workstations stream logs, file changes and process activity into the SIEM, where endpoint activity is correlated with network and identity events in one investigation. On Linux our own agent can contain the host once the action is confirmed; on Windows, containment runs through your existing endpoint tool, such as CrowdStrike, SentinelOne or Microsoft Defender, which the SIEM integrates with. --- ## SIEM with AI | Private AI Investigation Inside Managed SOC + SIEM | Clone Systems URL: https://www.clone-systems.com/ai-siem-soc-as-a-service HOME SIEM WITH AI SIEM with AI. Private by design. The AI inside Managed SOC + SIEM reads every incident, explains it in plain English, maps the attack and drafts the response, then waits for a human to approve it. It is Clone Systems' own private, self-hosted AI, so your logs and alerts never go to OpenAI, Anthropic or any outside AI service. Included with Managed SOC + SIEM, not sold separately. Schedule a Demo Speak with our team Private AI Our own private, self-hosted AI Human approved No action runs without a person 24/7/365 Analysts in the US and EU Included Part of Managed SOC + SIEM SIEM WITH AI CAPABILITIES SIEM with AI: AI does the reading, people make the call. Everything happens in the same console our analysts use. The AI handles the mechanical work, your team and ours review it, and nothing changes in your environment until a person says so. Investigate with AI Hand any search, incident or indicator to the AI and get back what happened, which assets were involved, first and last seen, related hosts and users, and what to check next. Plain-English Incident Summaries Every escalation arrives with a readable narrative of what happened, on which asset, and why it matters, so triage starts with a decision instead of a raw log. MITRE ATT&CK Attack Paths Each incident is mapped to attacker tactics and techniques and folded into a nine-stage attack path that shows how far the attacker got, the likely next step, and the earliest point to break the chain. Drafted Response, Approved by People The AI proposes the containment sequence for the specific technique observed. Every action is previewed and needs a human to approve it before it runs, and it is logged. Batch Indicator Sweeps Paste a threat report's list of bad addresses, domains or file hashes and the AI checks whether any of them has ever touched your environment, in one pass. Report Commentary The AI drafts the narrative for your monthly executive report and compliance evidence pack, editable before delivery. HOW SIEM WITH AI WORKS How SIEM with AI works: from raw alert to an approved response, in five steps. A predictable model for AI-assisted investigation, built into the Managed SOC + SIEM platform rather than bolted on. 01 Collect Your SIEM already holds the logs, events, incidents and watch lists from more than 100 integrations, syslog and endpoint agents. The AI works on that data, in place. 02 Detect Correlation rules run every minute, event-level rules fire in real time, and incidents are raised with their evidence attached. The AI does not replace detection; it starts where detection ends. 03 Investigate The AI profiles the indicators, correlates related incidents by shared users, hosts and addresses, maps the attack to MITRE ATT&CK and writes the summary. 04 Recommend The AI drafts the containment sequence and names the earliest point to break the attack chain. 05 Approve and Act A person, yours or ours, reviews the preview and approves it. Only then does the action run, and the approval is logged in the incident. PRIVATE AI, BY DESIGN Private AI for your SIEM: our AI, our platform, your data stays yours. The AI inside Managed SOC + SIEM is Clone Systems' own private, self-hosted AI, running on our own AI platform. Your logs, alerts and incident context are processed there and nowhere else. Our own AI platform. Models hosted and controlled by Clone Systems, not a public chatbot. Private, self-hosted AI. Inference and retrieval run on our own platform, not at an outside AI vendor. No third-party model sharing. Prompts and responses never leave Clone Systems for OpenAI, Anthropic, Google or any other model host. Your data serves your environment only. It is never mixed into shared or public model training. Our Own AI Platform, Not a Public Chatbot The AI runs on a platform Clone Systems operates itself. It is not a rebranded consumer AI service. Our Own Private, Self-Hosted AI All inference, retrieval and orchestration happen on Clone Systems' own AI platform, not at an outside model vendor. No Third-Party Model Sharing Alerts, logs, prompts and responses are never sent to OpenAI, Anthropic, Google or any other external model host. Off Until You Turn It On AI features are off by default and switched on by an administrator for your SIEM instance, so you decide when the AI sees your data. Same Controls as the Rest of the Platform Access control, encryption in transit, audit logging and retention match the standard used for the rest of Managed SOC + SIEM. Guardrails on Every AI Action The AI cannot change your systems without a person's approval. AI conversations and actions are recorded for review. WHY SIEM WITH AI AI for SOC analysts: real incidents on the screen, noise off the queue. Alert Fatigue, Handled Repeat alerts fold into the open incident instead of opening new ones, known-good behavior is suppressed with narrow whitelists, and the AI summarizes what is left, so people spend time on outcomes. Faster Time to Response The summary, attack path and drafted response are ready before an analyst opens the incident. Documented Decisions Every incident carries the evidence, the AI's summary, the drafted response and the human approval, ready for reviews and audits. Modern AI Without the Data Risk The productivity of AI without sending your telemetry to a public service. Built Into the Platform No extra agents, no extra tool. It works on the data your SIEM already holds. Live With Your SOC Switched on during Managed SOC + SIEM onboarding, so it is working from the day you go live. WHO RUNS ON SIEM WITH AI Who SIEM with AI is for: teams that need modern AI without the data risk. Security Teams Drowning in Alerts Mid-market and enterprise SOCs where analysts burn out on noise and miss real incidents in the queue. Regulated Financial Environments PCI DSS and financial programs that need documented, auditable decisions on every incident. Healthcare & HIPAA-Regulated Businesses Organizations handling protected health information who cannot risk sending telemetry to public AI vendors. E-Commerce & SaaS at Scale High-volume environments where automated prioritization and correlation are the only realistic way to keep up. CLONE SYSTEMS AI AI incident investigation: what the AI puts in front of a person. Every incident arrives with a plain-English summary, correlated evidence, a MITRE ATT&CK attack path and a drafted response, so the human starts with a decision, not a raw log. Incident summary. A readable narrative of what happened, on which asset, and why it matters. Correlated evidence. Related incidents sharing a user, host or address, stitched together. Attack path. Tactics and techniques mapped to ATT&CK, with the next likely step. Drafted response. Step-by-step containment, previewed and waiting for approval. Schedule a Demo Talk to a specialist INSIDE THE CONSOLE SOC with AI in action: a working queue, real triage actions, human approval on every one. Click any incident, then review the AI summary, drafted response and evidence. Sample data, but the flow is what your team and ours actually use. AI-summarized Every incident explained Plain English Summaries for every alert Human approved Contain, escalate, suppress Audit trail Every decision documented RELATED MANAGED SERVICES Pair SIEM with AI with the rest of the platform. The AI is part of Managed SOC + SIEM. These pages explain the service around it. Managed SOC + SIEM The full service: analysts 24/7, the SIEM, and this AI, sold together. Learn more about Managed SOC + SIEM SIEM Platform Deep Dive How the SIEM works: rule types, backtesting, attack paths, reports and integrations. Learn more about SIEM Platform Deep Dive Managed Penetration Test Engineer-led testing that validates the controls your SOC is monitoring. Learn more about Managed Penetration Test READY WHEN YOU ARE See the AI work a real incident. Walk through a live incident queue with a specialist, watch the AI summarize and draft a response, and get a scoped plan for Managed SOC + SIEM. Our own private, self-hosted AI, not an outside model host No outside AI vendor ever sees your alerts, logs or context Every AI action previewed and approved by a person Reply from a real specialist Schedule a Demo Website (leave blank) TALK TO OUR SOC TEAM Scope Managed SOC + SIEM for your environment. Tell us about your environment, your endpoint count and where you want the SIEM hosted. A specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. SIEM WITH AI FAQ SIEM with AI questions, answered. Everything you need to know about the AI inside Managed SOC + SIEM. Still stuck? Talk to us. What is SIEM with AI? The AI built into Managed SOC + SIEM. It reads every incident, correlates related events, writes a plain-English summary, maps the attack to MITRE ATT&CK and drafts a response. People stay in the loop and approve every action. It is included with the service, not sold separately. Where does the AI run? Do you send our data to a third-party AI vendor? The AI is Clone Systems' own private, self-hosted AI, not a public chatbot or an outside model host. Your alerts, logs and incident context are processed on Clone Systems' own private AI platform and nowhere else. Nothing is shared with OpenAI, Anthropic, Google or any other outside model host. Is our data used to train shared models? No. Your data serves only your own environment and is never mixed into shared or public model training. How is this different from adding ChatGPT to a SIEM? A public chatbot has no access to your telemetry, no memory of your incidents, and ships every prompt to a third party. This AI is embedded in your SIEM and SOC workflow, works on your real data in place, and runs on our own private, self-hosted AI platform under the same controls as the rest of the platform. Can the AI take action on its own? No. The AI drafts and recommends. Every action, from a containment command to a rule change, is previewed and needs a human to approve it before it runs, and the approval is logged in the incident. Do we need a security expert to use it? No. Your team gets the same console our analysts use, and the AI handles the heavy lifting: summaries, attack paths and recommended next steps. Anyone on your team can search and investigate, with our analysts in the US and EU available 24/7. What does the AI do with an incident? It profiles the indicators, correlates related incidents by shared users, hosts and addresses, maps the attack to MITRE ATT&CK, writes the summary and drafts the response. Analysts review, adjust, close, tune or escalate. How does it help with false positives? Repeat alerts fold into the open incident instead of opening new ones, known-good behavior is suppressed with narrow whitelists, and new rules can be tested against your recent real data before they are turned on. The AI then summarizes what remains. What controls are in place around the AI itself? It is off until an administrator switches it on for your organization. It runs behind the same access controls, audit logging and encryption in transit as the rest of the platform, AI conversations and actions are recorded for review, and it cannot change your systems without a person's approval. Can we see what the AI decided and why, for audit and compliance? Yes. Every incident carries the raw events, correlated evidence, the AI summary, the drafted response and the human decision. Reports and exports support PCI DSS, HIPAA, SOC 2 and ISO 27001 evidence needs. --- ## Managed Intrusion Prevention Service | 24/7 IPS URL: https://www.clone-systems.com/managed-intrusion-prevention-service HOME INTRUSION PREVENTION Managed IPS that blocks threats in real time Inline packet inspection, signature and behavioral analytics, and 24/7 SOC tuning that stops exploits, worms, and zero-day attacks before they reach your network. Schedule a Demo Speak with our team 24/7/365 US and EU SOC coverage Inline Real-time packet blocking Signature + Behavior Zero-day detection PCI · HIPAA · SOC 2 · ISO 27001 · NIST + Frameworks supported INTRUSION PREVENTION CAPABILITIES Deep packet inspection and inline blocking, fully managed. Continuously updated detections, inline prevention, and 24/7 analyst review, delivered as a fixed-cost service. Real-Time Traffic Inspection Continuous packet-level inspection of inbound and outbound traffic to detect exploits, worms, brute-force attempts, and abnormal patterns as they happen. Signature & Behavioral Analysis Detection engines combine continuously updated attack signatures with behavioral analytics so zero-day threats are blocked before a rule is even written. Inline Prevention & Blocking The IPS runs in-band and drops malicious packets in real time, stopping the attack before it reaches internal systems. Real-Time Alerts & Context Every blocked event is enriched with source, technique, and asset context, then routed to our SOC and your team for review. Firewall & Network Integration Sits alongside your next-generation firewall to provide the deep packet inspection layer it doesn't do. Also deployable internally for east-west visibility. Continuous Threat Intelligence Signatures and threat feeds update from multiple sources plus Clone Systems SOC observations, so detections stay ahead of new campaigns. HOW MANAGED IPS WORKS From edge appliance to blocked packet, in five steps. A predictable model for inline prevention, wired into your existing network with the CloneGuard Network Security appliance. 01 Scope & Sizing We size the CloneGuard Network Security appliance to your throughput and interfaces, then plan the inline insertion point between your edge router and firewall. 02 Deploy Inline The appliance is installed in-band. Traffic starts flowing through the IPS while we baseline normal behavior in monitoring mode. 03 Tune & Enforce Our SOC tunes signatures and behavioral rules to your environment, then enables inline prevention so malicious traffic is dropped in real time. 04 Detect & Block The IPS inspects every packet against continuously updated threat intelligence and blocks exploits, worms, brute-force attempts, and zero-day behavior at the perimeter. 05 Monitor & Report 24/7 SOC review, escalations to your team, and customizable dashboards and reports for compliance and executive visibility. ARCHITECTURE Inline at the edge. Every packet inspected. The CloneGuard Network Security appliance is deployed in-band between your edge router and firewall. Traffic is inspected against continuously updated signatures and behavioral analytics, then either passed through or dropped in real time before it can reach your internal systems. Inline packet inspection Every north-south packet is parsed, matched, and either forwarded or dropped in real time. Signature + behavioral analytics Known-bad patterns and abnormal behavior are handled together, so zero-day exploits are covered too. Optional internal sensor Add an IPS or IDS internally to inspect east-west traffic and TLS-decrypted flows for lateral movement. 24/7 SOC tuning Analysts continuously tune rules to keep false positives low and legitimate traffic flowing. VIEW THE IPS CONSOLE Inline prevention, live at the edge. A read-only window into the CloneGuard Network Security appliance our SOC runs on your behalf: live blocks with source, destination, and matched signature, plus the tuning log analysts keep updated 24/7. Inline Malicious traffic dropped, not logged 24/7 tuned Analyst-owned rule tuning Signature + behavior Known-bad and zero-day coverage SOC-reviewed Every escalation vetted by a human Same appliance protecting managed networks today Signatures updated continuously across every tenant Full audit trail of blocks, resets, and rule changes Live Blocks Signatures Sources Tuning Search ⌘K 5 IPS AR IPS Prevention Inline packet inspection at the edge. Malicious traffic dropped before it reaches your network. Inline · Enforcing PACKETS / SEC 180,487 rolling 60s ingest BLOCKED · 1H 2,150 dropped inline at edge SIGNATURES 41,208 continuously updated SENSORS ONLINE 6 / 6 north-south + east-west LIVE BLOCKS streaming 10:01:44 PM · 141.98.11.203 web-edge-02:443 BLOCK Path traversal · ../etc/passwd 10:01:42 PM · 185.242.111.4 web-edge-02:443 BLOCK SQLi · UNION SELECT in path 10:01:42 PM · 45.83.66.19 vpn-gw-1:443 BLOCK Fortinet CVE-2024-21762 probe 10:01:42 PM · 93.184.220.29 mail-hub:25 RESET SMTP auth brute-force · 42/min TOP SIGNATURES · 24H SQLi · UNION SELECT 1,284 Log4Shell JNDI payload 962 Fortinet CVE-2024-21762 741 RDP credential stuffing 588 ANALYST TUNING 24 / 7 02:38 Whitelisted approved-scanner ASN for 24h maintenance window. 01:14 Raised threshold on Struts OGNL rule after 3 known-benign matches. 00:47 Deployed new IoC pack · 128 signatures updated across 4 tenants. Clone Guard® IPS  |  Fully managed · read-only view · © 1998–2026 Clone Systems, Inc. WHY MANAGED IPS Stop attacks at the perimeter, not after the fact. Real-Time Network Protection Malicious traffic is dropped inline, shrinking the window an attacker has to exploit a vulnerability on your network. Fewer False Positives Analyst-tuned signatures and behavioral rules cut noise so your team focuses on events that actually matter. Proactive Threat Prevention Known and zero-day attacks are blocked before they reach internal systems, not just logged after the fact. Predictable Managed Service Purchase the right-sized appliance through Clone Systems, then updates, tuning, and 24/7 SOC coverage are one predictable line item. Better Network Visibility Dashboards surface what was blocked, from where, and why, so policies and other controls can be tightened over time. Live in Weeks, Not Months Standardized deployment gets the appliance inline, baselined, and enforcing in weeks, not the months a self-run rollout takes. WHO RUNS BEHIND OUR IPS Built for networks that need active protection, not just alerts. Mid-Market Networks Without a Dedicated Network Security Team Get enterprise-grade inline prevention and 24/7 tuning without hiring specialists to run it. Payment & Financial Environments Inline blocking and detailed evidence for PCI DSS-scoped networks, processors, and fintechs. Healthcare & HIPAA-Regulated Businesses Perimeter protection and reporting for organizations handling protected health information. E-Commerce & Public-Facing Services Blocks exploit attempts, credential stuffing, and worms targeting internet-exposed workloads. NEW · AI ADD-ON An AI assistant that explains every blocked packet, in plain English. Add the Clone Systems AI Assistant to your Intrusion Prevention service for faster triage of blocked events, plain-English explanations of the attack, and guided next steps, alongside our human analysts, not replacing them. Blocked-event summarization. Every notable block arrives with a plain-English summary of the attack, source, and target so response starts immediately. Signature vs behavior context. Explains whether a block matched a known signature, an anomaly, or both, and how confident the detection is. Response guidance. Step-by-step containment for repeat offenders and lateral movement, mapped to MITRE ATT&CK. Executive reporting. Draft weekly and monthly reports for leadership and auditors, editable before delivery. Schedule a Demo Talk to a specialist Clone Systems AI Assistant ON SHIFT What did the IPS block from 91.240.118.0/24 in the last hour? 1,284 packets dropped from that range in the past 60 minutes. The pattern matches CVE-2024-3400 exploit attempts against your public firewall management interface, plus SSH brute-force against a bastion host on 203.0.113.7. SIGNATURE: ET EXPLOIT MITRE: T1190 · T1110 RECOMMENDED RESPONSE Push a 24-hour perimeter deny for 91.240.118.0/24, confirm the firewall management interface is not internet-exposed, and rotate the bastion host's SSH keys. Want me to open the incident and page the on-call analyst? Deny + open incident Rotate SSH keys RELATED MANAGED SERVICES Pair Intrusion Prevention with the rest of the platform. IPS blocks attacks at the perimeter. These services extend visibility, offensive validation, and endpoint response deeper into your environment. SIEM Platform Correlate IPS events with logs from cloud, identity, and endpoints, and contain compromised hosts from the SOC console. Learn more about SIEM Platform Managed SOC + SIEM 24/7 US and EU SOC that investigates escalations from IPS, SIEM, and endpoint telemetry as a single incident. Learn more about Managed SOC + SIEM Managed Penetration Test Point-in-time offensive engagement that validates whether the controls this service enforces actually hold up under attack. Learn more about Managed Penetration Test READY WHEN YOU ARE Inline prevention, live in weeks, not months. Walk through your network with a senior specialist, see the CloneGuard IPS blocking real traffic, and get a scoped plan to turn it on at your perimeter. Inline packet inspection with real-time blocking Certified SOC analysts in the US and EU on shift 24/7/365 Right-sized appliance purchased through Clone Systems, small to large Reply from a real specialist Schedule a Demo Website (leave blank) TALK TO OUR IPS TEAM Scope your Intrusion Prevention coverage Tell us about your network and what you want protected. A senior specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. INTRUSION PREVENTION FAQ IPS questions, answered. Everything you need to know about our managed IPS. Still stuck? Talk to us. What is Managed Intrusion Prevention? Managed Intrusion Prevention (IPS) is a fully managed service that inspects every packet entering and leaving your network in real time. When traffic matches a known attack signature or behaves like an exploit attempt, the IPS drops it inline before it reaches your systems. Clone Systems runs the appliance, tunes detections, and staffs the 24/7 SOC that reviews every escalation. How is IPS different from a next-generation firewall? A next-generation firewall enforces policy: who can talk to what, on which port. An IPS inspects the contents of that traffic for exploit payloads, malware, worms, brute-force patterns, and zero-day behavior, then blocks matching traffic inline. The two are complementary; our IPS sits alongside your existing firewall to provide the deep inspection layer it doesn't do. What is the difference between IDS and IPS? An IDS sits out-of-band as a tap and only alerts on malicious traffic; a human still has to react. An IPS sits inline and drops the traffic itself. Our service supports both modes: most customers run IPS at the perimeter for automatic prevention and add IDS internally for visibility into east-west traffic. Do we need to buy hardware? Yes. Intrusion Prevention is the one Clone Systems service that requires a physical appliance, and it is purchased directly through us. We size it to your network throughput, with small, medium, and large models based on the gigabit capacity you need, so there are no separate vendor negotiations. Ongoing management, signature updates, patching, tuning, and lifecycle are all covered by the managed service. Where is the IPS deployed on our network? The IPS is typically installed inline between your edge router and primary firewall so it can inspect and block all north-south traffic in real time. For east-west visibility, we recommend an internal IPS or IDS sensor too, especially where TLS traffic is terminated and can be inspected in the clear. How do you keep detections current? Threat intelligence and signatures update continuously from multiple commercial and open-source feeds, plus observations from our own SOC across the Clone Systems customer base. Our engineers layer behavioral analytics on top so zero-day exploits can be blocked before a signature is written. Who manages the appliance and responds to alerts? Our 24/7 US and EU SOC monitors the appliance and every alert it generates. Analysts triage in real time, tune out false positives, escalate genuine threats to your team, and coordinate response. You get outcomes, not a raw alert queue. Can you demonstrate what was blocked for compliance and audits? Yes. Customizable dashboards visualize threats, blocked events, and detection trends. Reports can be filtered by asset, event type, or timeframe, and are formatted to support PCI DSS, HIPAA, SOC 2, and similar compliance requirements. Will inline blocking break legitimate traffic? Not when tuned. Every deployment starts with a monitoring baseline so we understand your normal traffic before enforcement is turned up. Our SOC continues tuning signatures and behavioral rules over time to keep false positives low and legitimate traffic flowing. --- ## SIEM Integrations | 100+ Tools in One Dashboard | Clone Systems URL: https://www.clone-systems.com/siem-integrations HOME MANAGED SOC + SIEM INTEGRATIONS MANAGED SOC + SIEM The tools you already run, in one dashboard . Managed SOC + SIEM connects to more than 100 security, cloud, identity and SaaS tools through their own APIs, plus syslog from any network device and agents on your servers and workstations. The list below is a sample of what connects today; new integrations are added regularly, so if you do not see a tool, ask. Schedule a Demo Browse integrations 100+ API integrations and growing Any device Syslog from firewalls, switches and appliances Windows and Linux Endpoint agents Growing New integrations added regularly List updated October 2026. HOW INTEGRATION WORKS How SIEM integrations work: three ways data gets in. API Integrations For log collection we connect to the tool's own API with read-only credentials you provide; nothing is installed on your side. Where a tool supports response actions, those use separately scoped permissions that you approve. Covers cloud platforms, identity providers, email security, endpoint security and SaaS tools. Syslog Any firewall, switch, VPN, appliance or server that can send syslog points at your SIEM. Built-in parsers cover the major network and security vendors, with custom parsing available. Endpoint Agents Lightweight agents on Windows and Linux servers and workstations send security logs, file changes and process activity. On Linux, our own agent also gives our analysts a way to respond on the machine once an action is approved; on Windows, response runs through your existing endpoint tool. INTEGRATIONS BY CATEGORY SIEM integrations by category Examples of integrations available today. New ones are added regularly; ask us about any tool not shown here. All categories 100+ integrations across 10 categories Identity and Access 17 Sign-ins, privilege changes and password vault activity. Microsoft Entra ID Okta Duo View all 17 Endpoint Security 21 Alerts and telemetry from the endpoint tools you already pay for, correlated with everything else. CrowdStrike Falcon SentinelOne Microsoft Defender View all 21 Email Security 11 Phishing, impersonation and message-trace data. Proofpoint Proofpoint Essentials Mimecast View all 11 Cloud Platforms 11 Audit logs, security findings and network flow from your cloud accounts. AWS CloudTrail Amazon GuardDuty AWS Security Hub View all 11 Network and Web Security 23 Firewalls, web application firewalls, zero trust and network detection. Palo Alto Prisma Access Cisco Meraki Cisco Umbrella View all 23 SaaS and Productivity 07 User activity and admin changes in the apps your business runs on. Microsoft 365 Google Workspace Salesforce View all 7 Vulnerability Management 06 Findings from your scanners, ranked by real-world exploitation. Clone Systems scanning Qualys VMDR Rapid7 InsightVM View all 6 DevOps and Code 04 Audit trails from your source and project tools. GitHub GitLab Atlassian audit log View all 4 Network Devices via Syslog 16 Built-in parsing for the major vendors; any syslog source is accepted. Palo Alto Fortinet Cisco ASA View all 16 Anything Else A generic webhook receiver accepts data from tools without a dedicated integration, and custom sources can be onboarded during setup. Ask about your tool Custom SIEM integrations: not seeing your tool? This page is a sample, not the full catalog, and new integrations are added regularly. Tell us what you run during the scoping call and we will confirm what connects and how. Ask about your tool RELATED PAGES More on Managed SOC + SIEM. Managed SOC + SIEM The full service: analysts 24/7, the SIEM and private AI, sold together. Learn more about Managed SOC + SIEM SIEM Platform Deep Dive How the SIEM works: rule types, backtesting, attack paths, reports. Learn more about SIEM Platform Deep Dive SIEM with AI Private AI investigation with Clone Systems' own private, self-hosted AI. Learn more about SIEM with AI See your tools in one dashboard. Walk through your environment with a specialist and get a scoped plan to connect what you already run. 100+ integrations and growing Syslog from any network device Agents on Windows and Linux Schedule a Demo Website (leave blank) TALK TO OUR SOC TEAM Scope Managed SOC + SIEM for your environment. Tell us about your environment, your endpoint count and the tools you want connected. A specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. INTEGRATIONS FAQ SIEM integration questions, answered. Is this the complete list of integrations? No. It is a sample of what connects today. New integrations are added regularly, so ask about any tool you do not see here. Do we have to install anything for API integrations? No. For log collection we connect with read-only credentials you provide, such as an application permission in Microsoft Entra ID or an API key in your endpoint tool, and nothing is installed on your side. Response actions, where a tool supports them, use separately scoped permissions that you approve. What if our firewall or appliance is not listed? Any device that can send syslog is accepted. Built-in parsers cover the major vendors, and custom parsing is set up during onboarding. Which operating systems do the agents support? Windows and Linux servers and workstations for log collection, file changes and process activity. Response actions on the agent itself are available on Linux today. Can you take data from a tool with no integration at all? Yes. A generic webhook receiver accepts data from tools without a dedicated integration, and custom sources can be onboarded. Do integrations cost extra? Integrations are part of Managed SOC + SIEM, which is priced per endpoint. Details are worked out during the scoping call. Can the SIEM pull alerts from CrowdStrike, SentinelOne and Microsoft Defender? Yes. All three are built-in connectors, alongside more than 100 others. --- ## SIEM vs SOC vs EDR vs MDR vs XDR: Plain-English Guide | Clone Systems URL: https://www.clone-systems.com/managed-soc-vs-mdr-vs-xdr HOME RESOURCE CENTER SIEM VS SOC VS EDR VS MDR VS XDR SIEM vs SOC vs EDR vs MDR vs XDR: what they mean and which you need If you have been told you need a SIEM, an MDR or an XDR and nobody explained the difference, this page is for you. Five acronyms, plain definitions, and an honest answer about which ones Clone Systems provides and how. No engineering background required. The five terms, in plain English SIEM (Security Information and Event Management) The software. A SIEM collects the security logs from everything you run (firewalls, servers, laptops, cloud accounts, Microsoft 365, your identity provider, your other security tools) into one place, keeps them, and checks them continuously against detection rules to spot trouble. On its own it is a tool. Someone still has to watch it. SOC (Security Operations Center) The people. A SOC is the team of analysts who watch the SIEM, investigate what it finds, and respond. You can build one yourself (expensive, hard to staff around the clock) or use someone else's. "SOC as a service" and "managed SOC" mean the same thing: another company's analysts watch your environment for you. EDR (Endpoint Detection and Response) The agent on each machine. EDR is software installed on servers and workstations that watches what happens on that machine and lets an analyst act on it directly, for example blocking a bad address or disabling an account. It sees one machine at a time; the SIEM is what sees everything together. MDR (Managed Detection and Response) The service. MDR means people, not just software, watch your security around the clock, investigate alerts and respond on your behalf. In practice it is a managed SOC. The term often gets used for endpoint-only services, so always ask what an MDR actually watches. XDR (Extended Detection and Response) The marketing word. XDR means correlating data from many source types (endpoints, network, cloud, email, identity) so an attack that moves between them shows up as one story. A good SIEM with enough integrations already does this. Be careful with the label; ask any vendor what sources their "XDR" actually pulls together. Side by side TERM WHAT IT IS SOFTWARE OR PEOPLE WHAT IT SEES SIEM Collects and analyzes security logs Software Everything you connect to it SOC Analysts who watch and respond People Whatever the SIEM shows them EDR Agent on each machine Software One machine at a time MDR Analysts watching for you People (plus their tools) Depends on the provider; ask XDR Correlation across source types A feature of a good SIEM Endpoints, network, cloud, email, identity How Clone Systems covers each one We sell one service, Managed SOC + SIEM. Here is how the five terms map to it. SIEM: included, never sold alone As a managed SIEM provider, Clone Systems runs a SIEM that collects logs from more than 100 integrations plus syslog and endpoint agents, checks every correlation rule every minute, and maps every incident to MITRE ATT&CK. It is included with the service and is not sold on its own, because a SIEM nobody watches is a very expensive log file. You choose where it runs: our data centers in Philadelphia, Athens or Limassol, or your own environment. SOC: our analysts, in the United States and the EU, 24/7 Our analysts work the incident queue around the clock, every day. They investigate, attach the evidence, and recommend the response. No action is taken in your environment until it is confirmed. EDR: our agent on Linux, plus the endpoint tool you already run Lightweight agents on your Windows and Linux servers and workstations send logs, file changes and process activity into the SIEM, and on Linux our own agent gives our analysts a way to respond on the machine once an action is approved. If you already run an endpoint tool like CrowdStrike, SentinelOne or Microsoft Defender, we pull its alerts in and respond through it, so you keep what you have. MDR: yes, that is what Managed SOC + SIEM is If you are shopping for MDR, you are shopping for this: people watching, investigating and responding, across your whole environment rather than just endpoints, with the SIEM and private AI included. XDR: the correlation is real, the label is not one we use Our SIEM correlates endpoint, network, cloud, email and identity data in one place and builds an attack path across all of it for every incident. That is what XDR promises. We do not put the XDR label on it, because we would rather describe what it does than add another acronym. Where the AI fits Managed SOC + SIEM includes private AI that reads every incident, summarizes it in plain English, maps the attack and drafts the response. Every AI action is previewed and needs a person to approve it. The AI is Clone Systems' own private, self-hosted AI, so your logs and alerts are never sent to OpenAI, Anthropic or any outside AI service. How to decide You have no one watching security around the clock. You need a managed SOC. Start with Managed SOC + SIEM. You already have a SIEM but no one watches it. Managed SOC + SIEM is delivered as one service, with our analysts working in our platform. The tools and log sources you already have connect to it, so nothing you have invested in is wasted. You already have an endpoint tool (EDR). Keep it. We integrate with it and add everything it cannot see: network, cloud, identity and email. You have been quoted an "MDR" or "XDR". Ask what sources it watches and who is on shift. Then compare it to the list above. Your logs cannot leave your environment. Self-host the SIEM with us managing it; the analysts and AI work the same way. See how Clone Systems compares with Arctic Wolf, Huntress, Blumira and Sophos MDR. What it costs, in structure Managed SOC + SIEM is priced per monitored endpoint with a 50 endpoint minimum, on a one-year minimum term with multi-year available. The SIEM, the analysts and the AI are included. It is sold directly through a scoping call and demo, not online. MANAGED SOC + SIEM Talk it through with a specialist. Tell us what you run and what you have been quoted, and we will tell you plainly what you need and what you do not. Schedule a Demo Scope your environment RELATED PAGES More on Managed SOC + SIEM. Managed SOC + SIEM The service: analysts 24/7, the SIEM and private AI, sold together. Learn more about Managed SOC + SIEM Integrations The tools the SIEM pulls logs from, by category. Learn more about Integrations SIEM with AI How the private AI investigates, and why your data never leaves your dedicated SIEM. Learn more about SIEM with AI Website (leave blank) TALK TO OUR SOC TEAM Scope Managed SOC + SIEM for your environment. Tell us about your environment, your endpoint count and where you want the SIEM hosted. A specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. FAQ SIEM, SOC, MDR and XDR questions, answered. Is MDR the same as a managed SOC? Usually yes. Both mean analysts watching, investigating and responding for you. The difference is what they watch: some MDR services cover endpoints only, while a managed SOC with a SIEM covers your whole environment. Do I need a SIEM if I have EDR? Yes, if you want to see attacks that move beyond one machine. EDR sees the endpoint; a SIEM sees the endpoint together with your network, cloud, identity and email. Can you monitor the SIEM we already have? Managed SOC + SIEM is delivered as one service: our analysts and our platform together. Your existing tools and log sources connect to our platform, so you keep what you have and gain one dashboard with people behind it. Can we keep our existing endpoint tool? Yes. We integrate with CrowdStrike, SentinelOne, Microsoft Defender and many others, and correlate their alerts with everything else. Is XDR something we should buy? Ask what it actually correlates. If a service already pulls together endpoint, network, cloud, email and identity data, which Managed SOC + SIEM does, the XDR label adds nothing. Can we buy the SIEM on its own? No. The SIEM is included with Managed SOC + SIEM and is not sold separately. --- ## PCI DSS Requirement 10 Explained: Logging, Monitoring and How to Comply | Clone Systems URL: https://www.clone-systems.com/pci-dss-requirement-10-logging HOME RESOURCE CENTER PCI DSS REQUIREMENT 10 PCI DSS Requirement 10: what it asks for and how to comply without building a security team Requirement 10 is the part of PCI DSS that most merchants and service providers find hardest to keep up with, because it is not a one-time fix. It asks you to collect security logs from every in-scope system, protect them, review them every day, keep them for a year, and notice when a control stops working. This page explains what version 4.0.1 requires in plain language, which SAQs it shows up in, and how Managed SOC + SIEM from Clone Systems does the ongoing work for you. What Requirement 10 actually requires Log everything in scope (10.2) Audit logs must be on for every system component in the cardholder data environment and must capture specific events: every access to cardholder data, every action by an administrator, every access to the logs themselves, failed login attempts, changes to accounts and credentials, logs being started, stopped or paused, and system-level objects being created or deleted. Each entry has to record who, what, when, where and the outcome. Protect the logs (10.3) Only people with a job-related need can read the logs, nobody can alter them, they are backed up promptly to a central log server, and file integrity monitoring or change detection alerts if existing log data is changed. Review them every day (10.4) Security events, logs from systems that store, process or transmit cardholder data, logs from critical systems and from systems that perform security functions must be reviewed at least once a day. Since 31 March 2025 that review must use automated mechanisms (10.4.1.1). Anything unusual has to be followed up and resolved, not just noted. Keep a year of history (10.5) At least 12 months of audit log history, with at least the most recent three months immediately available for analysis. Keep the clocks right (10.6) Every system uses synchronized time from a reliable source so events can be lined up across systems during an investigation. Notice when a control fails (10.7) Failures of critical security controls, including firewalls, intrusion detection, anti-malware, access controls, the logging itself and the log review process, must be detected, alerted on and dealt with promptly. As of 31 March 2025 this applies to all entities, not only service providers. Requirement 11.5 comes along with it Requirement 10 is about seeing what happened. Requirement 11.5 is about catching intrusions and unauthorized changes as they happen. Assessors look at the two together, and the same platform usually covers both. Intrusion detection and prevention (11.5.1) Intrusion detection or prevention techniques must watch all traffic at the perimeter of the cardholder data environment and at critical points inside it, alert on suspected compromises, and be kept current. Change detection (11.5.2) A change-detection mechanism such as file integrity monitoring must alert on unauthorized changes to critical system files, configuration files and content files, with comparisons at least weekly. Which SAQs include Requirement 10 Not every self-assessment questionnaire includes the full requirement. The table is a guide; confirm your SAQ with our PCI SAQ Finder. WHO YOU ARE SAQ REQUIREMENT 10 AND 11.5 SCOPE Merchant with all card data handled by a validated third party, website redirects or iframes SAQ A Minimal; logging requirements largely fall on your provider E-commerce merchant whose website affects the payment page SAQ A-EP Partial; logging, log review and retention for the systems that touch the payment page Merchant with a payment application connected to the internet SAQ C Partial; logging and review for the in-scope payment systems Merchant that does not fit a shorter SAQ, or any service provider SAQ D Full Requirement 10 and 11.5 Any organization assessed by a QSA for a Report on Compliance ROC Full Requirement 10 and 11.5 How Managed SOC + SIEM covers it We sell one service, Managed SOC + SIEM. Here is how it maps to the requirement, line by line. Logging (10.2) The SIEM collects logs from your in-scope systems, including syslog from network devices, agents on servers and workstations, and API connections to your cloud, identity and security tools, into one place with every event stamped with who, what, when and where. Protection (10.3) Logs are stored centrally on your SIEM, hosted in our data centers in Philadelphia, Athens or Limassol, or deployed in your own environment, encrypted in transit and protected from modification. Daily and automated review (10.4) Detection rules check your logs continuously, which satisfies the automated review mechanism the standard now requires, and Clone Systems analysts in the United States and the EU work the incident queue 24/7, so exceptions are investigated and resolved rather than filed. Retention (10.5) Retention is set to meet the 12 months of history and three months immediately available that PCI DSS requires, and can be set longer if another framework needs it. Control failure detection (10.7) A quiet-source rule set for each monitored control raises an alert when it stops reporting, and a log source health report lists anything that has gone silent, so the SOC knows when a control fails. Intrusion detection (11.5.1) Inline intrusion prevention is available as a managed service alongside the SOC, with alerts correlated in the same SIEM. Change detection (11.5.2) File changes on monitored endpoints flow into the SIEM, so unauthorized changes to critical files are alerted on and investigated. Evidence for your assessor Scheduled reports aligned to PCI DSS, delivered as PDF or Excel, give your QSA or your SAQ the review evidence, retention evidence and incident history in one place. How to decide You are on SAQ A. You probably do not need this page. Keep your quarterly ASV scans current. You are on SAQ A-EP or SAQ C and someone reviews logs by hand. Since March 2025 the review has to be automated. Managed SOC + SIEM covers it, and the 50 endpoint minimum is the thing to check first. You are on SAQ D or going through a ROC. Requirement 10 and 11.5 apply in full. This is the service built for you. You are a service provider. You also carry the control-failure detection requirement, which the SOC handles as part of normal monitoring. Your logs cannot leave your environment. Self-host the SIEM with us managing it. The analysts and the AI work the same way. What it costs, in structure Managed SOC + SIEM is priced per monitored endpoint with a 50 endpoint minimum, on a one-year term with multi-year available. The SIEM, the analysts and the private AI are included. It is sold directly through a scoping call and demo, not online. MANAGED SOC + SIEM Hand Requirement 10 to a team that does it every day. Tell us your SAQ, your endpoint count and where your logs need to live, and we will tell you plainly what is covered and what is not. Schedule a Demo Scope your environment RELATED PAGES More on Managed SOC + SIEM. Managed SOC + SIEM The service: analysts 24/7, the SIEM and private AI, sold together. Learn more about Managed SOC + SIEM PCI SAQ Finder Answer a few questions and find out which SAQ applies to you. Learn more about PCI SAQ Finder PCI Compliance Scanning Quarterly ASV scans for Requirement 11.3, available online. Learn more about PCI Compliance Scanning Website (leave blank) TALK TO OUR SOC TEAM Scope Managed SOC + SIEM for your PCI environment. Tell us your SAQ, your endpoint count and where you want the SIEM hosted. A specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. FAQ PCI DSS Requirement 10 questions, answered. Does PCI DSS require a SIEM? Not by name. It requires logging, protection, daily automated review, 12-month retention and failure detection. A SIEM with people watching it is the practical way most organizations meet all of those at once. How long do PCI logs have to be kept? At least 12 months, with the most recent three months immediately available for analysis (Requirement 10.5.1). Do we have to review logs every day? Yes, for security events and for logs from in-scope and critical systems, and since 31 March 2025 the review must use automated mechanisms. Other logs are reviewed on a schedule set by your targeted risk analysis. Does Requirement 10 apply to my SAQ? In full for SAQ D and any Report on Compliance; in part for SAQ A-EP and SAQ C; barely at all for SAQ A. Use our SAQ Finder to confirm which one you are on. Can you cover Requirement 10 if our logs cannot leave our environment? Yes. The SIEM can be deployed in your environment, with our analysts and AI working in it the same way as in our data centers. Does this replace our quarterly ASV scans? No. ASV scans satisfy Requirement 11.3.2. Managed SOC + SIEM covers Requirements 10 and 11.5. Most PCI customers need both, and Clone Systems provides both. --- ## Arctic Wolf vs Clone Systems (2026): Managed SOC and SIEM Compared URL: https://www.clone-systems.com/arctic-wolf-vs-clonesystems HOME PLATFORM COMPARISON ARCTIC WOLF VS CLONE SYSTEMS Arctic Wolf vs Clone Systems Enterprise MDR with a concierge team, compared with a managed SOC that includes the SIEM and lets you choose where your data lives. Arctic Wolf is a managed detection and response provider founded in 2012 and headquartered in Eden Prairie, Minnesota. It sells its Aurora Platform with a Security Operations Center and a named Concierge Security Team, and by its own count has more than 600 security engineers supporting its SOC. Clone Systems is an independent security firm operating since 1998 and a PCI Approved Scanning Vendor since 2007; its Managed SOC + SIEM pairs analysts in the United States and the EU with a SIEM that is included in the service and a private AI that is Clone Systems' own private, self-hosted AI. The two overlap on 24/7 monitoring and response but differ in scale, pricing model, and where your logs are kept. This page relies only on what each company publishes. In short: Arctic Wolf for enterprises that want a broad portfolio from one large vendor; Clone Systems for mid-sized teams that want the SIEM included, control over where their logs live, and AI that is Clone Systems' own private, self-hosted AI. Where Arctic Wolf is strong Arctic Wolf is built for organizations that want a large, established provider with a wide portfolio. Its Aurora Platform is described as open XDR that enriches events with threat intelligence and risk context, and its SOC is supported by a large engineering team working 24x7. The Concierge Security Team gives each customer named contacts who guide posture hardening over time. Beyond MDR it sells Managed Risk (vulnerability management), Managed Security Awareness, Incident Response (including remote remediation and ransomware negotiation), and Aurora Endpoint Security, which came from its December 2024 acquisition of Cylance from BlackBerry. It is a category leader for enterprises that want one vendor for monitoring, endpoint protection, risk and incident response, and that buy through a sales process and procurement. Where Clone Systems is different The SIEM is included, and it is one service. Managed SOC + SIEM always comes with the SIEM, the analysts and the private AI together. There is no separate platform license and nothing to assemble. Arctic Wolf's services are sold as a portfolio (MDR, Managed Risk, endpoint, awareness, IR) that you scope with its sales team. You choose where your logs live. Host the SIEM in Clone Systems' data centers in Philadelphia, Athens or Limassol, with EU customers hosted in Athens, or deploy it in your own environment so your logs never leave it. Arctic Wolf's published materials describe a cloud-delivered platform; we found no self-hosted option on its site. Private AI, no outside AI service. The AI that helps investigate your incidents is Clone Systems' own private, self-hosted AI. Your logs and alerts are never sent to OpenAI, Anthropic or any outside AI provider, and every AI action is previewed and approved by a person before it runs. Arctic Wolf describes AI-driven enrichment on the Aurora Platform; its site does not say where that AI runs or whether third-party AI services are involved. A pricing model you can read before the call. Clone Systems prices per monitored endpoint with a 50 endpoint minimum on a one-year term, and says so on its site. Arctic Wolf does not publish pricing on its website; the only public figure is an AWS Marketplace listing for MDR Basic covering up to 100 users on a 12-month term. PCI ASV and penetration testing from the same company. Clone Systems has been on the PCI Council's ASV list since 2007 and sells scanning and automated penetration testing online, so one vendor covers monitoring, scanning and testing. Arctic Wolf offers Managed Risk for vulnerability management; we found no PCI ASV claim on its site. Feature comparison Capability Clone Systems Arctic Wolf 24/7 monitoring by analysts Yes, United States and EU Yes, 24x7 SOC SIEM included in the service Yes, not sold separately Platform is Arctic Wolf's own; no separate SIEM to buy Self-hosted option for the SIEM Yes, in your environment Not found on its site EU data residency Yes, EU customers hosted in Athens Not stated on its site AI-assisted investigation Yes, private, self-hosted, human approved Yes, Aurora Platform enrichment Named concierge contact Specialist access during onboarding and investigations Yes, Concierge Security Team Endpoint protection product Works with your existing endpoint tool Yes, Aurora Endpoint Security Vulnerability scanning Yes, PCI ASV and vulnerability scanning, bought online Yes, Managed Risk Penetration testing Yes, automated and engineer-led Not found on its site Incident response and ransomware negotiation Containment from the console once approved; IR scoped on request Yes, dedicated IR service Published pricing model Yes, per endpoint, 50 minimum, one-year term AWS Marketplace listing only Minimum size 50 endpoints 100 users (AWS Marketplace MDR Basic) PCI Approved Scanning Vendor Yes, since 2007 Not found How each is priced, side by side Clone Systems Arctic Wolf Pricing unit Per monitored endpoint Per user at entry level (AWS Marketplace) Minimum 50 endpoints Up to 100 users on MDR Basic Term One year, multi-year available 12, 24 or 36 months listed What is included Analysts, SIEM, private AI, reports MDR; other services sold separately Published price Model published; quote after a scoping call $44,000 per 12 months for MDR Basic (AWS Marketplace); custom pricing by private offer How to buy Scoping call and demo Sales process and demo, or AWS Marketplace Checked 21 October 2026. Arctic Wolf's figure comes from its AWS Marketplace listing, which is the only public price we found; its website does not publish pricing. Clone Systems quotes each environment after a scoping call. Because the two count scope differently (users versus endpoints), the table compares purchasing models rather than matched sizes. Who should choose which Arctic Wolf suits larger organizations that want one established vendor across MDR, endpoint protection, risk, awareness training and incident response, have a security function to work with a concierge team, and buy through procurement. Clone Systems suits mid-sized organizations that want the whole SIEM included with people watching it, need to control where their logs live (including inside their own environment or inside the EU), care that AI never sends their data to an outside service, or already buy PCI scanning or penetration testing and want monitoring from the same company. If you are replacing or evaluating an MDR Ask any provider three questions: where do my logs physically live, which AI services touch my data, and what is included in the price versus sold on top. Arctic Wolf's answers depend on the services you scope with its team. Clone Systems' answers are on its site: in our data centers or yours, our own private AI only, and the SIEM, analysts and AI together in one per-endpoint price. Our SIEM vs SOC vs EDR vs MDR vs XDR guide explains the terms if the acronyms are getting in the way. Frequently asked questions How much does Arctic Wolf cost? Arctic Wolf does not publish pricing on its website. Its AWS Marketplace listing shows MDR Basic at $44,000 per 12 months for up to 100 users, with custom pricing by private offer. Clone Systems publishes its model, per endpoint with a 50 endpoint minimum on a one-year term, and quotes after a scoping call. Does Arctic Wolf include a SIEM? Arctic Wolf delivers monitoring on its own Aurora Platform, so you are not buying a separate SIEM. Clone Systems includes its SIEM in Managed SOC + SIEM and does not sell it on its own. Can I self-host with Arctic Wolf? We found no self-hosted option on its site. Clone Systems can host your SIEM in its data centers or deploy it in your environment. Is Arctic Wolf a PCI Approved Scanning Vendor? We found no ASV claim on its site. Clone Systems has been an ASV since 2007 and sells the ASV scan online. Who is each one for? Arctic Wolf for enterprises that want a broad portfolio and a concierge team from one large provider. Clone Systems for organizations that want the SIEM included, control over data location, private AI, and scanning and testing from the same company. SCHEDULE A DEMO TALK TO A SPECIALIST Product details are taken from Arctic Wolf's public website, Wikipedia and its AWS Marketplace listing, checked October 21, 2026. Arctic Wolf and Aurora are trademarks of Arctic Wolf Networks. Clone Systems is not affiliated with Arctic Wolf. Spotted something out of date? Tell us and we will update it. See also: Huntress vs Clone Systems, SIEM vs SOC vs EDR vs MDR vs XDR guide, Managed SOC + SIEM, Blumira vs Clone Systems, Sophos MDR vs Clone Systems --- ## Huntress vs Clone Systems (2026): Managed SOC and SIEM Compared URL: https://www.clone-systems.com/huntress-vs-clonesystems HOME PLATFORM COMPARISON HUNTRESS VS CLONE SYSTEMS Huntress vs Clone Systems Per-product managed security you assemble, compared with one managed SOC that includes the SIEM. Huntress is a managed security company founded in 2015 by former NSA operators and headquartered in Columbia, Maryland. It sells a set of separately priced managed products, Managed EDR, Managed ITDR, Managed SIEM, Managed ISPM and Security Awareness Training, each backed by its 24/7 SOC, and it publishes list prices on its website. Clone Systems is an independent security firm operating since 1998 and a PCI Approved Scanning Vendor since 2007; its Managed SOC + SIEM is one service that pairs analysts in the United States and the EU with a SIEM that is included and a private AI that is Clone Systems' own private, self-hosted AI. The two overlap on 24/7 human monitoring but differ in how the service is packaged, who it is built for, and where your data can live. This page relies only on what each company publishes. In short: Huntress for small businesses and MSPs that want endpoint and Microsoft 365 coverage at a published monthly price; Clone Systems for teams with 50 or more endpoints that want a full SIEM and analysts as one service, control over where their logs live, and AI that is Clone Systems' own private, self-hosted AI. Where Huntress is strong Huntress is built for small and mid-sized businesses and the managed service providers who serve them. Its pricing is public and per unit, with each product bought separately and a free, fully featured trial on offer. Managed EDR comes with managed antivirus at no extra charge, Managed ITDR watches Microsoft 365 and Google Workspace identities for session hijacking and policy changes, and Managed SIEM is priced per data source with pooled storage. Everything is cloud-delivered and backed by a 24/7 SOC that Huntress describes as AI-assisted human experts, included at no additional cost. It sells primarily through MSPs and resellers, with direct purchase available at a 50 seat minimum per product. For a small business that wants endpoint and Microsoft 365 coverage quickly at a known monthly price, it is one of the clearest offers on the market. Where Clone Systems is different One service, not a cart of products. Managed SOC + SIEM always includes the SIEM, the analysts and the private AI together, priced per endpoint. With Huntress you choose and pay for each product separately: EDR per endpoint, ITDR per identity, SIEM per data source, each with its own 50 unit minimum when bought direct. The SIEM is the center, not an add-on. Clone Systems' service is built around a full SIEM that collects logs from your network, servers, cloud, identity and security tools into one console, with analysts working the incident queue 24/7. Huntress's Managed SIEM is one product in its line-up, priced per data source alongside its endpoint-led products. You choose where your logs live. Host the SIEM in Clone Systems' data centers in Philadelphia, Athens or Limassol, with EU customers hosted in Athens, or deploy it in your own environment so your logs never leave it. Huntress is cloud-delivered; its site does not describe a self-hosted option or state where its SOC or data are located. Private AI with a person in the loop. Clone Systems' AI is its own private, self-hosted AI; your logs and alerts are never sent to OpenAI, Anthropic or any outside AI provider, and every AI action is approved by a person before it runs. Huntress describes its SOC as AI-assisted; its site does not say where that AI runs or which services it uses. PCI ASV and penetration testing from the same company. Clone Systems has been on the PCI Council's ASV list since 2007 and sells scanning and automated penetration testing online. Huntress does not offer vulnerability scanning or penetration testing; we found no ASV claim on its site. Feature comparison Capability Clone Systems Huntress 24/7 monitoring by analysts Yes, United States and EU Yes, 24/7 SOC, location not stated SIEM included in the service Yes, not sold separately Managed SIEM sold separately, per data source Self-hosted option for the SIEM Yes, in your environment Not found on its site EU data residency Yes, EU customers hosted in Athens Not stated on its site AI-assisted investigation Yes, private, self-hosted, human approved Yes, AI-assisted SOC Endpoint detection product Works with your existing endpoint tool Yes, Managed EDR with managed antivirus Microsoft 365 identity monitoring Yes, identity sources feed the SIEM Yes, Managed ITDR and ISPM Security awareness training Not offered Yes, Managed SAT Vulnerability scanning Yes, PCI ASV and vulnerability scanning, bought online Not offered Penetration testing Yes, automated and engineer-led Not offered Published pricing Model published; quote after a scoping call Yes, list prices per product Free trial No; scoping call and demo Yes Minimum size 50 endpoints 50 seats per product when bought direct Sold through Direct MSPs and resellers first; direct available PCI Approved Scanning Vendor Yes, since 2007 Not found How each is priced, side by side Clone Systems Huntress Pricing unit Per monitored endpoint, everything included Per endpoint (EDR), per identity (ITDR, ISPM), per data source (SIEM), per learner (SAT) Minimum 50 endpoints 50 seats per product (direct) Term One year, multi-year available Not stated on its pricing page What is included Analysts, SIEM, private AI, reports 24/7 SOC with each product; products bought separately Published price Model published; quote after a scoping call Managed EDR $8.99 per endpoint per month list ($7.99 at 100); Managed ITDR $4.80 list ($3.60 at 100); Managed SIEM $4.00 per data source list ($3.50 at 100); Managed SAT $2.08 per learner list ($1.75 at 100); Managed ISPM $4.00 list ($3.40 at 100) How to buy Scoping call and demo Through an MSP or reseller, direct, or Azure Marketplace; free trial Checked 21 October 2026. Huntress's figures are the list prices and 100 unit examples on its own pricing page; it says per unit rates fall with volume but does not publish the tiers. Clone Systems quotes each environment after a scoping call. Because Huntress prices each product separately, a like-for-like total depends on how many products you combine; the table compares purchasing models rather than matched sizes. Who should choose which Huntress suits small businesses and MSPs that want endpoint and Microsoft 365 coverage at a published monthly price, are comfortable assembling products as needed, and do not need a full SIEM, self-hosting or EU data residency. Clone Systems suits organizations with 50 or more endpoints that want a full SIEM with analysts watching it as one service, need to control where their logs live, care that AI never sends their data to an outside service, or already buy PCI scanning or penetration testing and want monitoring from the same company. If you have outgrown an endpoint-first service Endpoint-led monitoring is a good start, and many Clone Systems customers keep the endpoint tool they already run. What changes as you grow is the need to see the endpoint together with your network, cloud, identity and email in one place, to keep logs for an auditor, and to answer where that data physically lives. That is what a managed SIEM adds. Our SIEM vs SOC vs EDR vs MDR vs XDR guide explains the difference without the jargon. Frequently asked questions How much does Huntress cost? Huntress publishes list prices per product: Managed EDR from $8.99 per endpoint per month, Managed ITDR from $4.80 per identity, Managed SIEM from $4.00 per data source, with lower rates at volume. Clone Systems publishes its model, per endpoint with a 50 endpoint minimum on a one-year term, and quotes after a scoping call. Does Huntress include a SIEM? Managed SIEM is a separate Huntress product, priced per data source. Clone Systems includes its SIEM in Managed SOC + SIEM and does not sell it on its own. Can I self-host with Huntress? We found no self-hosted option on its site. Clone Systems can host your SIEM in its data centers or deploy it in your environment. Is Huntress a PCI Approved Scanning Vendor? We found no ASV claim on its site, and it does not sell vulnerability scanning or penetration testing. Clone Systems has been an ASV since 2007 and sells the ASV scan online. Can Clone Systems work with the endpoint tool I already have? Yes. Managed SOC + SIEM pulls in alerts from the endpoint tool you already run and correlates them with everything else, so you keep what you have. Who is each one for? Huntress for small businesses and MSPs that want per-product managed security at a published price. Clone Systems for organizations that want the SIEM included, control over data location, private AI, and scanning and testing from the same company. SCHEDULE A DEMO TALK TO A SPECIALIST Prices and product details are taken from Huntress's public website and Wikipedia, checked October 21, 2026. Huntress is a trademark of Huntress Labs. Clone Systems is not affiliated with Huntress. Spotted something out of date? Tell us and we will update it. See also: Arctic Wolf vs Clone Systems, SIEM vs SOC vs EDR vs MDR vs XDR guide, Managed SOC + SIEM, Blumira vs Clone Systems, Sophos MDR vs Clone Systems --- ## Blumira vs Clone Systems (2026): Managed SIEM Compared URL: https://www.clone-systems.com/blumira-vs-clonesystems HOME PLATFORM COMPARISON BLUMIRA VS CLONE SYSTEMS Blumira vs Clone Systems A cloud SIEM you run with Blumira's support team behind you, compared with a SIEM that Clone Systems' analysts run for you. Blumira is a cloud SIEM and XDR company founded in 2018 and headquartered in Ann Arbor, Michigan. It sells three editions priced per employee, Detect, Respond and Automate, with unlimited log ingestion, one year of retention and a support team whose hours and incident coverage grow with the edition. Clone Systems is an independent security firm operating since 1998 and a PCI Approved Scanning Vendor since 2007; its Managed SOC + SIEM is one service in which Clone Systems' own analysts in the United States and the EU work every incident 24/7, with the SIEM included and a private AI that is Clone Systems' own private, self-hosted AI. Both put a SIEM at the center. The difference is who operates it. This page relies only on what each company publishes. In short: Blumira for IT teams that want to run their own cloud SIEM with a vendor support team behind them; Clone Systems for teams with 50 or more endpoints that want someone else to run the SIEM and work every incident around the clock. Where Blumira is strong Blumira is built for lean IT teams that want a SIEM they can stand up quickly and operate themselves, with Blumira's team as backup. Pricing is public and per employee, every edition includes unlimited data ingestion and a year of retention, and a 30-day trial of the top edition is offered. The Respond and Automate editions add the Blumira Agent for endpoint visibility, host isolation, user lockout, honeypots and 24/7 incident support, and Automate layers on AI analysis and automated blocklists and isolation. Blumira publishes fast support numbers, an average of 26 minutes for all requests and 18 minutes for critical incidents on the higher editions, and sells through its website, sales team and MSP partners. For an IT team that wants to own its SIEM day to day at a predictable monthly price, it is a strong, transparent option. Where Clone Systems is different Analysts work every incident, on every plan. Managed SOC + SIEM is fully managed: Clone Systems' analysts in the United States and the EU investigate, attach the evidence and recommend the response around the clock. Blumira's lower edition includes concierge support during US business hours only; 24/7 incident support starts at its Respond edition, and your team still operates the platform. Per endpoint, everything included. One per-endpoint price covers the SIEM, the analysts, the private AI and the reports. Blumira is priced per employee by edition, with onboarding fees and extra agents priced separately. You choose where your logs live. Host the SIEM in Clone Systems' data centers in Philadelphia, Athens or Limassol, with EU customers hosted in Athens, or deploy it in your own environment so your logs never leave it. Blumira is a cloud SIEM; its pricing page does not describe a self-hosted option or state where data is hosted. Private AI with a person in the loop. Clone Systems' AI is its own private, self-hosted AI; your logs and alerts are never sent to OpenAI, Anthropic or any outside AI provider, and every AI action is approved by a person before it runs. Blumira's Automate edition includes AI analysis and automated response; its site does not say where that AI runs. PCI ASV and penetration testing from the same company. Clone Systems has been on the PCI Council's ASV list since 2007 and sells scanning and automated penetration testing online. Blumira offers compliance reporting inside the SIEM; we found no ASV claim and no scanning or testing products on its site. Feature comparison Capability Clone Systems Blumira Who operates the SIEM Clone Systems analysts, fully managed Your team, with Blumira support 24/7 incident support Yes, every customer Respond and Automate editions only Analysts in the US and EU Yes Support team hours 9am to 8pm ET on Detect; 24/7 incident support on higher editions Self-hosted option for the SIEM Yes, in your environment Not found on its site EU data residency Yes, EU customers hosted in Athens Not stated on its site AI-assisted investigation Yes, private, self-hosted, human approved Yes, on the Automate edition Endpoint agent and isolation Works with your existing endpoint tool; isolation through it once approved Blumira Agent on Respond and Automate; manual or automated isolation Log ingestion and retention Included; retention set to your framework Unlimited ingestion, one year retention, all editions Compliance reporting Yes, scheduled reports for your auditor Yes, all editions Vulnerability scanning Yes, PCI ASV and vulnerability scanning, bought online Not offered Penetration testing Yes, automated and engineer-led Not offered Published pricing Model published; quote after a scoping call Yes, per employee by edition Free trial No; scoping call and demo 30-day trial of Automate Minimum size 50 endpoints Not stated PCI Approved Scanning Vendor Yes, since 2007 Not found How each is priced, side by side Clone Systems Blumira Pricing unit Per monitored endpoint, everything included Per employee, by edition Minimum 50 endpoints Not stated Term One year, multi-year available Annual, multi-year available What is included Analysts 24/7, SIEM, private AI, reports SIEM and support level by edition; agent on higher editions Published price Model published; quote after a scoping call Detect $12 per employee per month plus $250 onboarding; Respond $16 plus $500 onboarding; Automate $21 with onboarding included; extra agents $3 per agent per month How to buy Scoping call and demo Website trial or demo request, sales for custom quotes, MSP pricing separately Checked 21 October 2026. Blumira's figures are the list prices on its own pricing page; it offers volume, nonprofit, government and education discounts on request. Clone Systems quotes each environment after a scoping call. Because the two count scope differently (employees versus endpoints) and Blumira's support level depends on edition, the table compares purchasing models rather than matched sizes. Who should choose which Blumira suits IT teams that want to run their own cloud SIEM with a vendor support team behind them, at a published per-employee price, and are comfortable with business-hours support on the entry edition. Clone Systems suits organizations with 50 or more endpoints that want someone else to run the SIEM and work the incidents around the clock, need to control where their logs live, care that AI never sends their data to an outside service, or already buy PCI scanning or penetration testing and want monitoring from the same company. If the question is who watches the screen A SIEM is only as good as the person looking at it at 2am. With Blumira, that is your team, backed by Blumira's support team according to your edition. With Clone Systems, it is Clone Systems' analysts, every hour, for every customer, with the evidence attached when they escalate to you. Our SIEM vs SOC vs EDR vs MDR vs XDR guide explains why that distinction matters more than the feature list. Frequently asked questions How much does Blumira cost? Blumira publishes list prices per employee per month: Detect $12, Respond $16 and Automate $21, with one-time onboarding fees on the lower two editions and extra agents at $3 per month. Clone Systems publishes its model, per endpoint with a 50 endpoint minimum on a one-year term, and quotes after a scoping call. Is Blumira a managed SOC? Blumira is a SIEM your team operates, with Blumira's support team behind you; 24/7 incident support is included on its Respond and Automate editions. Clone Systems' Managed SOC + SIEM is operated by Clone Systems' analysts for every customer. Can I self-host with Blumira? We found no self-hosted option on its site. Clone Systems can host your SIEM in its data centers or deploy it in your environment. Is Blumira a PCI Approved Scanning Vendor? We found no ASV claim on its site, and it does not sell vulnerability scanning or penetration testing. Clone Systems has been an ASV since 2007 and sells the ASV scan online. Who is each one for? Blumira for IT teams that want to own their SIEM at a published price. Clone Systems for organizations that want the SIEM run for them, control over data location, private AI, and scanning and testing from the same company. SCHEDULE A DEMO TALK TO A SPECIALIST Prices and product details are taken from Blumira's public website, checked October 21, 2026. Blumira is a trademark of Blumira, Inc. Clone Systems is not affiliated with Blumira. Spotted something out of date? Tell us and we will update it. See also: Arctic Wolf vs Clone Systems, Huntress vs Clone Systems, SIEM vs SOC vs EDR vs MDR vs XDR guide, Sophos MDR vs Clone Systems --- ## Sophos MDR vs Clone Systems (2026): Managed SOC and SIEM Compared URL: https://www.clone-systems.com/sophos-mdr-vs-clonesystems HOME PLATFORM COMPARISON SOPHOS MDR VS CLONE SYSTEMS Sophos MDR vs Clone Systems A global, endpoint-led MDR with a breach warranty, compared with a managed SOC built around a SIEM you can host where you choose. Sophos is a security vendor founded in 1985 and headquartered in Abingdon, England. Its Managed Detection and Response service comes in two tiers, Sophos MDR and Sophos MDR Plus, delivered 24/7/365 from what Sophos describes as nine regional hubs, usually bundled with Sophos's own endpoint protection and sold through partners and MSPs. Clone Systems is an independent security firm operating since 1998 and a PCI Approved Scanning Vendor since 2007; its Managed SOC + SIEM is one service in which analysts in the United States and the EU work every incident, with a full SIEM included and a private AI that is Clone Systems' own private, self-hosted AI. Both offer 24/7 human-led detection and response. They differ in what sits at the center (the endpoint versus the SIEM), where your data lives, and how you buy. This page relies only on what each company publishes. In short: Sophos MDR for organizations that already run Sophos and want a large global provider with a breach warranty; Clone Systems for teams with 50 or more endpoints that want a full SIEM run for them, control over where their logs live, and a person approving every AI action. Where Sophos MDR is strong Sophos MDR is one of the largest managed detection services in the market; Sophos reports more than 625,000 defended organizations across its products. The service follows the sun across nine regional hubs, includes unlimited threat response with no hourly caps, and comes with Sophos Endpoint or works with the endpoint protection you already run. Sophos publishes more than 500 integrations with security and IT tools at no extra cost, including Microsoft Defender, and reports an average of 89 seconds from alert to automated response. MDR Plus adds Sophos Endpoint deployed across your environment, a named Incident Response Advisor, full threat neutralization and a $1M breach protection warranty for qualifying customers. It is sold through Sophos partners and MSPs on a custom proposal. For an organization that already runs Sophos or wants a very large global provider behind its endpoints, it is a natural choice. Where Clone Systems is different The SIEM is the service, not an add-on to the endpoint. Managed SOC + SIEM is built around a full SIEM that pulls logs from your network, servers, cloud, identity and security tools into one console, with the SIEM included and never sold on its own. Sophos MDR is delivered on the Sophos platform and is strongest when Sophos Endpoint is deployed; it is an endpoint-led service with integrations around it. You choose where your logs live. Host the SIEM in Clone Systems' data centers in Philadelphia, Athens or Limassol, with EU customers hosted in Athens, or deploy it in your own environment so your logs never leave it. Sophos MDR is cloud-delivered through Sophos Central; its brochure does not describe a self-hosted option or state data residency. Private AI, no outside AI service, and a person on every action. Clone Systems' AI is its own private, self-hosted AI; your logs and alerts are never sent to OpenAI, Anthropic or any outside AI provider, and every AI action is previewed and approved by a person before it runs. Sophos reports that 52% of its cases are resolved end to end by AI with no human intervention; its brochure does not say where that AI runs. A pricing model you can read before the call, and you buy direct. Clone Systems prices per monitored endpoint with a 50 endpoint minimum on a one-year term and says so on its site, and you deal with Clone Systems directly. Sophos does not publish MDR pricing; you request a custom proposal, usually through a partner. PCI ASV and penetration testing from the same company. Clone Systems has been on the PCI Council's ASV list since 2007 and sells scanning and automated penetration testing online. Sophos sells endpoint, firewall and email products; we found no PCI ASV claim on its site. Feature comparison Capability Clone Systems Sophos MDR 24/7 monitoring by analysts Yes, United States and EU Yes, follow the sun across nine regional hubs SIEM included in the service Yes, not sold separately Delivered on the Sophos platform; no separate SIEM to buy Self-hosted option Yes, in your environment Not found in its brochure EU data residency Yes, EU customers hosted in Athens Not stated AI-assisted investigation Yes, private, self-hosted, human approved Yes, with a majority of cases resolved by AI Endpoint protection product Works with your existing endpoint tool Yes, Sophos Endpoint included or bring your own Named incident response advisor Specialist access during investigations Yes, on MDR Plus Breach protection warranty Not offered $1M on MDR Plus for qualifying customers Vulnerability scanning Yes, PCI ASV and vulnerability scanning, bought online Not part of MDR Penetration testing Yes, automated and engineer-led Not offered Published pricing model Yes, per endpoint, 50 minimum, one-year term No; custom proposal Sold through Direct Partners and MSPs Minimum size 50 endpoints Not stated PCI Approved Scanning Vendor Yes, since 2007 Not found How each is priced, side by side Clone Systems Sophos MDR Pricing unit Per monitored endpoint, everything included Not published; proposal based Minimum 50 endpoints Not stated Term One year, multi-year available Not stated What is included Analysts 24/7, SIEM, private AI, reports MDR: 24/7 detection and response, unlimited response, integrations; MDR Plus adds endpoint deployment, IR advisor, warranty Published price Model published; quote after a scoping call None published How to buy Scoping call and demo, direct Custom service proposal, usually through a Sophos partner or MSP Checked 21 October 2026. Sophos does not publish MDR pricing on its website or brochure; the only published dollar figure is the $1M breach protection warranty on MDR Plus. Clone Systems quotes each environment after a scoping call. The table compares purchasing models, not prices. Who should choose which Sophos MDR suits organizations that already run Sophos, want a very large global provider with a breach warranty behind their endpoints, and buy through a partner or MSP on a proposal. Clone Systems suits organizations with 50 or more endpoints that want a full SIEM run for them as one service, need to control where their logs live, want a person approving every AI action, prefer to buy direct on a model they can read first, or already buy PCI scanning or penetration testing and want monitoring from the same company. If you are weighing an MDR against a managed SIEM An MDR watches what its platform can see, which is excellent when the platform is on every endpoint. A managed SIEM starts from your logs, whatever produced them, and adds the people. If your auditor asks where your log data is, which AI services touched it, and who approved a containment action, Clone Systems answers from its site: in our data centers or yours, our own private AI, and a named person every time. Our SIEM vs SOC vs EDR vs MDR vs XDR guide covers the terms. Frequently asked questions How much does Sophos MDR cost? Sophos does not publish MDR pricing; it provides a custom service proposal, usually through a partner. Clone Systems publishes its model, per endpoint with a 50 endpoint minimum on a one-year term, and quotes after a scoping call. Does Sophos MDR include a SIEM? Sophos MDR is delivered on Sophos's own platform, so you are not buying a separate SIEM. Clone Systems includes a full SIEM in Managed SOC + SIEM and does not sell it on its own. Can I self-host with Sophos MDR? We found no self-hosted option in its brochure. Clone Systems can host your SIEM in its data centers or deploy it in your environment. Do I have to use Sophos Endpoint? Sophos says MDR works with non-Sophos endpoint protection, while MDR Plus deploys Sophos Endpoint across your environment. Clone Systems works with the endpoint tool you already run. Is Sophos a PCI Approved Scanning Vendor? We found no ASV claim on its site. Clone Systems has been an ASV since 2007 and sells the ASV scan online. Who is each one for? Sophos MDR for organizations that want a large global endpoint-led service with a warranty, bought through a partner. Clone Systems for organizations that want the SIEM included and run for them, control over data location, private AI, and scanning and testing from the same company. SCHEDULE A DEMO TALK TO A SPECIALIST Product details are taken from Sophos's public website and its Managed Detection and Response brochure, checked October 21, 2026. Sophos is a trademark of Sophos Limited. Clone Systems is not affiliated with Sophos. Spotted something out of date? Tell us and we will update it. See also: Arctic Wolf vs Clone Systems, Huntress vs Clone Systems, Blumira vs Clone Systems --- ## PCI ASV Scan from an Approved Scanning Vendor Since 2007 URL: https://www.clone-systems.com/pci-asv-scan-external-vulnerability-scanning HOME PCI ASV SCANNING PCI ASV Scan from a PCI Approved Scanning Vendor Our PCI ASV scanning service provides an external vulnerability scan of your internet-facing systems, run at least every 90 days by a PCI SSC Approved Scanning Vendor, to meet PCI DSS 4.0.1 Requirement 11.3.2. Clone Systems has been a listed ASV since 2007. Verify us on the PCI Security Standards Council ASV list. Purchase Online Speak with our team PCI ASV Approved Scanning Vendor Since 2007 PCI SSC listed 45M+ Vulnerability checks daily 24/7 Real engineers, always on PCI ASV SCANNING PORTAL Everything you need for PCI ASV scanning and quarterly compliance. External vulnerability scanning, unlimited re-scans, SAQ support, exception handling, and compliance reporting in one secure portal, single-tenant or multi-tenant based on your scenario. Instant Scan Launch Start scans immediately with no install or download required. Schedule for Later Set it and forget it. Schedule scans to run automatically at your preferred time. Unlimited Re-Scans Verify fixes at no extra cost until you achieve a passing scan. AoSC After Passing Scan Receive your Attestation of Scan Compliance after a passing quarterly ASV scan. Complementary SAQ Module Support your broader PCI compliance workflow from the same portal. 24-Hour Exception Review Submit exceptions in-portal and keep approved exceptions tied to future scans. HOW PCI ASV SCANNING WORKS How to run a quarterly PCI ASV scan online in five steps. No software to download, no complex setup. Launch instant or scheduled scans and move through remediation with unlimited re-scans. 01 Access Your Secure Portal Log in to your web portal, offered in single-tenant or multi-tenant deployments based on your scenario, and get started right away with no download required. 02 Choose Instant or Scheduled Run a scan immediately or set up automated recurring scans for your preferred frequency. 03 Add the Assets You Need to Scan Enter the public-facing systems relevant to your PCI ASV scanning scope. 04 Review Results and Exceptions View findings in one place, submit exceptions for 24-hour review, and move into remediation. 05 Re-Scan and Complete Compliance Use unlimited re-scans, and receive your AoSC after a passing scan for compliance proof. PCI ASV EXCEPTION MANAGEMENT Streamlined exception handling for quarterly PCI ASV scans. Submit exceptions through the portal and get an approval or rejection within 24 hours. Approved exceptions stay tied to future PCI ASV scans. Submit Exception In-Portal Keep exception handling inside the same secure workflow as your scan and remediation activity. Review Within 24 Hours Receive a timely approval or rejection decision so your compliance process keeps moving. Exception Stays Attached Approved exceptions remain tied to future scans, reducing repeat admin work every quarter. WHO USES OUR PCI ASV SCANNING SERVICE PCI ASV scanning for merchants and service providers. Small Businesses Accepting Card Payments A simple way to complete PCI ASV scanning without a long enterprise sales process. Merchants With Internet-Facing Systems Scan public-facing assets that may affect your cardholder data environment. Service Providers Supporting Payment Environments Use a secure portal, manage exceptions, and repeat scans as needed. Teams That Need a Fast Online Solution Instant access, no download, and clear next steps toward a passing scan. PCI DSS 4.0.1 COMPLIANCE PCI DSS 4.0.1 Requirement 11.3.2 external vulnerability scanning. PCI DSS 4.0.1 Requirement 11.3.2 requires external vulnerability scanning through a PCI SSC Approved Scanning Vendor. Clone Systems helps merchants and service providers run quarterly PCI ASV scans online, review findings, remediate, re-scan, and reach a passing result with supporting documentation. Pair ASV scanning with SIEM Platform for continuous monitoring beyond quarterly requirements. Quarterly PCI ASV Scans Complete required external vulnerability scanning every quarter through a secure online portal. Approved Scanning Vendor Work with a PCI SSC listed Approved Scanning Vendor for required PCI ASV scanning. Built for Requirement 11.3.2 Online scanning, re-scans, exception handling, and AoSC after a passing scan. NEW · AI ADD-ON AI assistance across the entire scan journey. Add the Clone Systems AI assistant to any plan for an in-portal chatbot and remediation guidance from first scan to passing AoSC. Ask questions in plain English and get step-by-step remediation help without leaving the portal. Portal chatbot. Ask about scan results, PCI DSS 4.0.1 requirements, exception handling, or next steps and get an answer instantly. Remediation guidance. Every finding comes with tailored fix instructions, example configurations, and links to vendor advisories. Exception drafting. AI drafts a false-positive or compensating-control write-up you can review, edit, and submit for our 24-hour review. Priority triage. Findings are ranked by exploitability and cardholder-data exposure so your team fixes what matters first. Add AI to your account See a live demo Clone Systems AI Assistant ONLINE Why did my last scan fail on 203.0.113.42? One high-severity finding blocked the AoSC: CVE-2024-XXXX, OpenSSL 1.1.1 on port 443. This is exploitable and fails PCI DSS 4.0.1 Requirement 11.3.2. SEVERITY: 8.1 EXPLOIT: PUBLIC REMEDIATION Upgrade OpenSSL to 3.0.13+ or apply the vendor patch, then re-scan from the portal. Want me to draft an exception in case the upgrade slips past your quarterly window? Draft exception Re-scan now PRICING Simple annual pricing for PCI ASV scanning. Every plan includes unlimited re-scans until you pass, the Attestation of Scan Compliance, and portal access. STARTER $185 / year 1 IP or Domain Unlimited re-scans until passing Purchase scan → STANDARD $625 / year 10 IPs or Domains Unlimited re-scans until passing Purchase scan → ADVANCED $1,575 / year 25 IPs or Domains Unlimited re-scans until passing Purchase scan → Need more than 50 IPs or Domains? Contact us for a custom quote. WHY CLONE SYSTEMS How Clone Systems compares to other Approved Scanning Vendors. Most ASVs bolt scanning onto a licensed third-party engine and route everything through sales. We built our own engine, sell it through an online cart, and give you same-day scans with a pass or fail AoSC. CAPABILITY CLONE SYSTEMS TYPICAL ASV Online cart with instant checkout Same-day checkout, Buy and scan the same day, no sales call required. Sales cycle, Quote-and-contract sales cycle, often 1 to 3 weeks. Pass or fail AoSC every scan Automated, Attestation of Scan Compliance issued automatically after each passing scan. Manual, AoSC generated manually or only on quarterly cadence. Unlimited re-scans until passing Included, Included on every plan at no extra cost. Capped, Capped re-scans or per-scan fees. Exception / false-positive review 24 hour review, Submitted in the portal, reviewed and approved or rejected within 24 hours. 3 to 10 days, Email tickets, 3 to 10 business day turnaround. Scan engine In-house since 2007, Our own engine, built and maintained in-house since 2007. Third-party, Licensed or white-labeled from a third-party vendor. Approved Scanning Vendor tenure PCI SSC listed since 2007, PCI SSC listed since 2007, verifiable on the official ASV list. Varies, Varies, many ASVs re-listed under new ownership. AI assistance Add-on available, Add-on AI chatbot and remediation guidance across the scan journey. Rare, Rarely offered, or gated behind enterprise tier. Deployment model Single or multi-tenant, Both single-tenant and multi-tenant deployments available, matched to your scenario, compliance scope, and data isolation needs. Shared only, Shared multi-tenant portal with no single-tenant option. Compliance mapping PCI, HIPAA, SOC 2, ISO, NIST, GLBA, PCI DSS 4.0.1, HIPAA, SOC 2, ISO 27001, NIST, GLBA. PCI DSS only, Primarily PCI DSS only. Reporting PDF and CSV, exec plus technical, Executive summary, technical detail, and AoSC in PDF and CSV. PDF only, PDF only, extra fee for technical detail. Support US team, email and phone, US-based team, direct email and phone on Standard and above. Portal tiers, Tiered support portal, phone gated to enterprise. Scheduling On-demand or custom, On-demand, quarterly, monthly, or custom cadence. Fixed quarterly, Fixed quarterly cadence. Contract terms Annual, transparent pricing, Annual plans with transparent pricing. Multi-year, Multi-year commitments common. RELATED SERVICES Extend PCI ASV scanning with the rest of the Clone Systems platform. Quarterly scanning is one control in a broader PCI DSS 4.0.1 program. Pair it with managed detection, expert guidance, and self-service purchasing. Managed SIEM 24/7 SOC monitoring, log correlation, and threat detection across your environment. Explore Managed SIEM Automated & Managed Penetration Testing Continuous automated pen testing paired with expert-led manual engagements. Learn more about Penetration Testing Agent-Based Scanning Lightweight agents deliver continuous visibility into roaming endpoints and cloud workloads. Learn more about Agent-Based Scanning Authenticated Web App Scanning Authenticated scans surface deeper misconfigurations and missing patches inside your assets. Learn more about Authenticated Web App Scanning QUICK FACTS: PCI ASV SCANNING PRICE $185 per year for 1 IP or domain. $625 per year for 10. $1,575 per year for 25. INCLUDED Quarterly PCI ASV scans, unlimited rescans, and the Attestation of Scan Compliance after a passing scan. HOW TO BUY Order online with no sales call. Portal access is created automatically when payment goes through. VENDOR Clone Systems, a PCI SSC Approved Scanning Vendor since 2007, in business since 1998. Code 5COST: 5% off eligible PCI ASV scanning purchases. See PCI scan pricing Prices verified September 9, 2026 READY TO GET STARTED Instant portal access, scans on your schedule. Run scans now or schedule for later, manage exceptions in one place, unlimited re-scans, receive your AoSC, and move forward with PCI DSS 4.0.1 compliance including SAQ support. Direct line to a PCI-certified engineer PCI SSC Approved Scanning Vendor since 2007 Straight quote, no long-term lock-in Unlimited re-scans until you pass, included on every plan Purchase PCI Scan Website (leave blank) GET A QUOTE Talk to an ASV Expert Tell us where you are with PCI ASV scanning. Pricing and next steps straight from an engineer. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. PCI ASV SCANNING FAQ PCI ASV scanning questions, answered. Everything you need to know about our approved scanning process. Still stuck? Talk to us. What is PCI DSS 4.0.1 Requirement 11.3.2? Requirement 11.3.2 requires external vulnerability scans at least once every three months and after any significant change to the cardholder data environment. Scans must be performed by a PCI SSC Approved Scanning Vendor (ASV) and must produce a passing result. What is a PCI Approved Scanning Vendor (ASV)? Our PCI ASV scanning service is provided by an Approved Scanning Vendor, an organization qualified by the PCI Security Standards Council to perform external vulnerability scans for merchants and service providers subject to PCI DSS. Clone Systems has been a PCI SSC listed ASV since 2007, verifiable on the official ASV list. How often do I need to run a PCI ASV scan? Requirement 11.3.2 requires external vulnerability scanning at least quarterly (every 90 days) and after any significant change to internet-facing systems in the cardholder data environment. Our portal supports instant scans and automated quarterly scheduling. What counts as a passing PCI ASV scan? A passing scan under PCI DSS 4.0.1 has no vulnerabilities scored CVSS 4.0 or higher and no automatic failures defined by the ASV Program Guide. If issues are found, remediate and re-scan until you pass; all re-scans are unlimited and included. Which systems are in scope for external vulnerability scanning? All internet-facing IP addresses and fully qualified domain names that are part of, or provide a path into, the cardholder data environment are in scope for Requirement 11.3.2, typically including web servers, mail servers, DNS, firewalls, VPN endpoints, and public-facing application infrastructure. How does exception handling work under the ASV Program Guide? Findings can qualify for exceptions (false positives, compensating controls, or disputed CVSS scores) per the ASV Program Guide. Submit in-portal with supporting evidence, get an approval or rejection within 24 hours, and approved exceptions stay attached to future quarterly scans so you do not resubmit each quarter. Can I schedule PCI ASV scans to run automatically? Yes. Schedule scans on your preferred quarterly cadence once, and they run on autopilot, keeping you aligned with the 90-day cycle required by Requirement 11.3.2. Can I run a PCI ASV scan immediately? Yes. The portal, available in single-tenant or multi-tenant deployments, is built for instant access, letting you launch a scan on demand, useful after a significant change to your environment as required by 11.3.2. Are unlimited re-scans included? Yes. Unlimited re-scans are included so you can verify remediation and reach a passing quarterly ASV scan without additional charges. When do I receive the Attestation of Scan Compliance (AoSC)? After a passing quarterly ASV scan, Clone Systems issues the AoSC, Executive Summary, Vulnerability Details, and remediation reports required by the ASV Program Guide for your acquirer or QSA. What reports does the ASV provide after a scan? Each scan produces the three ASV Program Guide deliverables, the AoSC, the ASV Scan Report Executive Summary, and the ASV Scan Report Vulnerability Details, plus a remediation report with prioritized fix guidance, all downloadable from the portal. Does an ASV scan replace internal vulnerability scanning? No. Requirement 11.3.2 covers external scanning by an ASV. Requirement 11.3.1 separately requires internal vulnerability scans at least every three months, performed by qualified internal staff or a third party, not necessarily an ASV. For Requirement 10 logging and monitoring, see our Requirement 10 guide. Is a complementary SAQ module included? Yes. Each account includes a complementary SAQ module to support the broader PCI DSS compliance workflow alongside your quarterly ASV scans. Do you provide website trust seals? Yes. Customers can display Clone Systems security trust seals on their websites that tie back to current PCI ASV compliance status. How can I verify Clone Systems is a listed ASV? Clone Systems is listed on the official PCI SSC Approved Scanning Vendors page at pcisecuritystandards.org, where acquirers, QSAs, and buyers can independently verify our ASV status. --- ## What Is a PCI Compliance Scan? | Clone Systems URL: https://www.clone-systems.com/what-is-a-pci-compliance-scan HOME RESOURCE CENTER WHAT IS A PCI COMPLIANCE SCAN? What is a PCI compliance scan? A PCI compliance scan is an external vulnerability scan of the internet-facing systems that handle or protect payment card data. PCI DSS requires one at least every three months, run by a PCI Approved Scanning Vendor (ASV), with a passing result. It is often called an ASV scan, a PCI scan, or a PCI vulnerability scan. They all mean the same thing. The scan looks at your website, servers and network from the outside, the way an attacker would, and checks for known weaknesses that could expose cardholder data. A passing scan is one of the pieces of evidence you submit to your bank or payment processor to show you are PCI compliant. Clone Systems has run PCI compliance scans as a PCI SSC Approved Scanning Vendor since 2007. This guide explains what the scan is, who needs it, what it checks, and what happens when it fails. Who needs a PCI compliance scan? Any business that stores, processes or transmits payment card data, and has systems reachable from the internet, needs quarterly ASV scans. That covers most online stores, hosted checkout pages, booking systems, and any service provider that touches card data for its customers. Which PCI DSS Self-Assessment Questionnaire (SAQ) you complete decides whether the scan applies to you. Under PCI DSS v4.0.1 the ASV scan requirement (11.3.2) is included in: SAQ A: ecommerce and mail or phone order merchants who fully outsource card handling. No penetration test, but ASV scans are required. SAQ A-EP: ecommerce merchants whose own website affects how the payment page loads. SAQ B-IP, SAQ C, SAQ C-VT: merchants using internet-connected payment terminals or virtual terminals. SAQ D: merchants and service providers who do not fit a simpler SAQ. SAQ B (dial-out terminals only) and SAQ P2PE (validated point-to-point encryption) do not include the ASV scan requirement. Not sure which SAQ applies to you? Use the PCI SAQ Finder. Clone Systems is an Approved Scanning Vendor, not a Qualified Security Assessor. Your acquiring bank or payment processor confirms which SAQ and reporting level apply to your business. What does a PCI compliance scan check? The scan tests every internet-facing IP address or domain you put in scope. It does not need software installed, a login, or access to your internal network. From the outside, it looks for: Open ports and services that should not be exposed to the internet Outdated software with known vulnerabilities, including web servers, frameworks and content management systems Weak or expired SSL/TLS encryption on your website and other services Common web application weaknesses such as SQL injection and cross-site scripting Misconfigurations, default settings and exposed admin interfaces Known malware or signs of compromise on public-facing systems Each finding is rated using the Common Vulnerability Scoring System (CVSS). The ASV Program Guide sets the pass line: any vulnerability scored 4.0 or higher fails the scan, and a short list of issues fails it automatically regardless of score. An ASV scan is not a penetration test. The scan is automated and looks for known weaknesses. A penetration test is a person actively trying to break in. PCI DSS asks for both at different points, and for most merchants the quarterly scan is the one that comes up first. How often do you need a PCI scan? PCI DSS v4.0.1 sets two triggers: Every three months (Requirement 11.3.2). You need a passing ASV scan for each quarter, and the four passing scans in a year are what your SAQ asks you to confirm. After any significant change (Requirement 11.3.2.1). A new server, a website rebuild, a new payment integration or a major software upgrade means you scan again, outside the quarterly cycle. Quarterly is the minimum. Clone Systems recommends scanning monthly. New vulnerabilities are published every week, and a monthly scan means you find and fix them before the quarterly scan that counts, instead of scrambling against a deadline. Rescans are included with every Clone Systems PCI ASV plan, so scanning more often costs nothing extra. Pass or fail: what the result means Every ASV scan ends in one of two results. Pass. No vulnerability at CVSS 4.0 or above and none of the automatic-failure conditions were found. You receive an Attestation of Scan Compliance (AoSC) and a scan report. The attestation is the document your bank or processor asks for. It carries the organization name you registered the scan under, so make sure that name matches your merchant account. Fail. At least one finding crossed the line. The report lists each failing item, which system it was found on, how it was rated, and what to do about it. A failed scan is not a penalty and nothing is reported to anyone. It means you have work to do before the quarterly deadline. Failing a first scan is common, especially for businesses scanning for the first time or after a website change. What matters is fixing the findings and getting a passing rescan before the end of the quarter. What to do after a failed PCI scan There are three ways a failing item gets cleared. Fix it and rescan. Patch the software, close the port, update the certificate, or change the setting the report points to. Then run the scan again. With Clone Systems, rescans are included, so you can rescan as many times as it takes. Dispute a false positive. Sometimes the scanner flags something that is not actually a risk, such as software that has been patched but still reports an old version number. You submit an exception with evidence, and the ASV's security team reviews it. At Clone Systems, exceptions are submitted in the portal under Options and are typically reviewed within 24 hours. Once accepted, the exception stays attached to that scan so you do not have to resubmit it. Document a compensating control. If a finding cannot be fixed, you can document the other controls that reduce the risk. The ASV reviews whether the compensating control is enough for the scan to pass. For a step-by-step walkthrough, see What to do when you fail a PCI scan. Who is allowed to run the scan? Only a PCI SSC Approved Scanning Vendor. Running a vulnerability scanner yourself, or using a scanning tool that is not on the approved list, does not satisfy Requirement 11.3.2. The scan has to be performed by an ASV whose scanning solution is tested and approved by the PCI Security Standards Council every year. You can check any vendor on the PCI SSC's list of Approved Scanning Vendors. Clone Systems has been on that list since 2007. Many security companies publish guides to PCI scanning and sell vulnerability scanning tools without being an ASV. Their scans may be useful for your own security, but they will not produce an Attestation of Scan Compliance your bank will accept. If a vendor cannot show you their listing on the PCI SSC site, their scan is not a PCI compliance scan. More on what an ASV does and how to choose one: What is a PCI Approved Scanning Vendor? How to get a PCI compliance scan With Clone Systems the whole process is online and self-managed. Buy the scan. Choose the plan for the number of IP addresses or domains you need to scan on the PCI ASV scanning page. The organization name you enter at checkout is the name that appears on your Attestation of Scan Compliance. Log in to the portal. Your scanning account is created automatically when the order completes. Add your targets. If your IP addresses change, you can scan by domain instead so the exception history stays attached to your scan. Run the scan. Run it on demand or schedule it. Quarterly is required; monthly is what we recommend. Review the report. Each finding comes with plain-language remediation guidance. Fix what needs fixing, submit exceptions for false positives, and rescan. Rescans are included. Download your attestation. When the scan passes, download the Attestation of Scan Compliance and scan report from the portal and send them to your bank or processor. For what the scan costs and how pricing works, see PCI scan cost in 2026, or go straight to pricing. Frequently asked questions Is a PCI scan the same as an ASV scan? Yes. PCI scan, PCI compliance scan, PCI vulnerability scan and ASV scan all refer to the external vulnerability scan PCI DSS Requirement 11.3.2 asks for, performed by an Approved Scanning Vendor. What is the difference between a PCI scan and a vulnerability scan? A PCI scan is a vulnerability scan with extra rules. It must be run by an ASV, it is scored against the PCI SSC's pass and fail criteria, and it produces an attestation your bank will accept. A general vulnerability scan can use any tool and has no pass line. How often is a PCI scan required? At least every three months, plus after any significant change to your systems. Clone Systems recommends monthly so problems are found before the quarterly scan that counts. What fails a PCI scan? Any vulnerability rated CVSS 4.0 or higher, plus a short list of automatic failures such as exposed cardholder data, known malware, or vulnerabilities in remote access software. The scan report lists every failing item and how to fix it. Do I need an internal PCI scan too? PCI DSS also requires quarterly internal vulnerability scans (Requirement 11.3.1), but those do not have to be run by an ASV. Clone Systems offers internal scanning as a separate service. Can I run a PCI scan myself with free software? You can scan your own systems with any tool you like, and it is a good idea. But it does not satisfy Requirement 11.3.2. Only a scan performed by an Approved Scanning Vendor counts, and only an ASV can issue the Attestation of Scan Compliance. What is a PCI scan tool? Usually this means the scanning platform an ASV provides: a portal where you add your IP addresses or domains, run scans, read reports and download your attestation. Clone Systems' platform does all of this, with AI remediation guidance on every finding. How long does it take to get compliant after a failed scan? It depends on the findings. Many fixes, such as updating a certificate or closing a port, take minutes, and you can rescan right away. The important deadline is the end of the quarter. QUICK FACTS: PCI ASV SCANNING PRICE $185 per year for 1 IP or domain. $625 per year for 10. $1,575 per year for 25. INCLUDED Quarterly PCI ASV scans, unlimited rescans, and the Attestation of Scan Compliance after a passing scan. HOW TO BUY Order online with no sales call. Portal access is created automatically when payment goes through. VENDOR Clone Systems, a PCI SSC Approved Scanning Vendor since 2007, in business since 1998. Code 5COST: 5% off eligible PCI ASV scanning purchases. See PCI scan pricing Prices verified September 9, 2026 READY WHEN YOU ARE Get your PCI compliance scan from an Approved Scanning Vendor Clone Systems has been a PCI SSC Approved Scanning Vendor since 2007. Buy online, scan the same day, and download your Attestation of Scan Compliance from your portal when you pass. See PCI ASV scanning plans Talk to a specialist --- ## Vulnerability Scanning Services | Internal & External URL: https://www.clone-systems.com/network-vulnerability-assessment-services HOME VULNERABILITY ASSESSMENT Internal and external vulnerability assessments . One self-managed scanning portal for internal and external vulnerability assessment, mapped to nearly every major framework, with our support team on hand to help you troubleshoot. Purchase Online Speak with our team Internal + External Scanning under one portal Credentialed Authenticated deep scans Framework-mapped PCI · HIPAA · SOC 2 · NIST · ISO + Self-managed Support team on hand to troubleshoot VULNERABILITY ASSESSMENT CAPABILITIES Everything a modern assessment program needs, in one module. Discovery, internal and external scanning, credentialed depth, risk-based prioritization, and audit-ready reporting, all through the same CloneGuard portal. Asset Discovery & Inventory The portal continuously maps hosts, services, and applications so your scope stays accurate as environments drift. External Network Scanning Cloud-based scanners evaluate your internet-facing perimeter with no software to install and no appliance to babysit. Internal Network Scanning A lightweight physical or virtual scanning server inside your network covers VLANs, data centers, and lab environments. Credentialed & Uncredentialed Run authenticated deep scans for accurate patch-level detection, or unauthenticated scans to see what an attacker sees. Risk-Based Prioritization Findings are scored on severity, exploitability, and business impact so remediation starts with what actually matters. Audit-Ready Reporting Executive summaries, technical detail, remediation reports, and compliance-mapped exports are one click away in the same portal. THE CLONEGUARD SCANNING PORTAL One console for every scan, every finding, every report. Vulnerability Assessment is one module inside CloneGuard. Launch scans, review prioritized results, export compliance reports, and rescan after remediation, all from the same portal your PCI ASV scans run in. Overview Scans Results Options Search ⌘K 7 Vulnerability CL Security Overview Your posture, what changed, and what to do next. New Scan Scan Again SECURITY POSTURE B+ 342 open findings High 8 Medium 47 COMPLIANCE Passing PCI DSS 4.0.1 ready Passed 90d 128 Failed 90d 6 WHAT'S NEW +23 since last scan New KEVs 7d 3 Scans 30d 42 NEXT SCAN Tomorrow weekly · 02:00 UTC Running 2 IPs 1,284 RISK OVER TIME -38% · 90 days 90 45 0 J F M A M J J A S O N D Clone Guard® Security Scanning  |  © 1998–2026 Clone Systems, Inc. All rights reserved AI Assistant External Vulnerability Scanning Cloud-based scanners continuously evaluate your perimeter, identifying and reporting public, internet-facing vulnerabilities with no software installation or deployment overhead. Rapid setup, typically live in a day Cloud-based scanning infrastructure No software installation required Continuous perimeter coverage Internal Vulnerability Scanning Internal scanning uses a lightweight security scanning server deployed inside your network, with physical and virtual options including VMware, Hyper-V, VirtualBox, and Citrix XEN. Run full credentialed or partial uncredentialed scans against your assets. Physical or virtual appliance options Full credentialed authenticated scans Partial uncredentialed scans Segmented VLANs, data centers, and labs covered HOW VULNERABILITY ASSESSMENT WORKS From asset discovery to verified fix, in five steps. A predictable model your team runs independently, with support a message away whenever you need help. 01 Discovery The portal maps your assets across networks, cloud accounts, and on-prem hosts so nothing in scope is missed. 02 Scanning Cloud-based external scanners and internal appliances run credentialed or uncredentialed assessments on your schedule. 03 Prioritization Every finding is scored by severity, exploitability, and asset criticality so remediation effort goes where it matters. 04 Reporting Dashboards and audit-ready exports translate findings for engineering, leadership, and auditors in the same portal. 05 Rescan & Verify Rescan on demand after remediation to confirm issues are closed and track improvement over time. COMPLIANCE COVERAGE Mapped to nearly every framework you report against. Our findings are pre-mapped to the controls your auditors care about, so you export the evidence you need without translating scanner output into control language yourself. Need help scoping which frameworks apply to your environment? A senior specialist can walk you through it. Talk to a specialist PCI DSS 4.0.1 REQ 11.3.1 / 11.3.2 HIPAA SECURITY RULE §164.308 SOC 2 CC7.1 · VULNERABILITY MGMT NIST 800-53 RA-5 · SI-2 NIST CSF ID.RA · PR.IP · DE.CM ISO 27001 A.8.8 · A.12.6.1 CIS Controls CONTROL 7 · CVM GLBA SAFEGUARDS RULE FISMA NIST 800-53 MODERATE CMMC LEVEL 2 · RA.L2-3.11 GDPR ART. 32 · SECURITY State privacy laws CCPA · CPRA · MORE WHY VULNERABILITY ASSESSMENT Better visibility, focused remediation, cleaner audits. One Portal, Full Coverage Internal and external scanning, asset inventory, findings, and reports live in one self-managed console. Focus Remediation Effort Risk scoring and business-impact context tell your team what to patch this week versus what can wait. Evidence Auditors Accept Framework-mapped exports and rescan history make audit prep a download, not a fire drill. Continuous Improvement Trend views measure how quickly you close findings and how your posture is changing month over month. WHO RUNS VULNERABILITY ASSESSMENT Built for teams that need continuous visibility, not point-in-time reports. Mid-Market & Enterprise IT Teams Standardize internal and external scanning across offices, data centers, and cloud accounts on a single platform. Regulated Financial & Payment Environments Meet PCI DSS 4.0.1 quarterly internal and external scanning requirements with evidence built for auditors. Healthcare & HIPAA-Regulated Businesses Continuous scanning of clinical systems, back office, and cloud workloads, with HIPAA-aligned reporting. E-Commerce & Cloud-Native Operations Track exposure across web frontends, APIs, cloud infrastructure, and workforce endpoints as they change. NEW · AI ADD-ON An AI assistant that turns scan output into a remediation plan. Add the Clone Systems AI Assistant to your Vulnerability Assessment module and stop reading scanner output line by line. It explains what each finding means, groups related issues, and hands your team a ranked plan to fix first. Plain-English findings. Every vulnerability is rewritten in language engineers and non-engineers can act on together. Grouped remediation. Related findings across hosts collapse into one work item so patching one thing closes many alerts. Risk-ranked priority. Exploitability, asset value, and framework impact combine into a single, defensible priority order. Auditor-ready summaries. Draft executive and compliance-mapped narratives you can edit and export from the portal. Schedule a Demo Talk to a specialist Clone Systems AI Assistant ON SHIFT What should we fix first from last night's internal scan? 412 findings collapsed into 27 remediation items. Top priority is an unpatched OpenSSH release on 14 production hosts, exploitable pre-auth and in-scope for PCI Requirement 6.3.3. SEVERITY: 9.4 HOSTS: 14 PCI 6.3.3 RECOMMENDED PLAN Patch OpenSSH to the fixed release on the 14 hosts, then rescan the internal segment. Want me to draft the change ticket and queue the rescan for tonight? Draft ticket + queue rescan Show all hosts RELATED MODULES Vulnerability Assessment is one module. Here is what pairs with it. Add PCI ASV scanning, penetration testing, or managed detection to build a full offensive and defensive program on one platform. PCI ASV Scanning Quarterly external scans by an Approved Scanning Vendor, with your Attestation of Scan Compliance included. Learn more about PCI ASV Scanning Managed Penetration Test Engineer-led offensive engagement that validates whether the vulnerabilities we find are actually exploitable in your environment. Learn more about Managed Penetration Test SIEM Platform Correlated detection and response so the vulnerabilities you have not patched yet do not become tomorrow's incident. Learn more about SIEM Platform QUICK FACTS: VULNERABILITY SCANNING PRICE External vulnerability scanning from $595 per year, ordered online. SCOPE External, internal, and agent-based scanning in one self-managed portal, sized by IP count. STANDARD Checks mapped to PCI DSS, HIPAA, SOC 2, NIST, and ISO 27001 requirements. VENDOR Clone Systems, a PCI SSC Approved Scanning Vendor, in business since 1998. See vulnerability scanning pricing Prices verified September 9, 2026 READY WHEN YOU ARE Continuous scanning, live in days, not months. Scope your environment with a senior specialist, see the CloneGuard scanning portal running against real assets, and get a plan for standing up continuous internal and external assessment. Internal and external scanning under one portal Framework-mapped reporting for PCI, HIPAA, SOC 2, and NIST Credentialed and uncredentialed scan options Support team available to help you troubleshoot Schedule a Demo Website (leave blank) TALK TO OUR SCANNING TEAM Scope your vulnerability assessment Tell us about your environment and what you want assessed. A senior specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. VULNERABILITY ASSESSMENT FAQ Vulnerability assessment questions, answered. Everything you need to know about running internal and external vulnerability assessments with Clone Systems. Still stuck? Talk to us. What is a vulnerability assessment? A vulnerability assessment systematically scans your infrastructure for known software flaws, missing patches, insecure configurations, and outdated services. Clone Systems runs internal and external assessments through one managed portal and returns prioritized findings with remediation guidance. How is a vulnerability assessment different from a penetration test? A vulnerability assessment identifies and prioritizes known weaknesses across a broad asset footprint. A penetration test attempts to exploit them to prove real business impact. Most compliance programs require both, running the assessment continuously between pentest engagements. Do you cover internal and external scanning? Yes. External scanning evaluates your perimeter from the internet with cloud-based scanners, no installation required. Internal scanning uses a physical or virtual appliance inside your network (VMware, Hyper-V, VirtualBox, and Citrix XEN supported) and can run credentialed or uncredentialed. Which compliance frameworks does this map to? Our vulnerability assessment module maps to nearly every major framework, including PCI DSS 4.0.1, HIPAA, SOC 2, NIST 800-53 and CSF, ISO 27001, CIS Controls, GLBA, FISMA, and CMMC. Findings, reports, and evidence exports are structured to feed directly into audits. Do I need credentials for scanning? Authenticated (credentialed) scans return the most accurate results because the scanner sees installed software, patch levels, and misconfigurations from inside the host. Uncredentialed scans still identify network-facing exposure, and you can run either or both per asset group. Is this self-managed or fully managed? Vulnerability assessment scanning is completely self-managed: your team launches scans, reviews results, and exports reports on demand from the portal. Support is available whenever you need a hand. How often should we run vulnerability assessments? For most environments, monthly internal and external scans are a healthy baseline, with additional scans after major infrastructure or application changes. PCI DSS requires at least quarterly external ASV and internal scans, plus scans after significant changes. How long does onboarding take? External scanning is typically live within a day. Internal scanning takes as long as deploying the appliance inside your network, usually a few days. There is nothing to buy, no hardware refresh, and no long professional-services engagement. --- ## Agent-Based Vulnerability Scanning | Clone Systems URL: https://www.clone-systems.com/agent-based-scanning HOME AGENT-BASED SCANNING Continuous coverage from a lightweight agent . Deploy a small CloneGuard agent to every laptop, server, cloud VM, and container host you care about. Get authenticated-quality vulnerability, patch, and configuration data streamed continuously, on-network or off. Purchase Online Speak with our team Continuous Streaming telemetry, not scan windows Works Off-VPN Remote endpoints stay covered Cross-Platform Windows · macOS · Linux · ARM Self-managed Support team on hand to troubleshoot AGENT-BASED SCANNING CAPABILITIES What a modern endpoint vulnerability program actually needs. Deep host visibility, continuous telemetry, credentialed-quality findings without credentials, and reporting mapped to your auditors' frameworks, all through the CloneGuard platform. Lightweight, Always-On Agent A small, resource-friendly agent lives on each host and streams telemetry continuously, so findings appear the moment they exist. Works Off-Network Remote laptops, field devices, and road warriors stay covered without VPN. The agent reports directly to CloneGuard over TLS. Deep Software Inventory Every OS package, third-party application, browser extension, and runtime is inventoried for accurate CVE matching and SBOM export. Authenticated by Design The agent runs locally with the visibility it needs, so you get credentialed-quality results without managing scan credentials per host. Configuration & Patch Posture Detect missing patches, insecure configurations, end-of-life software, and hardening gaps against CIS and vendor baselines. Unified Reporting Agent findings live alongside network, PCI ASV, and pentest results in one CloneGuard console, with remediation reports and framework-mapped exports. ONE PORTAL, EVERY AGENT Every agent, every finding, in the same CloneGuard console. Agent-based scanning is one module inside CloneGuard. Its telemetry lives alongside network, PCI ASV, and pentest results, so one console tells the whole story of your exposure. Overview Scans Results Options Search ⌘K 7 Vulnerability CL Security Overview Your posture, what changed, and what to do next. New Scan Scan Again SECURITY POSTURE B+ 342 open findings High 8 Medium 47 COMPLIANCE Passing PCI DSS 4.0.1 ready Passed 90d 128 Failed 90d 6 WHAT'S NEW +23 since last scan New KEVs 7d 3 Scans 30d 42 NEXT SCAN Tomorrow weekly · 02:00 UTC Running 2 IPs 1,284 RISK OVER TIME -38% · 90 days 90 45 0 J F M A M J J A S O N D Clone Guard® Security Scanning  |  © 1998–2026 Clone Systems, Inc. All rights reserved AI Assistant Where Agent-Based Scanning Wins When an asset moves, changes constantly, or sits outside the network you control, an agent on the host is the fastest path to accurate, continuous vulnerability data. Remote and roaming laptops Cloud VMs, containers, and auto-scaling groups Hardened servers where credential-based scanning is painful Environments where scan windows are hard to coordinate Where Network Scanning Still Belongs Agents cover what you can install on; network scanning fills the rest. The two are complementary and both live in the same CloneGuard portal. PCI ASV external scanning obligations Unmanaged and BYO devices on your network Network appliances, printers, IoT, and OT Perimeter and public-facing infrastructure HOW AGENT-BASED SCANNING WORKS From first install to verified fix, in five steps. A predictable model your team runs independently, with support a message away for deployment or tuning help. 01 Deploy Push the agent through Intune, Jamf, Group Policy, RMM, or a one-line install script. Bake it into cloud images for auto-scaling fleets. 02 Inventory Each agent enumerates installed software, running services, patch state, and configuration posture from inside the host, no credentials required. 03 Detect Findings flow to the CloneGuard platform continuously and are correlated against current CVE, exploit, and misconfiguration intelligence. 04 Prioritize Every issue is scored on severity, exploitability, asset criticality, and framework impact so remediation effort starts where risk is highest. 05 Verify Rescan on demand or wait for the next telemetry cycle. Closed findings drop off automatically, and trend views show progress over time. DEPLOY WHERE YOUR ASSETS LIVE One agent, everywhere your workloads run. Ship the agent through the tools you already use: MDM for laptops, Group Policy or RMM for servers, golden image or Terraform for cloud. Nothing about your deployment stack has to change. LINUX ONE-LINER curl -sSL https://install.cloneguard.io/agent | \ sudo TOKEN= bash See a deployment walkthrough Windows & macOS Laptops INTUNE · JAMF · KANDJI · WORKSPACE ONE Windows, macOS & Linux Servers GPO · SCCM · ANSIBLE · RMM Cloud VMs AWS EC2 · AZURE VM · GCP COMPUTE Container Hosts DOCKER · KUBERNETES NODES COMPLIANCE COVERAGE Continuous evidence for the frameworks that matter. Agent findings are pre-mapped to the controls auditors ask about, replacing the point-in-time scan PDF you used to assemble the week of the audit with continuous, timestamped host-level evidence. Not sure which frameworks apply to your environment? A senior specialist can walk you through it. Talk to a specialist PCI DSS 4.0.1 REQ 6.3.3 · 11.3 HIPAA SECURITY RULE §164.308 SOC 2 CC7.1 · VULNERABILITY MGMT NIST 800-53 RA-5 · SI-2 · CM-8 NIST CSF ID.AM · PR.IP · DE.CM ISO 27001 A.8.8 · A.8.9 CIS Controls CONTROL 2 · 7 · CVM CMMC LEVEL 2 · RA / CM FedRAMP RA-5 CONTINUOUS GLBA SAFEGUARDS RULE GDPR ART. 32 · SECURITY State privacy laws CCPA · CPRA · MORE WHY AGENT-BASED SCANNING Continuous coverage, deeper visibility, cleaner audits. Real-Time Visibility New CVEs are matched against your live inventory as soon as they land, so you learn about exposure in hours, not at the next scan window. No Scan Windows to Coordinate There is no traffic to schedule, no maintenance window to negotiate, and no firewall rules to open. The agent just reports. Low Overhead, No End-User Impact Sub-100 MB idle memory, minimal CPU outside collection cycles, and compressed telemetry keep the agent invisible on laptops and busy servers alike. Evidence Auditors Accept Continuous, timestamped host-level evidence with framework mappings replaces point-in-time scan PDFs pulled together the week of an audit. WHO RUNS AGENT-BASED SCANNING Built for teams whose assets do not sit still. IT & Security Teams with Remote Workforces Cover laptops that rarely touch the corporate network without shipping them home over a VPN. Financial & Payment Environments Continuous, authenticated coverage of workstations and servers to satisfy PCI DSS 4.0.1 vulnerability management expectations. Healthcare & HIPAA-Regulated Businesses Inventory and monitor clinical workstations, back-office servers, and cloud workloads without disrupting patient-facing systems. Cloud-Native & DevOps Teams Bake the agent into golden images so every auto-scaled instance and container host reports the moment it boots. NEW · AI ADD-ON An AI assistant that turns agent telemetry into a remediation plan. Add the Clone Systems AI Assistant to your agent fleet and stop scrolling through host-by-host findings. It clusters vulnerabilities, ranks what to fix first, and hands your team a ready-to-work remediation plan. Fleet-wide clustering. Related findings across thousands of hosts collapse into a handful of work items you can actually assign. Plain-English findings. Every vulnerability is rewritten in language engineers and non-engineers can act on together. Risk-ranked priority. Exploitability, asset value, and framework impact combine into a single, defensible priority order. Auditor-ready summaries. Draft executive and compliance-mapped narratives you can edit and export from the portal. Schedule a Demo Talk to a specialist Clone Systems AI Assistant ON SHIFT What is the highest-impact thing to fix across our agent fleet this week? 1,842 findings across 612 agents collapsed into 34 work items. Top priority is an outdated Chromium build on 289 laptops, actively exploited in the wild and in-scope for SOC 2 CC7.1. SEVERITY: 9.1 HOSTS: 289 SOC 2 CC7.1 RECOMMENDED PLAN Push the Chromium update through Intune to the 289 affected laptops, then let the agents confirm the fix on next check-in. Want me to draft the change ticket and stage the deployment ring? Draft ticket + stage rollout Show all hosts RELATED MODULES Agent-Based Scanning is one module. Here is what pairs with it. Add network vulnerability assessment, PCI ASV scanning, or managed penetration testing to build a full offensive and defensive program on the same platform. Vulnerability Assessment Internal and external network scanning for the assets an agent cannot live on, from a single self-managed portal. Learn more about Vulnerability Assessment Managed Penetration Test Engineer-led offensive engagement that validates whether the vulnerabilities agents surface are actually exploitable. Learn more about Managed Penetration Test SIEM Platform Correlated detection and response for the hosts your agents cover, so exposure becomes visibility, not incidents. Learn more about SIEM Platform READY WHEN YOU ARE Continuous agent coverage, live in days, not months. Scope your fleet with a senior specialist, see the CloneGuard platform reporting from live agents, and get a plan for standing up continuous vulnerability coverage across every host you care about. Windows, macOS, and Linux coverage from day one Deploy through Intune, Jamf, GPO, RMM, or cloud images Continuous telemetry, on-network and off-VPN Support team available to help you troubleshoot Schedule a Demo Talk deployment Website (leave blank) TALK TO OUR SCANNING TEAM Scope your agent-based scanning rollout Tell us about your fleet and how you deploy software today. A senior specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. AGENT-BASED SCANNING FAQ Agent-based scanning questions, answered. Everything you need to know about running agent-based vulnerability scanning with Clone Systems. Still stuck? Talk to us. What is agent-based vulnerability scanning? Agent-based scanning installs a small piece of software on each host. It inventories software, patch levels, configurations, and services, then streams telemetry to the CloneGuard platform so vulnerabilities surface in near real time, without a network scan. How is this different from network vulnerability scanning? Network scanning probes assets from outside and suits perimeter and unmanaged infrastructure, but struggles with roaming laptops, cloud auto-scale, containers, and hardened hosts. Agent-based scanning lives on the asset itself, giving authenticated visibility off VPN with no scanner traffic. Which operating systems do the agents support? Windows 10 and 11, Windows Server 2016+, macOS 12+ on Intel and Apple Silicon, and major Linux distributions including RHEL, CentOS Stream, Rocky, AlmaLinux, Ubuntu LTS, Debian, Amazon Linux, and SUSE. ARM64 Linux is supported for cloud and container use cases. How resource-intensive is the agent? The agent is intentionally lightweight: idle memory sits well under 100 MB, CPU usage is minimal outside active collection windows, and traffic is compressed telemetry rather than raw scan output. It is designed to be invisible on laptops and workstations. How do we deploy the agents at scale? Ship the installer through tools you already use: Microsoft Intune, Jamf, Kandji, Workspace ONE, Group Policy, SCCM, or any RMM. Linux hosts install via package or one-line curl script, and cloud images can be baked with the agent pre-installed for auto-scaling groups. Does the agent work when a laptop is off the corporate network? Yes. The agent reports directly to the CloneGuard cloud endpoint over TLS, so remote employees, road-warrior sales teams, and BYOD-adjacent devices stay covered without a VPN connection. Does agent-based scanning replace network scanning or PCI ASV scans? No, and it should not. Agent-based scanning gives deep, authenticated visibility on managed hosts, but you still need external network and PCI ASV scanning for perimeter, unmanaged, and compliance-mandated coverage. The two are complementary and both live inside CloneGuard. Is this self-managed? Yes. Agent-based scanning is completely self-managed through the CloneGuard portal: your team deploys agents, reviews findings, and exports reports on demand. Our support team is available to help with deployment, tuning, or reporting whenever you need it. --- ## Authenticated Web App Scanning | Clone Systems URL: https://www.clone-systems.com/credentialed-scanning HOME AUTHENTICATED WEB APP SCANNING Authenticated Web App Scanning from behind the login . Give the scanner a login and it will explore your app the way a real user does. Role-based coverage, SPA and API aware, mapped to PCI DSS 6.4.1, OWASP Top 10, and OWASP API Top 10. Schedule a Demo Speak with our team Behind the Login Authenticated views, not just marketing pages Multi-Role Admin, tenant, and user sessions in parallel SPA & API Aware React, Vue, Angular, REST, and GraphQL Self-managed Support team on hand to troubleshoot CREDENTIALED WEB APP SCANNING CAPABILITIES What a modern authenticated web app scan actually needs. Real logins, real sessions, real JavaScript, real APIs. Coverage that mirrors how your users, and your attackers, actually use the app, all through the CloneGuard platform. Real Login, Real Session The scanner authenticates like a person, keeps the session alive, and rotates CSRF and anti-forgery tokens so it stays inside the app for the full run. Multi-Role Coverage Run the same target as admin, tenant owner, standard user, and read-only. Surface IDOR, broken access control, and privilege escalation between roles. SPA & Modern JS Aware A real browser engine executes JavaScript, waits for XHR and fetch to settle, and follows client-side routes across React, Vue, Angular, and Svelte. REST & GraphQL APIs Import OpenAPI, Swagger, Postman, or HAR files. Every documented endpoint is fuzzed inside your authenticated session with realistic payloads. OWASP Top 10 & API Top 10 Injection, broken access control, XSS in authenticated views, SSRF, sensitive data exposure, misconfigured CORS, and business-logic checks are all in scope. Unified Reporting Credentialed web app findings live alongside network, PCI ASV, and agent findings in one CloneGuard console with remediation reports and framework-mapped exports. ONE PORTAL, EVERY TARGET Every app, every role, every finding, in the same CloneGuard console. Credentialed web app scanning is one module inside CloneGuard. Findings live alongside network, PCI ASV, agent, and pentest results so one console tells the whole story of your exposure. Status Targets Coverage Activity Search ⌘K 3 Credentialed Web App CL Session & Recipe Status Login recipes, sessions, and auth health across every app. Add Login Recipe Re-auth & Scan AUTH SUCCESS 98.6% last 24 hours Logins 24h 412 Failures 24h 6 ACTIVE SESSIONS 17 live scan workers Apps 9 Roles 24 RECIPES 24 stored & validated Healthy 22 Needs review 2 NEXT RE-AUTH 12m rolling schedule Nightly full 02:00 UTC MFA seeds OK RECIPE HEALTH All critical apps green app.acme.com Form + MFA (TOTP) Healthy portal.acme.com OAuth 2.0 · Auth Code + PKCE Healthy admin.acme.io SAML SSO (Okta) Needs review api.acme.com OAuth Client Credentials Healthy Clone Guard® Credentialed Web App Scanning  |  © 1998–2026 Clone Systems, Inc. All rights reserved What Authenticated Web App Scanning Finds Once signed in, the scanner exercises the surface area that only exists for authenticated users, where the highest-severity bugs almost always live. IDOR and broken object-level authorization Privilege escalation between roles Injection and XSS in authenticated forms Sensitive data exposure inside dashboards SSRF from server-side integrations Business-logic flaws in checkout, billing, and admin flows What an Unauthenticated Scan Misses An anonymous crawler only sees marketing pages and the login screen. Everything that makes your product a product stays invisible to it. Tenant-scoped dashboards and settings Admin panels and back-office tools APIs that require a valid session or token Multi-step workflows behind the login Authorization checks between user roles State transitions in checkout and billing HOW CREDENTIALED WEB APP SCANNING WORKS From first login to verified fix, in five steps. A predictable model your team runs independently, with support a message away for login scripting or scope tuning. 01 Scope Confirm the target application, environments, user roles, and any APIs you want covered. We keep production and staging cleanly separated. 02 Authenticate Upload or record a login recipe: form login, SSO, JWT, OAuth service account, or a pre-minted session header. One recipe per role. 03 Crawl & Discover A real browser walks the authenticated app, executes JavaScript, follows SPA routes, and captures every API call the UI makes. 04 Test Discovered pages, forms, and endpoints are exercised against OWASP Top 10 and API Top 10 checks, per role, with session and CSRF tokens rotated correctly. 05 Report & Verify Findings appear in CloneGuard with reproduction steps, evidence, and framework tags. Rescan on demand to confirm the fix. EVERY WAY YOUR APP SIGNS USERS IN If a person can log in, the scanner can too. Form login, enterprise SSO, OAuth service accounts, JWTs, or a pre-minted session header. Configure the login recipe once per role and reuse it across every scheduled scan. SAMPLE LOGIN RECIPE login: url: https://app.example.com/login method: form fields: email: scanner+admin@example.com password: ${SECRET_ADMIN_PW} success_when: url_contains "/dashboard" role: admin See a login walkthrough Form Login USERNAME + PASSWORD · MFA-FRIENDLY SSO & SAML OKTA · AZURE AD · GOOGLE OAuth 2.0 / OIDC SERVICE ACCOUNT · CLIENT CREDENTIALS Session / Header PRE-MINTED COOKIE · BEARER TOKEN COMPLIANCE COVERAGE Authenticated evidence for the frameworks that matter. Web app findings are pre-mapped to the controls auditors ask about, including PCI DSS 6.4.1, OWASP ASVS Level 2, and SOC 2 CC7.1. Every result is timestamped, reproducible, and exportable. Not sure which frameworks apply to your application? A senior specialist can walk you through it. Talk to a specialist PCI DSS 4.0.1 REQ 6.4.1 · 11.3.1 OWASP Top 10 2021 · WEB OWASP API Top 10 2023 · API OWASP ASVS LEVEL 2 CONTROLS HIPAA SECURITY RULE §164.308 SOC 2 CC7.1 · VULNERABILITY MGMT NIST 800-53 RA-5 · SA-11 NIST CSF ID.RA · PR.IP · DE.CM ISO 27001 A.8.25 · A.8.29 CMMC LEVEL 2 · RA / SA GDPR ART. 32 · SECURITY State privacy laws CCPA · CPRA · MORE WHY AUTHENTICATED WEB APP SCANNING Deeper visibility, release-aware coverage, cleaner audits. See Behind the Login Wall Most real business logic and most real risk live in authenticated views. Credentialed scanning is the only way to test them at machine speed. Continuous, Release-Aware Schedule scans nightly, weekly, or after every deploy so regressions surface in hours, not at the next quarterly pentest. Role-Aware Findings Every issue includes the role that reproduced it, so authorization flaws such as IDOR and broken access control are unambiguous. Evidence Auditors Accept Reports map findings to PCI DSS, OWASP ASVS, SOC 2, and more, with reproduction steps and timestamps for every result. WHO RUNS CREDENTIALED WEB APP SCANNING Built for teams shipping real, authenticated web products. SaaS & Product Engineering Teams Cover every authenticated dashboard, tenant view, and admin panel between manual pentest cycles, without slowing releases. Financial & Payment Applications Meet PCI DSS 6.4.1 for authenticated web app testing and give auditors clean, repeatable evidence per role and per environment. Healthcare & Regulated Portals Test patient portals, provider dashboards, and back-office tools without exposing PHI, using dedicated test accounts and staging. E-Commerce & Marketplaces Exercise the full authenticated funnel, from cart and checkout to seller consoles and admin ops, with role-scoped runs. NEW · AI ADD-ON An AI assistant that turns authenticated findings into a fix plan your engineers will ship. Add the Clone Systems AI Assistant to your credentialed scans and stop triaging finding by finding. It clusters issues across roles and endpoints, ranks what to fix first, and drafts remediation guidance ready to paste into a PR. Cross-role clustering. The same underlying bug reproduced under multiple roles collapses into one work item with all the evidence attached. Plain-English findings. Every vulnerability is rewritten with the affected endpoint, role, and impact so product and security stay aligned. Risk-ranked priority. Exploitability, data sensitivity, and framework impact combine into a single defensible priority order. Auditor-ready summaries. Draft executive and compliance-mapped narratives you can edit and export from the portal. Schedule a Demo Talk to a specialist Clone Systems AI Assistant ON SHIFT What is the highest-impact fix from last night's authenticated scan? IDOR on GET /api/v2/tenants/{id}/invoices. A standard-role session can read invoices belonging to any tenant by changing the ID. Reproduced on 3 of 3 roles tested. In-scope for PCI DSS 6.4.1 and SOC 2 CC7.1. SEVERITY: 9.4 ROLE: STANDARD PCI 6.4.1 RECOMMENDED PLAN Enforce tenant-scoped authorization in the invoice controller and add a regression test for cross-tenant access. Want me to draft the ticket with reproduction steps and a rescan trigger for the fix branch? Draft ticket + rescan Show all roles RELATED MODULES Authenticated Web App Scanning is one module. Here is what pairs with it. Add network vulnerability assessment, agent-based scanning, or managed penetration testing to build a full offensive and defensive program on the same platform. Vulnerability Assessment Internal and external network scanning for the infrastructure behind your web application, from a single self-managed portal. Learn more about Vulnerability Assessment Managed Penetration Test Engineer-led offensive engagement that validates whether the authenticated findings are exploitable end-to-end. Learn more about Managed Penetration Test Agent-Based Scanning Lightweight agents give you continuous, host-level coverage of the servers and workloads that run your web application. Learn more about Agent-Based Scanning READY WHEN YOU ARE Authenticated coverage, live in days, not months. Scope your app with a senior specialist, hand off a login recipe, and see credentialed findings from your first authenticated crawl inside the CloneGuard platform. Form login, SSO, OAuth, JWT, or pre-minted session Multi-role coverage: admin, tenant, user, read-only SPA and API aware, REST and GraphQL supported Support team available to help you troubleshoot Schedule a Demo Talk scope Website (leave blank) TALK TO OUR SCANNING TEAM Scope your credentialed web app scanning Tell us about your application, roles, and login flow. A senior specialist will get back to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. CREDENTIALED WEB APP SCANNING FAQ Credentialed web app scanning questions, answered. Everything you need to know about running authenticated web app scanning with Clone Systems. Still stuck? Talk to us. What is credentialed scanning for web apps? Credentialed scanning logs into your web application like a real user and explores the authenticated experience. Instead of only mapping the public pages an anonymous crawler sees, it walks the pages, forms, and API calls behind the login wall, where most real business logic and risk live. How is this different from unauthenticated web scanning? Unauthenticated scanning only sees what a signed-out visitor sees, usually a marketing shell. Credentialed scanning replays a stored login, keeps the session alive, and exercises the dashboards, admin panels, tenant-scoped data, checkout flows, and APIs that only exist for signed-in users. Finding volume and severity are not comparable. Which login methods do you support? Standard HTML form logins, HTTP basic and digest auth, multi-step logins with MFA bypass tokens, JWT and bearer tokens, OAuth 2.0 and OIDC with a service account, SAML for enterprise SSO, and header or cookie injection with a pre-minted session. If your login is unusual, a senior specialist will help you script it. Can you scan single-page apps (React, Vue, Angular)? Yes. The scanner uses a real browser engine, executes JavaScript, waits for XHR and fetch calls to settle, and follows client-side routes. React, Vue, Angular, Svelte, and other SPA stacks are first-class targets, and API calls the SPA makes are captured and scanned directly. What about APIs? REST and GraphQL APIs are covered. Point the scanner at an OpenAPI, Swagger, Postman, or HAR file and it fuzzes every documented endpoint using your credentialed session. Undocumented endpoints found while walking the UI are added to the same run. Can you scan the app as different user roles? Yes. Configure any number of roles (admin, tenant owner, standard user, read-only, external collaborator) and the scanner runs each in an isolated session, surfacing authorization flaws such as IDOR, broken function-level access control, and privilege escalation between roles. How do you handle CSRF tokens, one-time tokens, and rate limits? The scanner re-reads CSRF and anti-forgery tokens before every request, follows rotating session tokens, and respects configurable pacing and concurrency limits so your production app is not overwhelmed. You can also point it at a dedicated staging environment. What vulnerabilities does credentialed scanning catch? OWASP Top 10 and OWASP API Top 10, including injection, broken access control, IDOR, SSRF, XSS in authenticated views, insecure deserialization, sensitive data exposure inside dashboards, misconfigured CORS, and business-logic flaws that only trigger after login. Is this self-managed? Yes. Credentialed scanning is completely self-managed through the CloneGuard portal: your team configures targets, uploads login recipes, schedules scans, and exports reports on demand. Support is available to help with login recipes, scope, and reporting. How is this different from a manual penetration test? Credentialed scanning is automated and continuous, catching regressions the moment a release ships. A managed penetration test is a human-led, deeper investigation of business logic and chained exploits. Most customers pair the two. --- ## Clone Systems AI Assistant: Private AI for Every Scan URL: https://www.clone-systems.com/cloneguard-ai-assistant HOME CLONE SYSTEMS AI ASSISTANT Clone Systems AI Assistant for vulnerability remediation . A private, self-hosted AI add-on that turns findings from every Clone Systems scan into prioritized, plain-English fixes. Add AI to my plan Talk to a specialist Private AI Our model, our data center Every Scan Add-on across all CloneGuard modules Plain English Findings your whole team understands Zero Training Your scans never train external models WHAT THE AI ASSISTANT DOES Six things your team stops doing by hand. The AI Assistant is not a chatbot bolted onto scans. It reads your findings, asset inventory, and framework mappings, then does the high-leverage work your engineers were already going to do. Plain-English Findings Every finding is rewritten in language engineers, leadership, and auditors can act on together. No CVSS jargon, no vendor bulletin walls. Risk-Ranked Priority Exploitability, asset value, and framework impact combine into a single, defensible priority order across your account. Draft Remediation Plans The assistant proposes a concrete fix path, a sensible change window, and the owner most likely to close the ticket. Auditor-Ready Summaries Draft executive and compliance-mapped narratives, editable and exportable directly from the portal. Fleet-Wide Clustering Related findings across thousands of hosts and web routes collapse into a handful of assignable work items. Ask Anything, In-Context Ask about a host, a CVE, a scan run, or a compliance requirement and get an answer grounded in your own scan data. ONE ASSISTANT, EVERY SCAN An add-on to every product in the CloneGuard scanning toolkit. Turn it on once at the account level and it becomes available inside every scanning module you subscribe to, from PCI ASV through continuous penetration testing. PCI ASV Scanning Turn ASV findings into remediation drafts your merchants and engineers can act on before the next scan window. Learn more about PCI ASV Scanning Vulnerability Assessment Cluster internal and external findings across your fleet and get a prioritized fix plan the same day the scan finishes. Learn more about Vulnerability Assessment Agent-Based Scanning Collapse thousands of agent findings into a handful of fleet-wide work items assignable through your existing tools. Learn more about Agent-Based Scanning Authenticated Web App Scanning Explain authenticated findings, IDORs, and broken access-control chains without an analyst reading each line by line. Learn more about Authenticated Web App Scanning Automated Penetration Testing Translate 30-day snapshot results into an owner-by-owner remediation punch list your team can burn down. Learn more about Automated Penetration Testing Continuous Penetration Testing Keep the story straight across quarterly and monthly runs, so leadership sees the trend, not just the latest report. Learn more about Continuous Penetration Testing Ask a question about your scans. Get a plan back. The AI Assistant reads your scan results, asset inventory, and framework mappings inside CloneGuard. Ask anything from “what should I fix first?” to “draft the SOC 2 CC7.1 narrative for this quarter,” and get an answer grounded in your own data. Grounded in your scans. Every answer references specific findings, hosts, and framework requirements from your account. Cross-module reasoning. One conversation spans PCI ASV, vulnerability, agent, credentialed, and pentest results together. Ticket-ready output. Copy a drafted plan straight into Jira, ServiceNow, or your change process. No data leaves us. Nothing is sent to third-party AI providers. Our model, our data center. Clone Systems AI Assistant ACME CORP · ALL SCANS ON SHIFT Across everything we scanned last week, what actually matters right now? 3,412 findings across PCI ASV, agent, and credentialed scans collapsed into 41 work items. One item accounts for 62% of your critical risk: an outdated payment SDK on checkout.acme.com exposed by both PCI ASV and credentialed scans. SEVERITY 9.4 PCI 6.3.3 SEEN: PCI ASV + CREDSCAN Draft a remediation plan for the checkout SDK and stage the tickets by owner. DRAFT PLAN Pin the payment SDK to 4.11.2, redeploy checkout behind the maintenance window on Thursday, then rescan with PCI ASV and credentialed. Tickets drafted for the Payments and SRE owners on record. Draft tickets Export narrative Ask about a host, a CVE, or a control… HOW THE AI ASSISTANT WORKS Enable once. Working in minutes. In every module. A predictable model your team runs on its own, with our support team a message away. 01 Enable Turn on the AI Assistant at the account level. It immediately becomes available inside every CloneGuard module you subscribe to, with no install and no infrastructure. 02 Read your context The assistant reads your scan results, asset inventory, and framework mappings inside CloneGuard. Nothing leaves our data center. 03 Cluster & prioritize Related findings across hosts, apps, and scans collapse into a small number of prioritized work items, ranked by exploitability and business impact. 04 Explain & plan Ask about a host, a CVE, or a control. Get an answer in plain English with a concrete fix path drafted for your environment. 05 Hand off Export ticket-ready summaries, auditor narratives, and remediation plans. Your team stays in control of every change. PRIVATE BY DESIGN Our AI. Our data center. Your scans stay yours. AI is new for the industry, and it should not mean quietly shipping your scan data to a third-party model provider. The Clone Systems AI Assistant is a proprietary, in-house AI stack, hosted in our own data center, with tenancy enforced at the data layer. Runs In Our Data Center The AI Assistant is our own model stack, hosted in our own data center. No calls to third-party frontier providers, no consumer AI services involved. Your Data Is Not Training Data Your scan results, hostnames, and reports are never used to train external models. Ever. Scoped To Your Account The assistant only sees the scans, assets, and reports inside your CloneGuard account. Tenancy is enforced at the data layer, not just the prompt level. Human In The Loop It explains, prioritizes, and drafts. Your engineers still approve every ticket, fix, and export. AI is the accelerator, not the decision maker. WHY TEAMS TURN IT ON Faster fixes, cleaner audits, one voice across every module. From Scan To Fix, Faster Teams stop spending Monday morning reading a 400-page PDF and start working the shortlist the assistant already ranked. One Voice Across Every Module PCI, VA, agent, credentialed, and pentest findings all get summarized in the same clear format, so leadership sees the whole program at a glance. Audits That Write Themselves Compliance-mapped narratives and evidence summaries, drafted from your live scan history and ready for QSAs, auditors, and boards. Proprietary, Not Off-The-Shelf Built by Clone Systems for Clone Systems scans, it knows what a passing ASV report looks like, what a credentialed finding means, and how your fleet has drifted over time. WHO USES THE AI ASSISTANT Built for the teams reading the scan reports today. Lean Security Teams Get the leverage of a much larger team by handing the assistant the reading, ranking, and drafting work. MSPs & Resellers Deliver clearer, faster answers to every merchant and tenant without adding analyst headcount. Compliance Owners Turn scan history into ready-to-submit narratives for PCI DSS 4.0.1, HIPAA, SOC 2, and ISO 27001 workflows. Engineering Leaders See real priorities across every scanning module, not a queue of undifferentiated CVEs your team has learned to ignore. READY WHEN YOU ARE Add AI to every scan in days, not months. Scope your environment with a senior specialist, see the Clone Systems AI Assistant running against sample scans, and get a plan to turn it on across every scanning module in your account. Works with every CloneGuard scanning product Proprietary, in-house AI. Not a third-party model Your scans are never used to train external models Enable at the account level, live in every module Schedule a Demo Talk to a specialist Website (leave blank) TALK TO OUR SCANNING TEAM Add the AI Assistant to your account Tell us which scanning modules you run today. A senior specialist will scope pricing and turn-on for your environment. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. AI ASSISTANT FAQ Clone Systems AI Assistant questions, answered. Everything you need to know about adding the Clone Systems AI Assistant to your scanning program. Still stuck? Talk to us. What is the Clone Systems AI Assistant? The Clone Systems AI Assistant is a private AI add-on inside your CloneGuard portal. It reads your scan results, explains findings in plain English, prioritizes what matters, and drafts remediation plans and ticket-ready summaries your team can act on. Which scanning products can the AI Assistant be added to? Every one of them. The AI Assistant is an add-on to PCI ASV scanning, vulnerability assessment (internal and external), agent-based scanning, credentialed web app scanning, automated penetration testing, managed penetration testing, and continuous penetration testing. If a Clone Systems scan produces findings, it can work with them. Is my scan data used to train someone else's AI model? No. The Clone Systems AI Assistant is our own private, self-hosted AI, running in our own data center. Your findings, hostnames, and reports are never shipped to third-party model providers or used to train external models. Is the AI Assistant a chatbot bolted on top of my scans? It is a purpose-built assistant with direct access to your scan context inside CloneGuard. It answers questions about your specific findings, assets, and compliance framework mappings, not a generic chatbot answering from public knowledge. Can the AI Assistant make changes to my systems automatically? No. The assistant explains, prioritizes, drafts remediation plans, and prepares ticket summaries. All changes to your systems, tickets, and workflows stay in your hands. It accelerates your team, not replaces its judgment. How does pricing work for the AI Assistant? The AI Assistant is a per-account add-on enabling the feature across every scanning module in your CloneGuard subscription. Pricing depends on your environment size and the modules you run. A senior specialist will scope it and quote a flat monthly rate. Do we need any special setup to turn it on? No. If you already have a CloneGuard account, the AI Assistant is enabled at the account level and immediately becomes available inside the modules you subscribe to. Nothing to install, no infrastructure to stand up. How is this different from open-source AI or ChatGPT-style tools? Public LLM tools have no context on your environment, do not know your scan history, and often require pasting sensitive findings into a third-party product. The Clone Systems AI Assistant is private, in-house, and already wired to your scan results, assets, and compliance mappings. --- ## Website Trust Seal: Show Visitors Your Site Is Scanned URL: https://www.clone-systems.com/trust-seal HOME WEBSITE TRUST SEAL Show visitors your site is scanned and monitored . The Clone Systems trust seal turns the services on your account into visible proof. Pick a design, copy two lines of code, and visitors can open a report showing exactly which services you have active. Purchase Online Speak with our team 2 Lines Of code to install the seal 10 Designs Pick the look that fits your site Clickable Opens your live validation report Included Covers every service on your account BUILD YOUR SEAL Pick a design, get your code. Choose the seal design, size, and placement that suit your site. The preview updates instantly and the embed code is ready to copy. Once installed, the seal reports the services tied to your account, so it lists only what you purchased. 1 Step 1: Choose your seal Pick the design that fits your site. Dark seals suit dark footers, light seals suit white backgrounds. PLACEMENT 2 Step 2: Choose the size and position Set how large the seal renders and where it sits on your pages. SIZE Large (200 x 72) Medium (175 x 63) Small (150 x 54) POSITION Bottom left corner Bottom right corner Inline where you place it Corner positions float the seal on every page. Inline places it exactly where you put the code. 3 Step 3: Copy the code Paste it into your website just before the closing body tag. EMBED SNIPPET Copy code The seal only appears on domains with an active Clone Systems account and current scans. Log in to your portal to activate your service. WHY THE SEAL MATTERS Security work your customers can actually see. You already scan. The seal makes that investment visible at the exact moment a visitor decides whether to hand over a card number, a form submission, or their attention. Visible Proof At The Moment Of Doubt Shoppers decide in seconds. A seal near your checkout or contact form answers the security question before it stops the conversion. Backed By A Real Validation Report The seal is clickable. Visitors see a live report listing the exact services active on your account, whether that is PCI compliance scanning on its own or paired with vulnerability scanning and penetration testing. Always Current The seal reflects your latest results automatically. Add a service at checkout and it appears in your report. If coverage lapses, the seal stops displaying rather than making a stale claim. Included With Your Services There is no extra product to buy. Every service you purchase through checkout is tied to your portal account and can be published on the seal at no additional cost. GET COVERED The seal goes live once your services are active. Tell us about your domains and we will confirm the right coverage. Every service on your account, from PCI compliance scanning to penetration testing, shows up in your report. Confirm which domains need coverage Match the right services to your compliance needs Publish the seal the same day your services start Purchase Online Website (leave blank) TALK TO OUR TEAM Activate your trust seal Send us your domains and security goals. A specialist will reply the same business day. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send request No spam, ever. TRUST SEAL FAQ Trust seal questions, answered. Still stuck? Talk to us. What does the trust seal prove? The seal confirms that the domain it appears on is enrolled with Clone Systems and has current scans on record. Clicking it opens a validation report listing the specific services active on your account, such as PCI compliance scanning, vulnerability scanning, or penetration testing. Which services show up in my validation report? Only the ones you purchased. The report is tied to your portal account, so if you bought PCI compliance scanning alone, the report shows PCI. If you added penetration testing or vulnerability scanning, each of those appears as its own verified service. Nothing you have not purchased is ever listed. What happens if I add another service later? The report updates automatically. When a new service is activated on your account through checkout, it appears in your validation report on the next scan cycle. You do not need to change the seal code on your site. Where should I place the code? Paste both script tags just before the closing body tag of your site template. Corner placements float the seal on every page that includes the template, and the inline option renders the seal exactly where the code sits. Why is my seal not showing up? The seal renders only on domains with an active account and current scans. If your scans have lapsed or the domain is not on your account, the script returns nothing. Log in to your portal to check the domain and service status. Does the seal slow down my site? No. The script is small, loads asynchronously alongside the rest of your page, and serves a lightweight SVG image. Can I use the seal on more than one domain? Yes, as long as each domain is covered by an active service on your account. Use the same code on every covered domain. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing Selecting security services Choose your service SECURITY SCANNING PCI Compliance Scanning Quarterly ASV scans and attestation reports. From $185/yr External Vulnerability Scanning Continuous coverage of your public attack surface. From $595/yr Internal Vulnerability Scanning Find exposures inside your private network. From $1,095/yr Agent-Based Scanning Deep visibility on every managed endpoint. From $1,195/yr Authenticated Web App Scanning Catch flaws only logged-in users reach. From $5,995/yr PENETRATION TESTING Automated External Pentest Real-world attacks against your perimeter. From $1,995 / 30 days Automated Internal Pentest Test what an insider or intruder could reach. From $2,995 / 30 days PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing?mode=pci Selecting security services PCI Compliance Scanning Select multiple PCI scanning service packages to fit your desired scope. See today’s deal Starter 1 IP ADDRESS OR DOMAIN $185/year A PCI scanning service for merchants with a single PCI-scoped asset. PCI SSC Approved ASV scanning service Quarterly compliance validation Certified PCI compliance reports SAQ support & free rescans View everything included Add to Cart RECOMMENDED Standard UP TO 10 IPS OR DOMAINS $625/year A PCI scanning service for growing PCI environments. Up to 10 PCI assets Quarterly ASV scanning service Certified compliance reports SAQ support & free rescans View everything included Add to Cart Advanced UP TO 25 IPS OR DOMAINS $1,575/year A PCI scanning service built for larger PCI environments. Up to 25 PCI assets Quarterly compliance validation Executive & technical reporting Free rescans View everything included Add to Cart Custom CUSTOM SCOPE Custom A tailored PCI scanning service for larger, multi-environment programs. Unlimited scope Multi-environment support Dedicated onboarding Custom pricing Talk to Sales Need a larger PCI scope? Contact sales to scope a larger PCI scanning service deployment sized to your cardholder environment. CONTACT SALES PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing?mode=vuln Selecting security services External Vulnerability Scanning Select multiple external vulnerability scanning service packages to fit your desired scope. See today’s deal Starter 10 PUBLIC IPS OR URLS $595/year An external vulnerability scanning service with baseline coverage for a small footprint. 10 Public IPs or URLs Agent-less scanning Executive & remediation reports Free rescans View everything included Add to Cart RECOMMENDED Standard 50 PUBLIC IPS OR URLS $2,495/year An external vulnerability scanning service for growing external footprints. 50 Public IPs or URLs Compliance-aligned test suites Web application & malware tests Free rescans View everything included Add to Cart Advanced 150 PUBLIC IPS OR URLS $5,985/year An external vulnerability scanning service built for larger internet-facing environments. 150 Public IPs or URLs Full compliance test coverage Advanced reporting & remediation Free rescans View everything included Add to Cart Need more than 150 IPs? Contact sales to scope a larger deployment sized to your external attack surface. CONTACT SALES PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing?mode=internal-vuln Selecting security services Internal Vulnerability Scanning Select multiple internal vulnerability scanning service packages to fit your desired scope. See today’s deal Starter 128 INTERNAL IPS OR URLS $1,095/year An internal vulnerability scanning service with baseline coverage for a smaller network. 128 Internal IPs or URLs VM deployed on your infrastructure Advanced reporting & remediation Free rescans View everything included Add to Cart RECOMMENDED Standard 512 INTERNAL IPS OR URLS $1,495/year An internal vulnerability scanning service for mid-sized internal networks. 512 Internal IPs or URLs VM deployed on your infrastructure Email & phone support Dedicated account manager View everything included Add to Cart Advanced 2,048 INTERNAL IPS OR URLS $2,295/year An internal vulnerability scanning service built for large internal environments and data centers. 2,048 Internal IPs or URLs VM deployed on your infrastructure Advanced reporting & remediation Dedicated account manager View everything included Add to Cart Need more than 2,048 internal IPs? Contact sales to scope a larger deployment sized to your internal network. CONTACT SALES PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing?mode=agent-vuln Selecting security services Agent-Based Vulnerability Scanning Select multiple agent-based vulnerability scanning service packages to fit your desired scope. See today’s deal Starter UP TO 25 AGENTS $1,195/year An agent-based scanning service for continuous visibility across a smaller estate. Up to 25 Agents Annual Subscription CloneGuard Portal Windows, macOS & Linux Continuous Vulnerability Monitoring Patch & Configuration Monitoring View everything included Add to Cart RECOMMENDED Standard UP TO 100 AGENTS $3,995/year An agent-based scanning service for mid-sized endpoint fleets. Up to 100 Agents Annual Subscription CloneGuard Portal Windows, macOS & Linux Continuous Vulnerability Monitoring Patch & Configuration Monitoring View everything included Add to Cart Advanced UP TO 250 AGENTS $7,995/year An agent-based scanning service built for enterprise-scale endpoint coverage. Up to 250 Agents Annual Subscription CloneGuard Portal Windows, macOS & Linux Continuous Vulnerability Monitoring Patch & Configuration Monitoring View everything included Add to Cart Need more than 250 agents? Contact sales to scope a larger deployment sized to your environment. CONTACT SALES PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing?mode=webapp-vuln Selecting security services Authenticated Web App Scanning Select multiple authenticated web app scanning service packages to fit your desired scope. See today’s deal Starter 10 AUTHENTICATED WEB APPLICATIONS $5,995/year An authenticated web app scanning service that finds vulnerabilities behind login pages. Authenticated web application scanning API security testing Authenticated vulnerability discovery Detailed remediation guidance View everything included Add to Cart RECOMMENDED Standard 50 AUTHENTICATED WEB APPLICATIONS $14,995/year An authenticated web app scanning service that finds vulnerabilities behind login pages. Authenticated web application scanning API security testing Authenticated vulnerability discovery Detailed remediation guidance View everything included Add to Cart Advanced 150 AUTHENTICATED WEB APPLICATIONS $24,995/year An authenticated web app scanning service that finds vulnerabilities behind login pages. Authenticated web application scanning API security testing Authenticated vulnerability discovery Detailed remediation guidance View everything included Add to Cart Need more than 150 applications? Contact sales to scope a larger deployment sized to your application portfolio. CONTACT SALES PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Clone Systems Coupon Code Today | Official Daily Deals URL: https://www.clone-systems.com/deals HOME DEALS Official Clone Systems coupon code . One code a day, straight from us. No sign-up and no email required. TODAY’S DEAL No code today. Check back tomorrow. Our public prices remain available now. When an official code goes live, its exact package savings will appear here. See pricing CURRENT AVAILABILITY Today’s codes by service Every online service is listed below. A code only discounts the products and packages shown as eligible. PCI Compliance Scanning Service Quarterly ASV scanning and attestation for PCI DSS. No code today, check back tomorrow. See pricing External Vulnerability Scanning Service Continuous scanning of your internet-facing assets. No code today, check back tomorrow. See pricing Internal Vulnerability Scanning Service Scanning behind the firewall by virtual machine or agent. No code today, check back tomorrow. See pricing Agent-Based Vulnerability Scanning Service Lightweight agents covering laptops, servers and cloud hosts. No code today, check back tomorrow. See pricing Authenticated Web App Scanning Service Logged-in testing of the parts of your app a visitor never sees. No code today, check back tomorrow. See pricing Automated External Penetration Testing Service Exploit-validated testing of your external attack surface. No code today, check back tomorrow. See pricing Automated Internal Penetration Testing Service Attacker-path testing across your internal network. No code today, check back tomorrow. See pricing CloneGuard AI Assistant The AI assistant add-on for triage, context and reporting. No code today, check back tomorrow. See pricing HOW THE DAILY DEAL WORKS Real prices, with the discount shown before you buy Our package prices are published prices. The regular amount on this page comes from the same rate card used on the pricing page, and the deal calculation shows what one eligible package costs after the code. A code applies only to the services, packages, order types, and coverage terms stated with that offer. It does not change taxes, expand package scope, or discount a different product in the same order. New offers appear when they become valid. Copy the code here, choose the eligible package, and enter the code in the promotional code box at checkout. Checkout confirms eligibility before payment. TOMORROW’S PREVIEW The next service will be revealed here We show only the service in advance. The code and discount remain private until the offer starts. LAST 30 DAYS Recent deal archive These official offers have ended and cannot be used at checkout. No public deals expired in the last 30 days. --- ## Automated Penetration Testing Service | Clone Systems URL: https://www.clone-systems.com/automated-penetration-testing-service HOME AUTOMATED PENETRATION TESTING Automated Penetration Testing that proves exploitability Safely simulate real-world attacks against your internal and external infrastructure with a 30-day snapshot-in-time subscription. Confirm which vulnerabilities are actually exploitable, prioritize the fixes that matter, and prove the fix worked, all inside your test window. Purchase Online Schedule a Demo MITRE ATT&CK Mapped playbooks Since 1997 MSSP and pentest heritage 24/7 SOC Assistance for your test 30 Days Snapshot-in-time subscription AUTOMATED PENTEST PLATFORM A modern automated penetration testing platform, not a scheduled scanner. Purpose-built to safely exploit, not just enumerate. Attack surface discovery, production-safe playbooks, prioritized findings, and audit-ready reports in one secure portal, as a 30-day snapshot-in-time subscription. On-Demand Test Launch Kick off a full internal or external run in minutes, no installer or field engineer required. 30-Day Snapshot Subscription A defined 30-day window to test, remediate, and retest so you get a clean snapshot in time of your security posture. Safe Exploit Validation Production-safe playbooks confirm exploitability so your team stops chasing false positives. Internal & External Coverage Perimeter, internal network, Active Directory, cloud, and web applications from one platform. MITRE ATT&CK Mapped Every finding is tagged to the ATT&CK tactic and technique attackers use in the real world. Retest Within Your Window Fix a vulnerability and re-run the exact scenario any time inside your 30-day subscription to prove the fix. Audit-Ready Reports Executive summary, technical detail with proof-of-exploit, and remediation guidance in every report. 24/7 SOC Assistance Our SOC engineers are available around the clock for questions about your automated pen test. HOW IT WORKS From scope to proven fix in five steps. No installers, no field engineers, no six-week wait. Launch on demand or on a schedule and get results while your coffee is still warm. 01 Scope and Onboard Define internal and external targets, exclusions, and testing windows in the portal. No agents required for external testing; a lightweight collector handles internal segments. 02 Attack Surface Discovery The platform enumerates your in-scope attack surface, IPs, subdomains, services, and cloud assets, at the start of your 30-day subscription. 03 Safe Exploit Validation Production-safe playbooks mapped to MITRE ATT&CK attempt real exploitation, credential reuse, and privilege escalation to confirm what an attacker could actually do. 04 Prioritize and Remediate Findings are ranked by exploitability and blast radius, with fix guidance, example configurations, and AI-drafted remediation steps. 05 Retest and Report Re-run the exact scenario to confirm the fix, then export executive and technical reports with proof-of-exploit evidence for auditors. INTERNAL AND EXTERNAL COVERAGE Test the way real attackers test. Real breaches rarely stop at the perimeter. Our platform runs both sides of the fence: outside-in against your public attack surface, and inside-out from a foothold to see how far an intruder could reach. External Attack Surface Perimeter services, exposed applications, subdomains, and shadow assets you did not know were public. Internal Network & Active Directory Lateral movement, privilege escalation, Kerberoasting, credential reuse, and misconfigured shares from an assumed-breach starting point. Web Applications Authentication flaws, injection, access control, and business-logic weak points on your public and internal apps. Cloud & Identity IAM misconfigurations, over-permissive roles, and exposed storage across AWS, Azure, and Google Cloud. WEB APPLICATION PENETRATION TESTING Authenticated testing for your web apps and APIs. Web application penetration testing is included as a capability of our automated pen test. We test behind the login, follow real user sessions, and exercise your supported APIs so the flaws only authenticated users can reach do not stay hidden. Authenticated Application Testing Testing behind the login with valid credentials, so flaws that only appear to signed-in users are found and proven. Supported API Testing Exercise the REST and service endpoints behind your app to catch broken authorization, injection, and data exposure. Session-Aware Testing Sessions, tokens, and multi-step flows are maintained through the run so deep application paths stay in scope. Business Logic Validation Checks for logic abuse such as privilege jumps, forced browsing, and workflow bypasses that signature scanners miss. Proof of Exploitation Every confirmed finding ships with technical evidence, executive reporting, and step-by-step remediation guidance. Retesting Included Fix an application finding and re-run the same test inside your 30-day window to confirm the issue is closed. WHO IT IS FOR Built for teams that need proof, not just a scan report. Security Teams Under Compliance Pressure Prove control effectiveness continuously for PCI DSS, HIPAA, SOC 2, ISO 27001, and cyber insurance renewals. Fast-Moving Engineering Orgs Catch exploitable regressions the same week they ship instead of during an annual test. IT Teams Without a Dedicated Red Team Get real attacker perspective on your environment without hiring or contracting a full test crew. Merchants and Service Providers Validate that internet-facing systems in the cardholder data environment cannot be exploited between quarterly ASV scans. COMPLIANCE EVIDENCE Reports that hold up in an audit. Every run produces an executive summary, technical detail with proof-of-exploit evidence, remediation guidance, and retest confirmation. Reports support PCI DSS 4.0.1 Requirement 11.4, HIPAA Security Rule, SOC 2 CC7, ISO 27001 A.12.6, and cyber-insurance renewals. Pair with PCI ASV Scanning and SIEM Platform for a full detect, validate, and prove cycle. PCI DSS 4.0.1 Evidence for Requirement 11.4 penetration testing on internal and external systems. HIPAA, SOC 2, ISO 27001 Recurring exploit validation to satisfy risk-analysis and continuous-monitoring controls. Cyber Insurance Fresh proof-of-exploit and remediation evidence at renewal, not a stale annual PDF. NEW · AI ADD-ON AI assistance across every stage of the pen test. Add the Clone Systems AI Assistant to any plan. It explains findings in plain English, drafts remediation for your exact stack, and ranks confirmed exploits by real business impact so your team fixes what matters first. Attack chain summaries. Turn a raw exploit trace into a clear narrative your engineers and executives can both read. Stack-aware remediation. Fix instructions and example configurations tailored to your OS, framework, and cloud provider. Exception drafting. AI drafts false-positive and compensating-control write-ups you can review, edit, and submit. Priority triage. Findings ranked by exploitability, blast radius, and business impact, not just CVSS. Add AI to your account See a live demo Clone Systems AI Assistant ONLINE What did last night's internal run actually prove? Kerberoasting on DC01 yielded a service account with local admin on 42 hosts. From there we reached the finance file share in two hops. ATT&CK: T1558.003 BLAST RADIUS: HIGH REMEDIATION Rotate the SPN account to a gMSA, enforce AES-only Kerberos, and remove local admin on the 42 hosts. Want me to schedule a retest for tomorrow at 2am? Schedule retest Export report RELATED SERVICES Extend automated testing with the rest of the Clone Systems platform. Automated pen testing pairs cleanly with expert-led engagements, external ASV scanning, and 24/7 managed detection. Managed Penetration Testing Expert-led engagements for business-logic flaws and creative attack chains automation cannot find. Learn more about Managed Penetration Testing PCI ASV Scanning Quarterly external vulnerability scanning by a PCI SSC Approved Scanning Vendor since 2007. Learn more about PCI ASV Scanning SIEM Platform 24/7 SOC monitoring so exploits confirmed here are also detected in real time in production. Learn more about SIEM Platform Vulnerability Assessment Continuous enumeration of weaknesses across your internal and external estate. Learn more about Vulnerability Assessment QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $5,995 for 10 applications. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY TO GET STARTED Launch your first test, see real results today. Same-day onboarding, production-safe playbooks, retests inside your 30-day subscription, and audit-ready reports. Talk to a security specialist and get scoping guidance for your environment. Reply from an offensive engineer Production-safe playbooks mapped to MITRE ATT&CK 30-day snapshot-in-time subscription with retests included 24/7 SOC assistance for questions about your test Start Automated Testing Website (leave blank) GET A QUOTE Talk to a Pen Test Engineer Tell us what you need tested and who is asking for the report. Pricing and next steps straight from an engineer. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. AUTOMATED PENETRATION TESTING FAQ Automated penetration testing questions, answered. Everything you need to know before your first run. Still stuck? Talk to us. How is automated penetration testing different from vulnerability scanning? Vulnerability scanning tells you what could be wrong. Automated penetration testing safely proves what an attacker could actually do with those weaknesses. Our platform chains exploits, tests credentials, and validates lateral-movement paths, then ranks findings by real business impact rather than raw CVSS score. Is automated pen testing safe to run against production? Yes. Every playbook is production-safe by default. Destructive modules are gated behind explicit opt-in, and you can exclude any host, subnet, or window from testing. Activity is logged in real time so your team can pause a run instantly. How often should we run an automated penetration test? Our automated pen test is a 30-day snapshot-in-time subscription. Within that window you can test, remediate, and retest in-scope assets as often as needed. Many customers renew around major releases, before an audit, or after any material change to production. Does this replace a manual penetration test? No. Automated testing covers the 80 percent of exploitable weaknesses that repeat across environments, freeing your human testers to focus on business-logic flaws, chained attack narratives, and creative bypasses. Most customers pair both. What does the platform actually test? External perimeter, internal network, Active Directory, cloud misconfigurations, exposed services, common web application flaws, weak and reused credentials, missing patches, and lateral-movement paths. Playbooks map to MITRE ATT&CK tactics and update as new techniques emerge. How quickly do we get results? Findings stream into the portal as the run progresses. A typical external test returns first exploitable results within minutes and a full report within hours, not weeks. Do the reports satisfy compliance requirements? Yes. Reports include an executive summary, technical detail with proof-of-exploit evidence, remediation guidance, and retest confirmation, supporting PCI DSS, HIPAA, SOC 2, ISO 27001, and cyber-insurance evidence requests. How does the AI assistant help? The Clone Systems AI Assistant explains each finding in plain English, drafts remediation steps for your stack, and can generate the exception write-up you submit for review. It also prioritizes findings by exploitability and blast radius. Is there support if we have questions during the test? Yes. Our 24/7 SOC provides assistance for any questions about your automated penetration test, from scoping to interpreting findings to remediation guidance. --- ## Continuous Penetration Testing Services | Clone Systems URL: https://www.clone-systems.com/continuous-penetration-testing HOME CONTINUOUS PENETRATION TESTING Penetration testing that never clocks out Package automated exploit validation and certified-engineer led testing into a single always-on program. Pick a cadence that matches your compliance calendar, your release velocity, and your board's appetite for surprises. Purchase Online Contact Us 12 Months Rolling coverage window Since 1998 MSSP and pentest heritage Automated + Manual One subscription, both delivered Fixed Price No mid-cycle surprises WHY CONTINUOUS A single test date cannot secure a moving target. Continuous penetration testing replaces the annual PDF with a program: scheduled automated runs, planned engineer-led engagements, and free retests, all under one subscription and calendar. Trend Lines, Not Snapshots See how your exploitability curve moves month over month and quarter over quarter instead of judging security by a single test date. Compliance on the Right Calendar Evidence is timestamped to match PCI, SOC 2, HIPAA, and ISO reporting periods so auditors never ask for a re-test. Retests Are Free and Fast Every fix triggers a targeted retest inside the same subscription. No new statement of work, no new procurement cycle. One Contract, One Team A single subscription covers automated, manual, retests, AI assistance, and portal access. One relationship, one renewal. THE ANNUAL RHYTHM What twelve months of continuous testing actually looks like. Example rhythm for a Hybrid Quarterly program. Your calendar is confirmed at kickoff and adjusted around your release schedule, audit deadlines, and change windows. Q1 Baseline & First Deep Dive Program kickoff, scope confirmation, initial automated run against internal and external estate, and, for hybrid plans, the first certified-engineer led test with a live threat model workshop. Q2 Automated Cadence & Targeted Retests Scheduled automated runs continue, focused retests confirm remediation from Q1, and any new assets brought online during the quarter get folded into scope. Q3 Change-Driven Testing On-demand automated launches around major releases and infrastructure changes, plus mid-year board narrative from the AI assistant summarizing trend and residual risk. Q4 Annual Signoff & Attestation Final engineer-led test (or dedicated deep-dive on hybrid biannual plans), rolled-up executive report, attestation letter, and planning session for the next 12 months. INSIDE EVERY SUBSCRIPTION One subscription, every capability under it. Automated Exploit Validation Scheduled and on-demand automated runs mapped to MITRE ATT&CK against external, internal, cloud, identity, and web application scope. Certified Engineer Time Included manual test hours delivered by the same offensive engineers who run our standalone managed penetration tests. Rolling Program Report One evergreen report that grows across the year, with quarterly executive summaries and per-run technical detail packaged for auditors. AI Assistant Across Every Run Attack chain summaries, stack-aware remediation, exception drafting, and trend narratives without switching tools. Assigned Program Lead A senior specialist owns the calendar, scope changes, kickoff calls for each manual test, and quarterly reviews. Unlimited Retests in Scope Fix a finding, retest it, and prove the fix. Retests never count against your subscription or your engineer hours. WHO IT IS FOR Built for programs, not one-off tests. Compliance-Driven Programs Teams that live inside PCI DSS 4.0.1, HIPAA, SOC 2, and ISO 27001 audit cycles and need continuous evidence, not annual scrambles. Multi-Environment Enterprises Organizations with production, staging, cloud, and third-party attack surfaces that change too fast for a once-a-year test to matter. Boards and Cyber-Insurance Underwriters Leadership groups that expect a defensible trend line instead of a one-page PDF at renewal. MSPs and Resellers Service providers offering a bundled security stack who need a white-labelable continuous testing program to attach. COMPLIANCE COVERAGE Continuous evidence for every framework auditors ask about. Program reporting is labeled to the frameworks you name at kickoff. Pair with PCI ASV Scanning for quarterly external attestation and SIEM Platform so real production detections back up every test finding. PCI DSS 4.0.1 Requirement 11.4 penetration testing across the year, with automated runs supporting change-driven testing between manual engagements. SOC 2, HIPAA, ISO 27001, NIST Rolling evidence for CC4/CC7 monitoring, HIPAA evaluation, ISO A.12.6 and A.8.29, and NIST 800-53 CA-8 and RA-5. Cyber Insurance & Board Reporting Trend narratives and remediation velocity metrics that underwriters and boards prefer over a single annual PDF. RELATED SERVICES Pair continuous testing with the rest of the Clone Systems platform. Agent Based Scanning Lightweight always-on agents that inventory software and surface vulnerabilities wherever assets roam. Learn more about Agent Based Scanning Vulnerability Scanning Self-managed internal and external vulnerability scanning mapped to every major compliance framework. Learn more about Vulnerability Scanning PCI ASV Scanning Quarterly external vulnerability scanning by a PCI SSC Approved Scanning Vendor since 2007. Learn more about PCI ASV Scanning SIEM Platform 24/7 detection so every exploit proven in a test is also caught in production. Learn more about SIEM Platform BUILD YOUR PROGRAM Tell us the cadence, we will build the plan. Share your compliance drivers, in-scope assets, and how often you need engineer-led testing. A senior specialist will map it to a fixed annual subscription and introduce the certified engineers who will run it. Fixed annual pricing, no mid-cycle surprises Automated and engineer-led testing under one contract Unlimited retests inside your program scope Rolling report tuned to your audit calendar Design My Program Website (leave blank) GET A QUOTE Scope a Continuous Program Tell us the cadence, scope, and compliance drivers. A senior specialist will follow up to map it to the right continuous plan. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. CONTINUOUS PENETRATION TESTING FAQ Continuous testing questions, answered. Everything you need to know before you sign an annual program. Still stuck? Talk to us. What is continuous penetration testing? A subscription that keeps a penetration test running all year instead of once. You choose the cadence of automated runs and how many certified-engineer led tests are included, and Clone Systems packages both into one contract, one portal, and one rolling report. Why not just run one annual penetration test? Environments change every week: new services ship, cloud roles get widened, third parties are onboarded, and identities drift. An annual test is a snapshot of a system that no longer exists by month three. Continuous testing keeps the picture current between audits. Can I mix automated and manual testing? Yes, that is the whole point. Common blends include monthly automated runs with one certified-engineer led test per year, quarterly automated runs paired with two manual engagements, and fully manual quarterly testing for high-assurance environments. Describe the cadence you need and we can package it. How is this different from the 30-day automated pen test? The 30-day automated pen test is a fixed snapshot. Continuous rolls that engine into a year-long or multi-year subscription with a scheduled rhythm, added engineer time, and reporting that tracks trend lines instead of a single window. Which compliance requirements does continuous testing satisfy? PCI DSS 4.0.1 Requirement 11.4, HIPAA Security Rule risk analysis and evaluation, SOC 2 CC4 and CC7 monitoring controls, ISO 27001 A.12.6 and A.8.29, NIST 800-53 CA-8 and RA-5, and cyber-insurance renewal evidence. Reports are labeled to the framework you name at kickoff. Do we get a fixed price for the year? Yes. Every continuous program is a fixed annual or multi-year subscription. Add-ons like extra manual tests, new subsidiaries, or scope expansions are quoted up front, so procurement never sees a surprise mid-cycle. What happens when we find a critical finding between scheduled tests? You can launch an on-demand automated run inside your subscription at any time, and your assigned certified engineer is reachable through the portal for exploit validation questions. Critical findings never wait for the next quarterly cycle. Can the AI assistant help across the year? Yes. The Clone Systems AI Assistant runs across every automated and manual finding in your program, tracks remediation status, and drafts the trend narrative for your quarterly board report. --- ## Managed Penetration Testing Services | Clone Systems URL: https://www.clone-systems.com/managed-penetration-testing-services HOME MANAGED PENETRATION TESTING Managed Pen Testing that proves your defenses hold Expert-led testing across network, web, mobile, API, cloud, and wireless. Every engagement starts with a scoping call with your engineer, and the final report is written by the engineer who ran your test. Free remediation retest included. Schedule a Demo Learn More Since 2003 Delivering engagements MITRE ATT&CK Aligned tradecraft Engineer-Led On every test Free Retest After remediation WHAT WE TEST Every layer, tested by a real engineer. The only thing we do not do is in-person, on-site physical intrusion. Everything else is delivered remotely from our SOC. External Network Perimeter services, exposed apps, and shadow assets tested from the public internet. Internal & Active Directory Assumed-breach lateral movement, Kerberoasting, and privilege escalation. Web Application Auth, injection, access control, and business-logic testing beyond OWASP Top 10. Mobile Application iOS and Android client, transport, and backend API abuse. API & Microservices REST, GraphQL, and gRPC broken auth, mass assignment, and rate-limit bypass. Cloud (AWS, Azure, GCP) IAM, over-permissive roles, exposed storage, and cloud-native attack paths. Wireless Remote wireless assessments of enterprise Wi-Fi, guest, and segmentation. Red Team Objective-driven, multi-vector attack simulation under stealth conditions. Source Code Review Manual and tool-assisted review of auth, crypto, and dangerous sinks. HOW IT WORKS Scoping call to passing retest in six steps. We scope, kick off with your engineer, test, report, and retest until you have a clean, defensible result. 01 Scoping & SOW Fixed scope, timeline, and statement of work with no surprise fees. 02 Engineer Kickoff Call A call with your assigned engineer confirms targets, credentials, and rules of engagement. 03 Active Testing Your engineer executes the scope with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from your engineer covering findings, evidence, and remediation. 05 Remediation Window You fix. Your engineer stays available for questions throughout. 06 Free Remediation Retest We retest the in-scope findings so you receive a passing result. ENGINEER KICKOFF CALL Every test starts with a real conversation. Before a single packet is sent, you meet the certified engineer running your test. We confirm scope, catch gaps, and lock rules of engagement in writing. Confirm scope and targets. IP ranges, apps, cloud accounts, identities, and anything out of scope. Agree rules of engagement. Windows, blackout periods, notification thresholds, and escalation contacts. Verify credentials and access. For authenticated tests, we confirm access works before day one. Meet your engineer. You know exactly who is on your engagement and how to reach them. Kickoff Call · Agenda SCHEDULED 00:00 Introductions & assigned engineer 00:05 In-scope assets & credentials 00:15 Out-of-scope systems & blackout windows 00:25 Rules of engagement & escalation 00:40 Reporting cadence & deliverables 00:50 Q&A and confirm start date Direct engineer channel open for the whole engagement. DELIVERABLES A real report, written by your engineer. Your final report is a hand-written summary from the certified engineer who ran the test, not an auto-generated portal export. Need continuous, dashboard-driven visibility? SIEM Platform is built for that. Engineer-Written Executive Summary Scope, posture, top findings, and business impact, authored by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, evidence, severity, and remediation for every issue. Auditor-Ready PDF Share with auditors, customers, and cyber-insurance underwriters. Remediation Retest Report Updated report after retest so you can prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. Regulated Enterprises Defensible pen test evidence for PCI, HIPAA, SOC 2, ISO 27001, and FedRAMP. SaaS & Product Companies Fresh engineer-led reports and passing retests for enterprise security questionnaires. Merchants & Payment Providers PCI DSS 4.0.1 Requirement 11.4 across internal, external, and segmentation. Cloud-Native & Hybrid Purpose-built assessments across AWS, Azure, GCP, containers, and identity. COMPLIANCE EVIDENCE Reports that hold up in an audit. Defensible evidence for the frameworks your business is measured against. Pair with PCI ASV Scanning and Automated Pen Testing for continuous coverage. PCI DSS 4.0.1 Requirement 11.4 across internal, external, and segmentation boundaries. HIPAA, SOC 2, ISO 27001 Independent evidence for risk analysis and Annex A.12.6 controls. FedRAMP & Cyber Insurance Recent engineer-led reports and retests for renewals. RELATED SERVICES Pairs cleanly with the rest of the platform. Add continuous validation, ASV scanning, and 24/7 managed detection for full coverage. Automated Pen Testing 30-day snapshot subscription that validates exploitability between engagements. Learn more about Automated Pen Testing PCI ASV Scanning Quarterly external scanning by a PCI SSC Approved Scanning Vendor since 2007. Learn more about PCI ASV Scanning SIEM Platform 24/7 SOC monitoring so what a pen test proves is also detected in production. Learn more about SIEM Platform READY TO SCOPE YOUR ENGAGEMENT Talk to a specialist, get an honest scope. Share your environment and goals. A senior specialist will scope the right test, introduce the certified engineer who will run it, and confirm your free remediation retest. Certified offensive engineer on every engagement Kickoff call before testing begins Engineer-written final report, not an auto-generated export Free remediation retest for a passing result Scope My Engagement Website (leave blank) GET A QUOTE Scope a Penetration Test Tell us about your environment and goals. A senior specialist will follow up to scope the right test and set up your engineer kickoff call. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. MANAGED PENETRATION TESTING FAQ Managed pen testing, answered. Everything you need before your kickoff call. Talk to us. What is managed penetration testing? Managed penetration testing is an expert-led, human-driven assessment where our offensive engineers safely simulate real-world attacks against your systems, applications, or cloud environments. Unlike a self-service scanner, it is scoped, executed, and reported by a certified engineer who chains findings into a real attack narrative and hands you a clear remediation path. What kinds of penetration tests do you offer? We test just about everything: external and internal network, web applications, mobile applications (iOS and Android), APIs, cloud environments (AWS, Azure, Google Cloud), wireless, Active Directory (assumed-breach and unauthenticated), source-code review, and full red-team engagements. The only thing we do not do is in-person, on-site physical penetration testing. How does a managed test start? Every engagement begins with a kickoff call between your team and the assigned certified engineer to confirm scope, targets, credentials, test windows, out-of-scope systems, points of contact, and rules of engagement. Once we agree on everything in writing, testing begins. How is this different from automated penetration testing? Automated testing safely validates the eighty percent of exploitable weaknesses that repeat across environments, with a 30-day snapshot subscription to retest inside. Managed testing puts a human offensive engineer on your environment to find business-logic flaws, chained attack paths, and creative bypasses automation cannot see. Most mature security teams pair the two. Do we get a dashboard during the test? Managed penetration testing is a delivered engagement, not a dashboard product. You get a dedicated engineer, direct communication throughout, and a formal report hand-written by the engineer who ran your test. For a live security dashboard, our SIEM and Endpoint Protection service is built for that. How are results delivered? Your final report is a real summary written by the certified engineer who ran your test, not an auto-generated portal export. You receive it as a formal PDF to share with auditors, insurers, and customers, including an executive summary, technical findings with proof-of-exploit evidence, severity and business impact ranking, and remediation guidance for every issue. Do you retest after we remediate? Yes. After the first test we give you time to remediate findings, then rescan the same in-scope assets so you receive a passing result and an updated report to hand to your auditor, customer, or cyber-insurance underwriter. Do you do in-person or on-site testing? No. We deliver every engagement remotely from our SOC, including external, internal (via a lightweight collector or VPN), cloud, wireless, application, and red-team assessments, without sending a person to your site. How long does a typical engagement take? Timelines depend on scope. A focused external or web application test is usually one to two weeks of active testing plus reporting; larger internal, cloud, or red-team engagements run three to six weeks. We commit to a fixed calendar window in the statement of work so your team can plan around it. Do your reports satisfy PCI, HIPAA, SOC 2, ISO 27001, and cyber insurance? Yes. Our reports are designed as audit evidence and directly support PCI DSS 4.0.1 Requirement 11.4, HIPAA Security Rule risk analysis, SOC 2 CC7, ISO 27001 A.12.6, FedRAMP, and cyber-insurance renewals. We have delivered penetration tests for auditors and regulators since 2003. --- ## Web Application Penetration Testing | Clone Systems URL: https://www.clone-systems.com/web-application-penetration-testing HOME MANAGED PENTEST WEB APPLICATION PENETRATION TESTING Web application penetration testing by a real engineer A certified engineer from our SOC tests your web application remotely with real attacker tradecraft mapped to MITRE ATT&CK, then hand-writes your report. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST Your application, tested the way attackers use it. Authenticated and unauthenticated testing that goes beyond the OWASP Top 10. Authentication & Sessions Login, password reset, multi-factor and session handling. Injection Injection flaws across inputs, parameters and requests. Access Control Privilege escalation and data access between user roles. Business Logic Flaws in how your application's workflows can be abused. Beyond the OWASP Top 10 Testing that does not stop at a standard checklist. Behind the Login Authenticated testing with credentials for each role. Faster option. Need a quick automated test first? Automated external pen tests include authenticated web app testing and can be bought online today. See automated pricing HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. SaaS & Product Companies Engineer-led reports for customer security reviews and questionnaires. Merchants & Payment Pages Testing of applications that support PCI DSS 4.0.1 Requirement 11.4. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope a Web App Pen Test Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. WEB APPLICATION PENETRATION TESTING FAQ Web Application Penetration Testing, answered. What is a web application penetration test? It is an expert-led test where a certified engineer attacks your web application the way a real attacker would, covering authentication and session handling, injection, access control between user roles and business-logic flaws. You receive a hand-written report with proof-of-exploit, severity and remediation for every issue. How is it different from a web app vulnerability scan? A scan reports possible weaknesses automatically. A penetration test puts an engineer on your application to confirm what is exploitable, chain issues together and find business-logic and access control flaws that scanners do not understand, with reproduction steps for each finding. Do you test behind the login? Yes. Authenticated testing behind the login is part of the scope. Test credentials for each user role are confirmed on the kickoff call so your engineer can test privilege escalation between roles. Will testing affect our live site? Scope, timing windows and rules of engagement are agreed on the kickoff call before testing starts, including blackout windows and escalation contacts, so testing runs on your terms. Do you retest after we fix things? Yes. A free remediation retest of in-scope findings is included. After you fix the issues, your engineer retests them and you receive an updated retest report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## API Penetration Testing for REST, GraphQL and gRPC | Clone Systems URL: https://www.clone-systems.com/api-penetration-testing HOME MANAGED PENTEST API PENETRATION TESTING API penetration testing that finds what scanners miss A certified engineer from our SOC tests your APIs and microservices remotely with real attacker tradecraft mapped to MITRE ATT&CK, then hand-writes your report. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST Every endpoint, tested by a real engineer. REST, GraphQL and gRPC APIs and the microservices behind them. REST, GraphQL & gRPC APIs and microservices across all three styles. Broken Authentication & BOLA Broken authentication and broken object level authorization. Mass Assignment Fields and properties that should never be writable. Rate-Limit Bypass Ways around throttling and abuse protections. Injection Injection flaws through API parameters and payloads. Data Exposure & Logic Abuse Excess data in responses and business-logic abuse. Faster option. Automated pen tests include testing of supported APIs behind your web app. See automated pricing HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. SaaS & Platform Companies Proof for enterprise customers that your APIs were tested by an engineer. Microservice Architectures Testing across services, not just the public front door. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope an API Pen Test Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. API PENETRATION TESTING FAQ API Penetration Testing, answered. What is an API penetration test? It is an expert-led test where a certified engineer attacks your APIs the way a real attacker would, looking for broken authentication, broken object level authorization, mass assignment, rate-limit bypass, injection, data exposure and business-logic abuse. You receive a hand-written report with proof-of-exploit and remediation. Which API types do you test? We test REST, GraphQL and gRPC APIs and microservices. What do you need from us before testing? API documentation or a collection, plus test credentials for each role. These are confirmed on the kickoff call before testing starts. Is an API pen test needed for SOC 2 or PCI? If your APIs are part of the systems in scope, testing them gives your auditor direct evidence. Our reports support PCI DSS 4.0.1 Requirement 11.4 and SOC 2, as well as HIPAA, ISO 27001, FedRAMP and cyber insurance renewals. Do you retest after we fix things? Yes. A free remediation retest of in-scope findings is included. After you fix the issues, your engineer retests them and you receive an updated retest report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## Cloud Penetration Testing for AWS, Azure and GCP | Clone Systems URL: https://www.clone-systems.com/cloud-penetration-testing HOME MANAGED PENTEST CLOUD PENETRATION TESTING Cloud penetration testing for AWS, Azure and Google Cloud A certified engineer from our SOC tests your cloud environment remotely with real attacker tradecraft mapped to MITRE ATT&CK, then hand-writes your report. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST Your cloud, tested the way attackers move through it. AWS, Azure and Google Cloud, including containers and hybrid environments. IAM Misconfigurations Over-permissive roles and policies that grant too much. Exposed Storage Storage that is reachable when it should not be. Identity Attack Paths How an attacker could move from one identity to more access. Cloud-Native Attack Paths Chains of cloud services an attacker could abuse. Containers Container workloads and the permissions around them. Hybrid Environments Connections between cloud and on-premises systems. Faster option. Automated pen tests cover cloud and identity misconfigurations too, bought online. See automated pricing HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. Cloud-Native & Hybrid Assessments across AWS, Azure, Google Cloud, containers and identity. SaaS & Product Companies Engineer-led evidence for customer security reviews. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope a Cloud Pen Test Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. CLOUD PENETRATION TESTING FAQ Cloud Penetration Testing, answered. What is a cloud penetration test? It is an expert-led test where a certified engineer looks for the ways an attacker could abuse your cloud environment, including IAM misconfigurations and over-permissive roles, exposed storage, identity attack paths, cloud-native attack paths, containers and hybrid connections. Which cloud providers do you test? We test AWS, Microsoft Azure and Google Cloud, including hybrid environments that connect them to on-premises systems. Do we need permission from AWS, Azure or Google? Each provider publishes its own penetration testing policy. We confirm the scope against that policy with you on the kickoff call before testing starts. What access do you need? The access depends on the scope. The accounts, credentials and rules of engagement your engineer needs are agreed on the kickoff call and confirmed before testing begins. Do you retest after we fix things? Yes. A free remediation retest of in-scope findings is included. After you fix the issues, your engineer retests them and you receive an updated retest report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## Internal Network and Active Directory Penetration Testing | Clone Systems URL: https://www.clone-systems.com/internal-network-penetration-testing HOME MANAGED PENTEST INTERNAL NETWORK PENETRATION TESTING Internal network and Active Directory penetration testing A certified engineer from our SOC tests your internal network remotely from an assumed-breach position, using real attacker tradecraft mapped to MITRE ATT&CK. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST What an attacker could do once inside. Assumed-breach testing from inside your network, delivered remotely. Assumed Breach Testing that starts from inside the network. Lateral Movement How far an attacker could move from one foothold. Kerberoasting Attacks against Active Directory service accounts. Credential Reuse Passwords and credentials reused across systems. Path to Domain Admin Privilege escalation toward domain admin. Misconfigured Shares File shares exposing data or credentials. Segmentation Testing Network segmentation, including PCI DSS segmentation. Faster option. Need it this week? Automated internal pen tests can be bought online and start the same day. See automated pricing HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. Merchants & Payment Providers Internal and segmentation testing for PCI DSS 4.0.1 Requirement 11.4. Active Directory Environments Testing how far an attacker could get inside your domain. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope an Internal Pen Test Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. INTERNAL NETWORK PENETRATION TESTING FAQ Internal Network Penetration Testing, answered. What is an internal penetration test? It is an expert-led test of what an attacker could do from inside your network, including lateral movement, Kerberoasting, credential reuse, misconfigured shares and privilege escalation to domain admin, plus network segmentation testing. Do you need to come on site? No. Internal penetration testing is delivered remotely by a certified engineer from our SOC. What is an assumed-breach test? An assumed-breach test starts from the position of an attacker who already has a foothold inside your network. It shows how far that attacker could move and how much access they could gain. Does PCI DSS require internal and segmentation testing? PCI DSS 4.0.1 Requirement 11.4 covers internal penetration testing and, where segmentation is used to reduce scope, testing of that segmentation. Our reports support Requirement 11.4. Do you retest after we fix things? Yes. A free remediation retest of in-scope findings is included. After you fix the issues, your engineer retests them and you receive an updated retest report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## External Network Penetration Testing | Clone Systems URL: https://www.clone-systems.com/external-network-penetration-testing HOME MANAGED PENTEST EXTERNAL NETWORK PENETRATION TESTING External network penetration testing from the attacker's side A certified engineer from our SOC tests your internet-facing systems remotely with real attacker tradecraft mapped to MITRE ATT&CK, then hand-writes your report. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST Everything an attacker can reach from the internet. Testing from the public internet, with exploitation attempts and proof. Perimeter Services Internet-facing services across your external footprint. Exposed Applications Applications reachable from the public internet. Subdomains & Shadow Assets Forgotten subdomains and assets you may not know are exposed. Firewall & VPN Exposure What your firewall and VPN reveal to the outside. Exploitation With Proof Exploitation attempts documented with proof. Faster option. Need it today? Automated external pen tests can be bought online and start the same day. See automated pricing HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. Merchants & Payment Providers External testing that supports PCI DSS 4.0.1 Requirement 11.4. SaaS & Product Companies Engineer-led evidence for customer security reviews. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope an External Pen Test Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. EXTERNAL NETWORK PENETRATION TESTING FAQ External Network Penetration Testing, answered. What is an external penetration test? It is an expert-led test of everything an attacker can reach from the public internet, including perimeter services, exposed applications, subdomains, shadow assets, firewall and VPN exposure, with exploitation attempts documented with proof. How is it different from a PCI ASV scan? An ASV scan is an automated external vulnerability scan that meets PCI DSS Requirement 11.3.2. An external penetration test puts an engineer on your perimeter to attempt exploitation and prove what an attacker could actually do. Clone Systems has been a PCI Approved Scanning Vendor since 2007 and offers both. Does PCI DSS require an external pen test? Yes. PCI DSS 4.0.1 Requirement 11.4 covers external penetration testing. Our reports are written to support Requirement 11.4. Will testing disrupt our services? Testing windows and rules of engagement, including blackout windows and escalation contacts, are agreed on the kickoff call before testing starts. Do you retest after we fix things? Yes. A free remediation retest of in-scope findings is included. After you fix the issues, your engineer retests them and you receive an updated retest report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## Mobile App Penetration Testing for iOS and Android | Clone Systems URL: https://www.clone-systems.com/mobile-app-penetration-testing HOME MANAGED PENTEST MOBILE APP PENETRATION TESTING Mobile app penetration testing for iOS and Android A certified engineer from our SOC tests your mobile app and its backend remotely with real attacker tradecraft mapped to MITRE ATT&CK, then hand-writes your report. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST The app, the device and the APIs behind them. iOS and Android testing that follows the data from the device to your backend. iOS & Android Client The app itself on both platforms. Data Stored on the Device What the app leaves behind on the phone. Transport Security How the app protects data in transit. Backend API Abuse Abuse of the backend APIs the app talks to. HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. App Publishers Engineer-led evidence for customers and partners. Payments & Commerce Apps Testing of apps that handle sensitive transactions. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope a Mobile App Pen Test Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. MOBILE APP PENETRATION TESTING FAQ Mobile App Penetration Testing, answered. What is a mobile app penetration test? It is an expert-led test of your iOS or Android app, covering the client, data stored on the device, transport security and abuse of the backend APIs the app talks to. You receive a hand-written report with proof-of-exploit and remediation. Do you test both iOS and Android? Yes. We test iOS and Android apps. Do you test the backend API too? Yes. Abuse of the backend APIs the app talks to is part of the scope. What do you need from us? App builds or store access, plus test accounts. These are confirmed on the kickoff call before testing starts. Do you retest after we fix things? Yes. A free remediation retest of in-scope findings is included. After you fix the issues, your engineer retests them and you receive an updated retest report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## Wireless Penetration Testing | Clone Systems URL: https://www.clone-systems.com/wireless-penetration-testing HOME MANAGED PENTEST WIRELESS PENETRATION TESTING Wireless penetration testing, delivered remotely A certified engineer from our SOC assesses your wireless networks remotely with real attacker tradecraft mapped to MITRE ATT&CK, then hand-writes your report. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST Your Wi-Fi, tested without a site visit. Remote wireless assessments planned on the scoping and kickoff calls. Enterprise Wi-Fi Remote assessment of your corporate wireless networks. Guest Networks Wireless networks offered to visitors and guests. Guest to Internal Segmentation Whether guest networks are kept apart from internal ones. HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. Retail & Hospitality Guest Wi-Fi kept separate from internal and payment systems. Multi-Site Offices Wireless assessed without sending a person to each site. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope a Wireless Pen Test Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. WIRELESS PENETRATION TESTING FAQ Wireless Penetration Testing, answered. What is a wireless penetration test? It is an expert-led assessment of your wireless networks, including enterprise Wi-Fi, guest networks and the segmentation between guest and internal networks. How can wireless be tested remotely? The remote setup for your environment is planned with you on the scoping and kickoff calls, so a certified engineer can run the assessment from our SOC without visiting your site. Do you test guest network separation? Yes. Segmentation between guest and internal networks is part of the scope. Does PCI DSS cover wireless? Yes. PCI DSS includes requirements for wireless networks. Our reports support PCI DSS 4.0.1 Requirement 11.4 as well as HIPAA, SOC 2, ISO 27001, FedRAMP and cyber insurance renewals. Do you retest after we fix things? Yes. A free remediation retest of in-scope findings is included. After you fix the issues, your engineer retests them and you receive an updated retest report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## Red Team Assessment Services | Clone Systems URL: https://www.clone-systems.com/red-team-assessment HOME MANAGED PENTEST RED TEAM ASSESSMENT Red team assessments that test your people, process and technology A certified engineer from our SOC runs an objective-driven attack simulation remotely with real attacker tradecraft mapped to MITRE ATT&CK, then hand-writes your report. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST A real attack, run to an objective. Remote only. We do not do in-person, on-site physical intrusion. Objective-Driven An attack simulation built around goals agreed with you. Multi-Vector Combining attack paths the way a real adversary would. Stealth Conditions Run quietly to see what your defenses notice. Detection & Response Measures whether your team detects and responds. HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. Security Teams With a SOC Proof of whether detection and response work under pressure. Mature Security Programs Going beyond a scoped pen test to test the whole program. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope a Red Team Assessment Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. RED TEAM ASSESSMENT FAQ Red Team Assessment, answered. What is a red team assessment? It is an objective-driven, multi-vector attack simulation run under stealth conditions. It measures whether your people, process and technology detect and respond to a real attack. How is red teaming different from a penetration test? A penetration test aims to find and prove as many weaknesses as possible within a defined scope. A red team assessment works toward a specific objective under stealth and measures whether your team detects and responds. Does our security team know it is happening? That is decided with you during scoping. Do you do physical break-ins? No. We do not do in-person, on-site physical intrusion. Red team assessments are delivered remotely. What do we get at the end? A report hand-written by the engineer who ran the assessment, with an executive summary, technical findings with proof-of-exploit and reproduction steps, and severity and remediation for every issue, delivered as an auditor-ready PDF. A free remediation retest of in-scope findings is included. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## Secure Source Code Review | Clone Systems URL: https://www.clone-systems.com/source-code-review HOME MANAGED PENTEST SECURE SOURCE CODE REVIEW Secure source code review by an engineer A certified engineer from our SOC reviews your code manually and with tools, then hand-writes your report with severity and remediation for every issue. Free remediation retest included. Scope My Test See All Pen Test Types Since 1998 Managed security PCI ASV Since 2007 MITRE ATT&CK Aligned tradecraft Free Retest After remediation WHAT WE TEST The code paths attackers look for. Manual and tool-assisted review by an engineer, not just a scanner. Authentication How users and sessions are verified in code. Cryptography How data is encrypted, hashed and protected. Input Handling How untrusted input is validated and processed. Dangerous Sinks Code that turns bad input into real damage. HOW IT WORKS Scoping call to passing retest in six steps. Expert-led and delivered remotely by a certified engineer from the Clone Systems SOC. 01 Scoping & SOW A scoping call and a fixed statement of work with no surprise fees. 02 Engineer Kickoff Call Your engineer confirms targets, credentials, rules of engagement, blackout windows and escalation contacts. 03 Active Testing Your engineer tests remotely from our SOC with real attacker tradecraft mapped to MITRE ATT&CK. 04 Reporting A hand-written report from the engineer who ran your test, with evidence and remediation. 05 Remediation Window You fix the findings. Your engineer stays available for questions. 06 Free Remediation Retest We retest in-scope findings and issue an updated retest report to prove closure. ENGINEER KICKOFF CALL Every test starts with a real conversation. After the scoping call and a fixed statement of work, you meet the certified engineer running your test before testing starts. Confirm targets. Exactly what is in scope and what is not. Verify credentials. Access for authenticated testing is confirmed up front. Agree rules of engagement. Testing windows, blackout windows and escalation contacts. Meet your engineer. You know who is running your test and how to reach them. Kickoff Call · Agenda 01 Introductions and assigned engineer 02 Targets and credentials 03 Rules of engagement 04 Blackout windows 05 Escalation contacts 06 Confirm start date Your engineer stays reachable through the engagement. DELIVERABLES A real report, written by your engineer. Your final report is hand-written by the engineer who ran the test, not an auto-generated export. See what is in a pen test report. Engineer-Written Executive Summary Written by the engineer who ran your test. Technical Findings & Proof-of-Exploit Reproduction steps, severity and remediation for every issue. Auditor-Ready PDF Share with auditors, customers and cyber insurance underwriters. Remediation Retest Report A free retest of in-scope findings and an updated report to prove closure. WHO IT IS FOR Built for teams that need audit-defensible proof. Software Companies An engineer's review of the code your customers rely on. Development Teams Findings tied to specific code with clear remediation. Regulated Organizations Evidence for PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and FedRAMP. Cyber Insurance Renewals An engineer-written report and retest report to share with your underwriter. COMPLIANCE EVIDENCE Reports that hold up in an audit. Clone Systems has provided managed security since 1998 and has been a PCI Approved Scanning Vendor since 2007, based in Philadelphia, PA. PCI DSS 4.0.1 Supports Requirement 11.4 penetration testing. HIPAA, SOC 2, ISO 27001 Independent, engineer-written evidence for your auditors. FedRAMP & Cyber Insurance Reports and retest reports for assessments and renewals. READY TO SCOPE YOUR TEST Talk to a specialist, get an honest scope. Tell us what you need tested. We will set up a scoping call and send a fixed statement of work with no surprise fees. Certified engineer from our SOC on every test Kickoff call before testing begins Engineer-written report, not an auto-generated export Free remediation retest of in-scope findings Website (leave blank) GET A QUOTE Scope a Source Code Review Tell us what you need tested and who is asking for the report. We will set up a scoping call and a fixed statement of work. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request quote No spam, ever. SECURE SOURCE CODE REVIEW FAQ Secure Source Code Review, answered. What is a secure code review? It is a manual and tool-assisted review of your source code by an engineer, focused on authentication, cryptography, input handling and dangerous sinks. How is it different from a penetration test? A penetration test attacks your running systems from the outside. A secure code review reads the source code itself, which can find issues in code paths that are hard to reach in testing. Many teams use both. Which languages do you review? Languages are confirmed during scoping. How do you handle our code securely? How your code is shared, stored and handled is agreed in the statement of work before the review begins. Do you re-review after fixes? Yes. A free remediation retest of in-scope findings is included, with an updated report to prove closure. Not sure which test you need? Take the pen test finder. What does a pen test cost? See penetration test pricing. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing?mode=pentest Selecting security services External Penetration Testing Perform real world attack simulations on your infrastructure to identify existing vulnerabilities and obtain recommendations to improve your overall security. See today’s deal One-Time Annual Starter 1 EXTERNAL IP OR DOMAIN $1,995/30 days An automated penetration testing service for a single external asset. 1 External IP or Domain No Software Installation Executive & remediation reports Free rescans View everything included Add to Cart RECOMMENDED One-Time Annual Standard 10 EXTERNAL IPS OR DOMAINS $3,495/30 days An automated penetration testing service for comprehensive testing of growing external environments. 10 External IPs or Domains Compliance-aligned exploit suite Authenticated Web Application Testing Free rescans View everything included Add to Cart One-Time Annual Advanced 50 EXTERNAL IPS OR DOMAINS $6,495/30 days An automated penetration testing service built for larger internet-facing environments. 50 External IPs or Domains Email & phone technical support Full compliance exploit coverage Free rescans View everything included Add to Cart Do you require broader coverage? Contact sales to size a larger deployment for your environment, including manual penetration testing. CONTACT SALES PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Pricing: PCI ASV Scans, Vulnerability Scans, Pen Tests URL: https://www.clone-systems.com/pricing?mode=internal-pentest Selecting security services Internal Penetration Testing Simulate an attacker already inside your network with Active Directory, privilege escalation, and lateral movement testing. Select multiple packages to fit your scope. See today’s deal One-Time Annual Starter UP TO 25 LIVE INTERNAL HOSTS $2,995/30 days An automated internal penetration testing service focused on smaller internal environments. Up to 25 Live Internal Hosts Active Directory assessment Privilege escalation testing Executive & remediation reports Retesting included View everything included Add to Cart RECOMMENDED One-Time Annual Standard UP TO 100 LIVE INTERNAL HOSTS $6,995/30 days An automated internal penetration testing service with comprehensive assessment of growing internal networks. Up to 100 Live Internal Hosts Active Directory assessment Lateral movement testing Executive & remediation reports Retesting included View everything included Add to Cart One-Time Annual Advanced UP TO 250 LIVE INTERNAL HOSTS $12,995/30 days An automated internal penetration testing service designed for larger enterprise environments. Up to 250 Live Internal Hosts Active Directory assessment Network segmentation testing Executive & remediation reports Retesting included View everything included Add to Cart Need a larger internal scope? Contact sales to size internal host coverage to your network. CONTACT SALES PRICING FAQ Common questions about plans and features. Not sure which package fits? Talk to our team and we’ll help you scope it. How is CloneGuard pricing structured? Every order is built from three service families: the PCI ASV scanning service (per package by asset count), vulnerability scanning (external, internal, and web app), and penetration testing (automated infrastructure or authenticated web app). Add any combination to one subscription, and the Clone Systems AI Assistant can be added on top of any scanning product. Which PCI ASV package should I choose? Starter covers a single IP or domain, Standard covers up to 10, and Advanced covers up to 25. Larger or multi-environment programs use the Custom package with dedicated onboarding. You can add multiple packages of the same tier to expand coverage. What is the difference between vulnerability scanning and PCI ASV scanning? Our PCI ASV scanning service satisfies PCI DSS 4.0.1 Requirement 11.3.2 (quarterly external scans by an Approved Scanning Vendor with an Attestation of Scan Compliance). Vulnerability scanning is broader continuous coverage of external, internal, and web application assets, mapped to PCI, HIPAA, SOC 2, ISO 27001, and NIST. How is penetration testing priced: 30-day or annual? Automated and authenticated web app pen tests are available as 30-day engagements or annual subscriptions with quarterly retests. Annual delivers a lower effective per-test cost and keeps findings tracked across the year. Expert-led manual testing is sales-assisted and quoted from a scoping call. What is the Clone Systems AI Assistant and when should I add it? The Clone Systems AI Assistant is our proprietary AI that prioritizes findings, drafts remediation steps, and answers questions in plain language across your scan results. Add it to any scanning product from the AI step of checkout, or skip it and enable it later. How does the checkout process work? Build your order, review the summary, and continue to secure checkout. Payments accept credit card, PayPal, Apple Pay, and Google Pay. Onboarding starts the same business day for online purchases; larger custom orders route to our team. Can I change or expand my subscription later? Yes. You can add packages or add the Clone Systems AI Assistant at any time. Existing scans, exceptions, and reports carry forward so you never lose historical context. Comparing options? See how Clone Systems compares to other vulnerability management platforms. --- ## Which Penetration Test Do I Need? Pen Test Finder URL: https://www.clone-systems.com/which-penetration-test-do-i-need PEN TEST FINDER Which penetration test do I need? Answer a few quick questions. We will show you the exact test that fits, the price, and the reason it fits, then put it in your cart. No sales call. 1 OF 4 Who is asking you for a penetration test? PCI DSS (my assessor, my bank, or my payment processor) A SOC 2, ISO 27001, or HIPAA auditor A regulator (FTC Safeguards Rule or New York DFS) My cyber insurance company A customer, a partner, or an app marketplace Nobody yet. I want to know where I stand. What happens after you check out Log in. Your portal login is created at checkout. Set your scope. Enter your targets, any exclusions, and your testing window. External tests need nothing installed. Internal tests use a lightweight collector on your network. Test, fix, retest. The test runs, you fix what it finds, and you run it again inside your 30-day window. Then export your reports. Need an engineer-led test? We also run external network penetration testing, internal network and Active Directory testing, web application penetration testing, API penetration testing, cloud penetration testing, mobile app penetration testing, wireless penetration testing, red team assessments, and secure source code review. FAQ What is the difference between an external and an internal penetration test? An external test attacks the systems you expose to the internet, such as your website, web apps, and firewall. An internal test simulates an attacker who is already inside your network and checks how far they could get. Many requirements ask for both. How do I count my IPs or domains? Count each website, web app, or public IP address as one. If you are not sure, pick the next size up or talk to a specialist before you buy. What if my auditor wants a person to run the test? You have two options. One of our engineers can run the test for you on the same platform as an add-on, or you can move to a full managed penetration test. See what is in the report and your options. See pen test pricing and buy online·Not sure which SAQ you file? Use the SAQ Finder·Talk to a specialist --- ## Vulnerability Management Platforms Compared (2026) URL: https://www.clone-systems.com/vulnerability-management-comparison HOME PLATFORM COMPARISON How Clone Systems compares to other vulnerability management platforms PCI ASV scanning, vulnerability scanning and penetration testing in one platform, compared feature by feature with other vendors. Features and modules Clone Systems has been a PCI Approved Scanning Vendor since 2007. Our platform brings PCI ASV scanning, vulnerability scanning, web application scanning, and automated and managed penetration testing together in one place, and you can buy it online without a sales call. Here is how it compares with four widely used vulnerability management platforms, based on what each vendor publishes about its own products. Capability Clone Systems Qualys Tenable Rapid7 Fortra PCI Approved Scanning Vendor External vulnerability scanning Internal network scanning Agent-based scanning Authenticated web app scanning Automated external pen testing Limited Limited Limited Automated internal pen testing Limited Limited Limited Managed penetration testing AI remediation assistant AI hosted privately in the vendor's own data center Published prices with online checkout Limited Limited ✓ offered, per the vendor's public website or documentation. "Limited" means a narrower version, a separate product, or availability only through a marketplace. Blank means we did not find it in the vendor's public materials. PCI ASV status is from the PCI Security Standards Council's Approved Scanning Vendor list. Published starting prices Many vendors only quote prices privately. Where a vendor publishes a price, here it is, exactly as listed. Module Clone Systems Published competitor prices PCI ASV scanning $185/year (1 IP) Qualys, Tenable, Rapid7, Fortra: quote only (Tenable also requires a Tenable One license and a minimum of 7 PCI licenses) External scanning $595/year (10 IPs) Tenable One Vulnerability Management: $3,700/year, 100 assets, internal and external (Tenable online store, checked September 21, 2026) Rapid7 InsightVM: $3,840 for 12 months, up to 128 assets, internal and external (AWS Marketplace listing, checked September 21, 2026) Internal scanning $1,095/year (128 IPs) Tenable One Vulnerability Management: $3,700/year, 100 assets (Tenable online store, checked September 21, 2026) Rapid7 InsightVM: $3,840 for 12 months, up to 128 assets (AWS Marketplace listing, checked September 21, 2026) Qualys VMDR: $596/month, 128 hosts (AWS Marketplace listing, checked September 21, 2026) Fortra VM: quote only Agent-based scanning $1,195/year (25 agents) Tenable One Vulnerability Management: $3,700/year, 100 assets, agents included (Tenable online store, checked September 21, 2026) Qualys VMDR: $596/month, 128 hosts, agents included (AWS Marketplace listing, checked September 21, 2026) Authenticated web app scanning $5,995/year (10 apps) Tenable Web App Scanning: $6,790/year, 5 sites (Tenable online store, checked September 21, 2026) Rapid7 InsightAppSec: $175/month per app, billed annually (Rapid7 pricing page, checked September 21, 2026) Fortra WAS: quote only Automated pen testing External $1,995 (30 days, 1 asset) and Internal $2,995 (30 days, 25 hosts) Qualys, Tenable, Rapid7, Fortra: no comparable online package. Qualys and Rapid7 offer exploit-validation tools; Fortra sells Core Impact separately; all quote only. Prices and features as published by each vendor, checked September 21, 2026. Vendors measure scope differently (IPs, assets, targets, hosts or apps), and many offer discounts through private quotes. Product names are trademarks of their respective owners. Spotted something out of date? Tell us and we will update it. Looking at one platform in particular? Read the detailed comparisons: Qualys vs Clone Systems, Tenable vs Clone Systems, Rapid7 vs Clone Systems, Fortra vs Clone Systems, Aikido vs Clone Systems, Intruder vs Clone Systems, Pentera vs Clone Systems, Arctic Wolf vs Clone Systems, Huntress vs Clone Systems, Blumira vs Clone Systems, Sophos MDR vs Clone Systems. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST --- ## Qualys vs Clone Systems (2026): Scanning and Pen Testing URL: https://www.clone-systems.com/qualys-vs-clonesystems HOME PLATFORM COMPARISON QUALYS VS CLONE SYSTEMS Qualys vs Clone Systems Enterprise vulnerability management compared with PCI ASV scanning, published pricing and penetration testing you can buy online. Qualys is one of the largest names in vulnerability management, built for enterprise security teams managing thousands of assets. Clone Systems is a PCI Approved Scanning Vendor since 2007 that puts PCI ASV scanning, vulnerability scanning, web application scanning, and automated penetration testing in one platform you can buy online. This page compares the two on features and published pricing, using only what each company publishes about its own products. Where Qualys is strong Qualys VMDR is a mature enterprise platform with broad coverage: cloud agents, network scanners, passive sensors, patching (FixIT), and endpoint protection (ProtectIT). It is a PCI Approved Scanning Vendor. Large organizations with dedicated security teams, complex cloud estates, and procurement processes built around enterprise contracts are its natural customers. Where Clone Systems is different Buy online, scan today. Every Clone Systems package has a published price and an online checkout. Qualys publishes fixed prices only through the AWS Marketplace; its own site quotes on request. Automated penetration testing in the same cart. Clone Systems sells automated external and internal pen tests from $1,995 per 30 days. Qualys offers exploit validation (TruConfirm) inside VMDR, which Qualys itself describes as validation rather than a penetration test. Managed penetration testing by our own engineers. Human-led testing scoped per environment. We found no equivalent service in Qualys's public materials. Private AI remediation. The Clone Systems AI Assistant runs in our own data center and sends nothing to outside AI providers. Qualys offers AI assistants; its public materials do not state where the AI runs. Built for smaller scopes too. PCI ASV scanning starts at $185 a year for one IP. Qualys's smallest published VMDR package covers 128 hosts. Feature comparison Capability Clone Systems Qualys PCI Approved Scanning Vendor External vulnerability scanning Internal network scanning Agent-based scanning Authenticated web app scanning Automated external pen testing Limited (exploit validation) Automated internal pen testing Limited (exploit validation) Managed penetration testing AI remediation assistant AI hosted in vendor's own data center Not stated Published prices with online checkout AWS Marketplace only Patch management Endpoint anti-malware Published pricing, side by side Module Clone Systems Qualys PCI ASV scanning $185/yr (1 IP), $625 (10), $1,575 (25) Quote only Internal + external scanning, about 128 hosts $1,095/yr internal (128 IPs) + $595/yr external (10 IPs) = $1,690 VMDR $596/month = $7,152/yr (128 hosts, includes agents; AWS Marketplace listing) Internal scanning, about 2,048 hosts $2,295/yr VMDR $3,719/month = $44,628/yr (AWS Marketplace listing) Agent-based scanning, 100 to 128 endpoints $3,995/yr (100 agents) Included in VMDR at $7,152/yr (128 hosts) Authenticated web app scanning $5,995/yr (10 apps) Quote only Automated pen testing External from $1,995, internal from $2,995 (30 days) No comparable package Prices as published by each vendor, checked September 21, 2026. Qualys figures are 1-month AWS Marketplace contract rates; Qualys states 12-month contracts save up to 17%. Vendors count scope differently (IPs, hosts, assets), so matched sizes are approximate. Who should choose which Choose Qualys if you run a large security team, need patching and endpoint protection in the same console, and buy through enterprise procurement or AWS commitments. Choose Clone Systems if you need a PCI ASV scan now, want vulnerability scanning and pen testing without a sales cycle, or want bank-grade scanning priced for a normal business. You can buy today and scan today. PCI ASV scanning: how the process compares Both companies are on the PCI SSC list of Approved Scanning Vendors (Qualys is listed as "Qualys PCI - 2026"; Clone Systems as "Clone Guard PCI"). The difference is in how you buy, how findings get reviewed, and how the attestation reaches your bank. Buying. Qualys PCI is a separate app on the Qualys platform, offered with a free trial and priced on request. Clone Systems PCI ASV scanning is bought online at $185, $625, or $1,575 a year, and portal access is created automatically when payment goes through. Reviews and exceptions. In Qualys, you generate the network report, request a review from the ASV, and get an email with an approved or rejected status. In Clone Systems, you submit false positives and compensating controls in the portal and get an approval or rejection within 24 hours; approved exceptions stay attached to future scans. Getting the attestation to your bank. Qualys can auto-submit compliance status directly to acquiring banks that use its PCI Bank Service, or you download the PDF and send it yourself. Clone Systems issues the Attestation of Scan Compliance (AoSC) in the portal after each passing scan, and you send it to your acquirer. Rescans. Clone Systems includes unlimited rescans until you pass on every plan. Qualys allows ad hoc scanning on demand in addition to the required quarterly scans. Switching from Qualys to Clone Systems ASV scans are external, so there is nothing to uninstall and no data to migrate. Bring the list of public IPs and domains in your PCI scope and any false-positive or compensating-control write-ups that were accepted last quarter, since you can submit them again as exceptions. Buy the plan that matches your IP count, run your first scan the same day, fix or dispute anything that fails, and rescan until you pass. Keep your Qualys subscription active until you have a passing AoSC from Clone Systems for the current quarter so there is no gap in coverage. Frequently asked questions Is Qualys a PCI Approved Scanning Vendor? Yes. Qualys appears on the PCI Security Standards Council's list of Approved Scanning Vendors with the product name "Qualys PCI - 2026". Clone Systems is on the same list as "Clone Guard PCI" and has been listed since 2007. How much does a Qualys PCI ASV scan cost? Qualys does not publish a price for its PCI app; it is quote only. Qualys publishes fixed prices for VMDR through the AWS Marketplace, starting at $596 a month for 128 hosts. Clone Systems publishes PCI ASV pricing at $185 a year for 1 IP, $625 for 10, and $1,575 for 25. Can a small merchant use Qualys for PCI scanning? Qualys offers a free trial of its PCI app and quotes pricing on request. Its smallest published VMDR package covers 128 hosts. Clone Systems sells a single-IP PCI ASV plan for $185 a year, which is built for merchants with one or a few public-facing systems. How long does a false-positive review take? Clone Systems reviews exceptions submitted in the portal within 24 hours and keeps approved exceptions tied to future scans. Qualys sends an email when the ASV review is approved or rejected; its public documentation does not state a turnaround time. Does Clone Systems replace Qualys VMDR? For PCI ASV scanning, external scanning, internal scanning, agent-based scanning, web application scanning, and automated penetration testing, yes. Clone Systems does not offer patch management or endpoint anti-malware, which Qualys sells as FixIT and ProtectIT. Process details are taken from each vendor's public documentation and the PCI SSC ASV list, checked September 28, 2026. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST Qualys is a trademark of Qualys, Inc. Clone Systems is not affiliated with Qualys. Spotted something out of date? Tell us and we will update it. See also: Vulnerability management platforms compared --- ## Tenable vs Clone Systems (2026): Scanning and Pen Testing URL: https://www.clone-systems.com/tenable-vs-clonesystems HOME PLATFORM COMPARISON TENABLE VS CLONE SYSTEMS Tenable vs Clone Systems Vulnerability scanning, PCI ASV coverage and published pricing compared with a fully hosted platform that includes penetration testing. Tenable makes Nessus, the most widely used vulnerability scanner in the world, and sells it alongside Tenable One for cloud, web app, and identity exposure. Clone Systems is a PCI Approved Scanning Vendor since 2007 that puts PCI ASV scanning, vulnerability scanning, web application scanning, and automated penetration testing in one platform you can buy online. This page compares the two on features and published pricing, using only what each company publishes about its own products. Where Tenable is strong Nessus has a long track record and a huge plugin library, and Tenable publishes prices and sells online, which is rare among large security vendors. Nessus Professional at $4,790 a year covers unlimited IPs if you install and run the scanner yourself. Tenable One adds cloud security, identity exposure, and attack path analysis for larger organizations, and Tenable offers a free version of Nessus for personal, non-commercial use. Where Clone Systems is different PCI ASV scanning without the add-on ladder. Clone Systems sells ASV scanning from $185 a year for one IP. Tenable's PCI ASV service is quote only, requires a Tenable One Vulnerability Management license, and has a minimum of 7 PCI licenses. Penetration testing in the same platform. Clone Systems sells automated external and internal pen tests from $1,995 per 30 days, plus managed penetration testing by our own engineers. Tenable's public materials describe security control validation, and pen test results are imported from third-party providers rather than run by Tenable. Fully hosted, nothing to run. Clone Systems scanning is delivered from our own platform. Nessus Professional's unlimited-IP price is for software you install, maintain, and run yourself. Private AI remediation. The Clone Systems AI Assistant runs in our own data center and sends nothing to outside AI providers. Tenable's own documentation states its AI features run on Google Cloud, AWS Bedrock, and Anthropic services. Web app scanning at scale. Clone Systems covers 10 apps for $5,995 a year and 50 apps for $14,995. Tenable's online store covers 5 sites for $6,790; more than 5 is quote only. Feature comparison Capability Clone Systems Tenable PCI Approved Scanning Vendor (quote only, minimum 7 licenses) External vulnerability scanning Internal network scanning Agent-based scanning Authenticated web app scanning Automated external pen testing Automated internal pen testing Managed penetration testing AI remediation assistant AI hosted in vendor's own data center No (Google Cloud, AWS, Anthropic) Published prices with online checkout Free tier (Nessus Essentials, non-commercial) Cloud security and identity exposure (Tenable One) Published pricing, side by side Module Clone Systems Tenable PCI ASV scanning $185/yr (1 IP), $625 (10), $1,575 (25) Quote only; requires Tenable One VM ($3,700/yr) plus minimum 7 PCI licenses Internal + external scanning, about 100 assets $1,095/yr internal (128 IPs) + $595/yr external (10 IPs) = $1,690 Tenable One VM $3,700/yr (100 assets; Tenable online store) Unlimited IPs, self-run scanner Hosted service; see packages Nessus Professional $4,790/yr (software you run yourself) Agent-based scanning, about 100 endpoints $3,995/yr (100 agents) Tenable One VM $3,700/yr (100 assets, agents included) Authenticated web app scanning $5,995/yr (10 apps), $14,995 (50) Web App Scanning $6,790/yr (5 sites); more than 5 is quote only Automated pen testing External from $1,995, internal from $2,995 (30 days) No comparable package Prices as published by each vendor, checked September 21, 2026. Tenable prices are from Tenable's online store. Vendors count scope differently (IPs, assets, sites), so matched sizes are approximate. At about 100 endpoints, Tenable's entry package and Clone Systems agent scanning are priced within a few percent of each other. Who should choose which Choose Tenable if you want to run Nessus yourself on unlimited IPs, need cloud and identity exposure management in one console, or already standardize on Nessus. Choose Clone Systems if you need a PCI ASV scan without a license minimum, want penetration testing from the same platform, prefer a fully hosted service with nothing to install, or need web app scanning beyond a handful of sites. You can buy today and scan today. PCI ASV scanning: how the process compares Both companies are on the PCI SSC list of Approved Scanning Vendors (Tenable is listed as "Tenable PCI ASV Service 2026"; Clone Systems as "Clone Guard PCI"). Tenable publishes a detailed attestation workflow, which makes the two easy to compare. Buying. Tenable PCI ASV is a workbench inside Tenable Vulnerability Management, quote only, with a minimum of 7 PCI licenses on top of the platform license. Clone Systems PCI ASV scanning is bought online at $185, $625, or $1,575 a year, with portal access created automatically when payment goes through. Attestation turnaround. Tenable states that its ASV assessment team aims to return a passed or failed attestation within 30 days of submission for PCI Standard and 14 days for PCI Enterprise, and that attestations are typically assigned to an assessor within 14 business days. Clone Systems issues the Attestation of Scan Compliance (AoSC) automatically after each passing scan. Reviews and exceptions. In Tenable, you dispute failing findings in the PCI ASV workbench, submit the attestation for ASV review, and an assessor sends information requests within 48 business hours if clarification is needed; disputes and exceptions can be carried over quarter to quarter. In Clone Systems, exceptions are submitted in the portal, approved or rejected within 24 hours, and stay attached to future scans. Rescans. Clone Systems includes unlimited rescans until you pass on every plan. Tenable's guide advises running the PCI Quarterly External Scan template multiple times to get the cleanest results before submitting. Switching from Tenable to Clone Systems ASV scans are external, so there is nothing to migrate. Take the list of public IPs and domains marked in scope in your Tenable PCI ASV workbench and any disputes that were accepted last quarter, since you can submit them again as exceptions. Buy the plan that matches your IP count, run your first scan the same day, fix or dispute anything that fails, and rescan until you pass. Because Tenable's attestation review can take up to 30 days, start with Clone Systems early in the quarter if you are switching mid-cycle, and keep your Tenable subscription active until you have a passing AoSC in hand. If you run Nessus for internal scanning, you can keep it; Clone Systems also sells internal scanning from $1,095 a year if you want both from one vendor. Frequently asked questions Is Tenable a PCI Approved Scanning Vendor? Yes. Tenable, Inc. appears on the PCI Security Standards Council's list of Approved Scanning Vendors with the product name "Tenable PCI ASV Service 2026". Clone Systems is on the same list as "Clone Guard PCI" and has been listed since 2007. How much does Tenable PCI ASV cost? Tenable's PCI ASV service is quote only. It requires a Tenable Vulnerability Management license (from $3,700 a year for 100 assets in Tenable's online store) and a minimum of 7 PCI licenses. Clone Systems publishes PCI ASV pricing at $185 a year for 1 IP, $625 for 10, and $1,575 for 25. How long does Tenable take to issue a PCI attestation? Tenable's documentation says its ASV assessment team aims to provide a passed or failed attestation within 30 days of submission for PCI Standard and 14 days for PCI Enterprise. Clone Systems issues the Attestation of Scan Compliance automatically after each passing scan and reviews exceptions within 24 hours. Can I use free Nessus for PCI scanning? No. Nessus Essentials is for personal, non-commercial use, and a PCI ASV scan must be run and attested by an Approved Scanning Vendor, not by a scanner you run yourself. Nessus Professional can help you find and fix issues before the ASV scan, but the attestation still has to come from an ASV. Does Clone Systems run pen tests, or import them like Tenable? Clone Systems runs automated external and internal penetration tests from its own platform, from $1,995 per 30 days, and offers managed penetration testing by its own engineers. Tenable's public materials describe importing pen test results from third-party providers rather than running the tests. Process details are taken from each vendor's public documentation and the PCI SSC ASV list, checked September 28, 2026. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST Tenable and Nessus are trademarks of Tenable, Inc. Clone Systems is not affiliated with Tenable. Spotted something out of date? Tell us and we will update it. See also: Vulnerability management platforms compared --- ## Rapid7 vs Clone Systems (2026): Scanning and Pen Testing URL: https://www.clone-systems.com/rapid7-vs-clonesystems HOME PLATFORM COMPARISON RAPID7 VS CLONE SYSTEMS Rapid7 vs Clone Systems Vulnerability management, web app scanning and penetration testing compared with transparent online pricing. Rapid7 is a major security platform vendor known for InsightVM, InsightAppSec, Metasploit, and 24/7 managed detection and response. Clone Systems is a PCI Approved Scanning Vendor since 2007 that puts PCI ASV scanning, vulnerability scanning, web application scanning, and automated penetration testing in one platform you can buy online. This page compares the two on features and published pricing, using only what each company publishes about its own products. Where Rapid7 is strong Rapid7 covers a lot of ground: vulnerability management, web app scanning, a SIEM, managed detection and response, threat intelligence with dark web monitoring, and human penetration testing services. It is a PCI Approved Scanning Vendor and owns Metasploit, the best-known exploitation framework. Enterprises that want scanning, SIEM, and a managed SOC from a single vendor are its natural fit. Where Clone Systems is different Published prices you can buy at. Every Clone Systems package has a listed price and an online checkout. Rapid7 publishes starting prices but sells through sales or the AWS Marketplace; there is no cart. Automated penetration testing as a product. Clone Systems sells automated external and internal pen tests from $1,995 per 30 days, run from our platform. Rapid7's automated option is Metasploit Pro, a tool you license and run yourself, priced on request. PCI ASV scanning at small-business prices. Clone Systems ASV scanning starts at $185 a year for one IP. Rapid7's PCI ASV service is quote only. Web app scanning at a fraction of the cost. Clone Systems covers 10 apps for $5,995 a year. Rapid7 InsightAppSec is $175 per app per month billed annually, or $21,000 a year for the same 10 apps. Private AI remediation. The Clone Systems AI Assistant runs in our own data center and sends nothing to outside AI providers. Rapid7 offers AI-written risk summaries; its public materials do not state where the AI runs. Feature comparison Capability Clone Systems Rapid7 PCI Approved Scanning Vendor (quote only) External vulnerability scanning Internal network scanning Agent-based scanning Authenticated web app scanning Automated external pen testing Limited (Metasploit Pro, self-run) Automated internal pen testing Limited (Metasploit Pro, self-run) Managed penetration testing AI remediation assistant AI hosted in vendor's own data center Not stated Published prices with online checkout Starting prices only; no cart Dark web monitoring Published pricing, side by side Module Clone Systems Rapid7 PCI ASV scanning $185/yr (1 IP), $625 (10), $1,575 (25) Quote only Internal + external scanning, about 128 assets $1,095/yr internal (128 IPs) + $595/yr external (10 IPs) = $1,690 InsightVM $3,840 for 12 months (up to 128 assets; AWS Marketplace listing) Internal scanning, about 500 assets $1,495/yr (512 IPs) InsightVM from $1.62 per asset per month, about $9,720/yr for 500 assets (Rapid7 pricing page) Authenticated web app scanning, 10 apps $5,995/yr InsightAppSec $175 per app per month billed annually = $21,000/yr Authenticated web app scanning, 50 apps $14,995/yr InsightAppSec = $105,000/yr at the same rate Automated pen testing External from $1,995, internal from $2,995 (30 days) Metasploit Pro, quote only Prices as published by each vendor, checked September 21, 2026. Rapid7 figures are from Rapid7's pricing pages and its AWS Marketplace listing. Vendors count scope differently (IPs, assets, apps), so matched sizes are approximate. Who should choose which Choose Rapid7 if you want scanning, a SIEM, and a 24/7 managed SOC from one enterprise vendor, or your team already runs Metasploit. Choose Clone Systems if you want to see the price and buy today, need a PCI ASV scan for a small or mid-size scope, want automated pen testing run for you rather than a tool to operate, or need web app scanning across many applications without an enterprise budget. PCI ASV scanning: how the process compares Both companies are on the PCI SSC list of Approved Scanning Vendors (Rapid7 is listed as "Rapid7 PCI ASV"; Clone Systems as "Clone Guard PCI"). The difference is in how the scanning is delivered and how you buy it. Buying. Rapid7's external and PCI/ASV scanning runs through its External Scanning Service, a Rapid7-managed scan engine that is an add-on to InsightVM; Rapid7's documentation directs customers to their Customer Success Advisor to add it. Clone Systems PCI ASV scanning is bought online at $185, $625, or $1,575 a year, with portal access created automatically when payment goes through. What you run. Rapid7's External Scanning Service pairs with your InsightVM Security Console, so you need an InsightVM deployment to use it. Clone Systems is a hosted portal with nothing to install. Reviews and exceptions. Clone Systems reviews false positives and compensating controls submitted in the portal within 24 hours, and approved exceptions stay attached to future scans. Rapid7's public documentation does not publish an exception turnaround for its ASV service. Rescans and attestation. Clone Systems includes unlimited rescans until you pass on every plan and issues the Attestation of Scan Compliance (AoSC) after each passing scan. Switching from Rapid7 to Clone Systems ASV scans are external, so there is no console to migrate. Export the list of public IPs and domains in your PCI scope from InsightVM, along with any exceptions that were accepted last quarter, since you can submit them again in the Clone Systems portal. Buy the plan that matches your IP count, run your first scan the same day, fix or dispute anything that fails, and rescan until you pass. Keep your current ASV coverage active until you have a passing AoSC from Clone Systems for the quarter so there is no gap. If you use InsightVM for internal scanning, you can keep it; Clone Systems also sells internal scanning from $1,095 a year for 128 IPs if you want both from one vendor. Frequently asked questions Is Rapid7 a PCI Approved Scanning Vendor? Yes. Rapid7 LLC appears on the PCI Security Standards Council's list of Approved Scanning Vendors with the product name "Rapid7 PCI ASV". Clone Systems is on the same list as "Clone Guard PCI" and has been listed since 2007. How much does Rapid7 PCI ASV scanning cost? Rapid7 does not publish a price for PCI ASV scanning. It is delivered through the External Scanning Service add-on to InsightVM and priced through Rapid7's sales team. Clone Systems publishes PCI ASV pricing at $185 a year for 1 IP, $625 for 10, and $1,575 for 25. Do I need InsightVM to get a PCI scan from Rapid7? Rapid7's External Scanning Service pairs with an InsightVM Security Console, so an InsightVM deployment is part of the setup. Clone Systems PCI ASV scanning is a hosted portal with no software to install. Can I get penetration testing from the same vendor? Rapid7 sells human penetration testing services and licenses Metasploit Pro for teams that run their own testing. Clone Systems sells automated external pen tests from $1,995 and internal from $2,995 per 30 days in the same cart as its scanning, plus managed penetration testing by its own engineers. Which is cheaper for web application scanning? Rapid7 InsightAppSec is $175 per app per month billed annually, or $21,000 a year for 10 apps. Clone Systems authenticated web app scanning is $5,995 a year for 10 apps and $14,995 for 50. Process details are taken from each vendor's public documentation and the PCI SSC ASV list, checked September 28, 2026. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST Rapid7, InsightVM, InsightAppSec, and Metasploit are trademarks of Rapid7, Inc. Clone Systems is not affiliated with Rapid7. Spotted something out of date? Tell us and we will update it. See also: Vulnerability management platforms compared --- ## Fortra vs Clone Systems (2026): Scanning and Pen Testing URL: https://www.clone-systems.com/fortra-vs-clonesystems HOME PLATFORM COMPARISON FORTRA VS CLONE SYSTEMS Fortra vs Clone Systems Vulnerability scanning, PCI ASV coverage and penetration testing compared with transparent online pricing. Fortra is a large security software company whose vulnerability management product, Fortra VM (formerly Frontline VM from Digital Defense), sits alongside Core Impact for penetration testing and a wide portfolio of other tools. Clone Systems is a PCI Approved Scanning Vendor since 2007 that puts PCI ASV scanning, vulnerability scanning, web application scanning, and automated penetration testing in one platform you can buy online. This page compares the two on features and published pricing, using only what each company publishes about its own products. Where Fortra is strong Fortra VM has been a PCI Approved Scanning Vendor since 2005 and offers network scanning, endpoint agents, and a separate web application scanning product. Fortra sells managed service tiers where a named analyst runs your scans (VM Pro and PCI-Pro), and Core Impact adds automated and manual penetration testing for organizations that want it from the same vendor. Fortra also offers a free trial of Fortra VM. Where Clone Systems is different Every price is published. Clone Systems lists every package price and sells online. Fortra VM, its web app scanner, Core Impact, and PCI-Pro are all quote only. Pen testing in the same platform, at a package price. Clone Systems sells automated external and internal pen tests from $1,995 per 30 days inside the scanning platform. Fortra's automated pen testing is Core Impact, a separate product sold and licensed on its own. Web app scanning in the same platform. Clone Systems authenticated web app scanning is part of the same platform and cart, from $5,995 a year for 10 apps. Fortra's web app scanning is a separate product from Fortra VM. AI remediation assistant. The Clone Systems AI Assistant explains findings in plain language and runs privately in our own data center. We found no AI remediation assistant in Fortra VM's public materials. Buy today, scan today. No quote, no procurement cycle. Fortra sells through quotes and its partner channel. Feature comparison Capability Clone Systems Fortra PCI Approved Scanning Vendor External vulnerability scanning Internal network scanning Agent-based scanning Authenticated web app scanning (separate product) Automated external pen testing Limited (Core Impact, separate product) Automated internal pen testing Limited (Core Impact, separate product) Managed penetration testing AI remediation assistant Not found AI hosted in vendor's own data center Not applicable Published prices with online checkout Quote only Analyst-run managed scanning tier (VM Pro, PCI-Pro) Free trial Published pricing, side by side Module Clone Systems Fortra PCI ASV scanning $185/yr (1 IP), $625 (10), $1,575 (25) Quote only External vulnerability scanning $595/yr (10 IPs), $2,495 (50), $5,985 (150) Quote only Internal vulnerability scanning $1,095/yr (128 IPs), $1,495 (512), $2,295 (2,048) Quote only Agent-based scanning $1,195/yr (25 agents), $3,995 (100), $7,995 (250) Quote only Authenticated web app scanning $5,995/yr (10 apps), $14,995 (50), $24,995 (150) Quote only (separate product) Automated pen testing External from $1,995, internal from $2,995 (30 days) Core Impact, quote only Prices as published by each vendor, checked September 21, 2026. Fortra publishes no list prices for these products; its pricing page describes tiered pricing based on the number of assets and directs buyers to request a quote. Fortra's AWS Marketplace listings show placeholder amounts marked Private Offer Only. Who should choose which Choose Fortra if you want a named analyst running your scans as a managed service, already use other Fortra products, or buy through a reseller relationship with Fortra. Choose Clone Systems if you want to see the price before you talk to anyone, need PCI ASV scanning, vulnerability scanning, web app scanning, and pen testing from one platform and one cart, or want plain-language AI help fixing what the scan finds. You can buy today and scan today. PCI ASV scanning: how the process compares Both companies are on the PCI SSC list of Approved Scanning Vendors (Fortra is listed as "Fortra Vulnerability Manager"; Clone Systems as "Clone Guard PCI"). Fortra has been an ASV since 2005 through Digital Defense and Clone Systems since 2007, so both have long track records. The difference is in how you buy and how disputes are handled. Buying. Fortra VM, its PCI-ASV scanning, and the PCI-Pro managed tier are quote only. Clone Systems PCI ASV scanning is bought online at $185, $625, or $1,575 a year, with portal access created automatically when payment goes through. Running the scan. In Fortra VM you create a scan group with the PCI Assessment workflow, run it, then send the PCI Compliance Report to the certification workflow once findings are resolved. In Clone Systems you add your IPs or domains in the portal and launch an instant or scheduled scan with no setup. Disputes. Fortra lets you mark findings as exceptions, compensating controls, or false positives, and a Fortra PCI analyst reviews each dispute and can move it from fail to pass; the documentation does not publish a turnaround time. Clone Systems reviews exceptions submitted in the portal within 24 hours, and approved exceptions stay attached to future scans. Rescans and attestation. Clone Systems includes unlimited rescans until you pass on every plan and issues the Attestation of Scan Compliance (AoSC) after each passing scan. Fortra VM supports rescans through its multi-scan method after remediation. Switching from Fortra to Clone Systems ASV scans are external, so there is nothing to migrate. Export the list of public IPs and domains in your Fortra VM PCI scan group and any disputes a Fortra analyst accepted last quarter, since you can submit them again as exceptions. Buy the plan that matches your IP count, run your first scan the same day, fix or dispute anything that fails, and rescan until you pass. Keep your Fortra coverage active until you have a passing AoSC from Clone Systems for the quarter so there is no gap. If you rely on Fortra's PCI-Pro analyst tier, note that Clone Systems includes a direct line to a PCI-certified engineer and an optional AI assistant for remediation guidance. Frequently asked questions Is Fortra a PCI Approved Scanning Vendor? Yes. Fortra, LLC appears on the PCI Security Standards Council's list of Approved Scanning Vendors with the product name "Fortra Vulnerability Manager", and Fortra states it has been PCI-ASV approved since 2005. Clone Systems is on the same list as "Clone Guard PCI" and has been listed since 2007. How much does Fortra PCI ASV scanning cost? Fortra does not publish prices for Fortra VM or its PCI-ASV scanning; its pricing page describes tiered pricing by number of assets and directs buyers to request a quote. Clone Systems publishes PCI ASV pricing at $185 a year for 1 IP, $625 for 10, and $1,575 for 25. What is Fortra VM's relationship to Frontline and Digital Defense? Fortra VM is the current name of Frontline Vulnerability Manager, the product Fortra acquired with Digital Defense. The PCI-ASV listing is now under Fortra, LLC. How are false positives handled in each platform? In Fortra VM you dispute a finding as an exception, compensating control, or false positive, and a Fortra PCI analyst reviews it. In Clone Systems you submit the exception in the portal, get an approval or rejection within 24 hours, and the approved exception stays tied to future scans. Which vendor includes penetration testing? Fortra sells Core Impact as a separate product for automated and manual penetration testing, priced on request. Clone Systems sells automated external pen tests from $1,995 and internal from $2,995 per 30 days in the same cart as scanning, plus managed penetration testing by its own engineers. Process details are taken from each vendor's public documentation and the PCI SSC ASV list, checked September 28, 2026. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST Fortra, Fortra VM, Frontline, and Core Impact are trademarks of Fortra, LLC. Clone Systems is not affiliated with Fortra. Spotted something out of date? Tell us and we will update it. See also: Vulnerability management platforms compared --- ## Aikido vs Clone Systems (2026): Pen Testing Compared URL: https://www.clone-systems.com/aikido-vs-clonesystems HOME PLATFORM COMPARISON AIKIDO VS CLONE SYSTEMS Aikido vs Clone Systems AI pentesting for your application compared with automated penetration testing of your networks and web apps, with published prices on both sides. Aikido Security is a developer security platform from Ghent, Belgium, founded in 2022, that added an AI-driven penetration test for applications and APIs. Clone Systems is an independent security testing company since 1998 and a PCI Approved Scanning Vendor since 2007 that sells automated external and internal penetration testing online. This page compares the two on what they test, how they test it, and what they publish about price, using only what each company says about its own products. Where Aikido is strong Aikido's pentest is built around your application. Hundreds of autonomous agents test your frontend, web app, and APIs, with code access improving the results, and findings are reported only after they are exploited and confirmed against the live target. It is fast: Aikido says findings arrive within minutes and a full report within a few hours. Retesting is free for six months. If you do not pay up front and the test finds no high or critical issue, Aikido says you do not pay at all. For a software company that wants a deep test of one application and its APIs, it is a serious option. Where Clone Systems is different Networks as well as applications. Clone Systems tests your internet-facing systems (perimeter services, exposed applications, subdomains) and, with the internal test, your office network, Active Directory, and cloud identity. Aikido's pentest scope is one application and its primary APIs. We found no network or internal network test on Aikido's site. Nothing from your code. Clone Systems tests from the outside, the way an attacker would, with no repository to connect. Aikido's standard test does not require code access but works better with it, and its rightsized pricing and pay-later option require a connected repository. Lower published price. A Clone Systems external test is $1,995 for one target over 30 days. Aikido's standard pentest is 4,000 credits, which Aikido prices at one dollar per credit. A PCI Approved Scanning Vendor. Clone Systems has been on the PCI Council's ASV list since 2007 and sells the ASV scan in the same cart. We found no ASV listing claimed on Aikido's site. Engineers when you need them. If your auditor wants a person to run the test, a Clone Systems engineer can perform it on the same platform, or you can move to a full managed penetration test. Aikido describes human escalation for critical findings. Feature comparison Capability Clone Systems Aikido Automated external penetration test (networks and web apps) Applications and APIs only Automated internal network penetration test - Authenticated web application testing Code repository required - (not needed) Optional (improves results; required for rightsized pricing) PCI Approved Scanning Vendor Not found PCI ASV scan in the same cart - Human-led penetration test available Escalation for critical findings Published price with online checkout Retests Inside your 30-day window Free for six months Executive and technical reports Letter of attestation Developer platform (code scanning, cloud posture) - Published pricing, side by side Test Clone Systems Aikido One external target, 30 days $1,995 Not offered as a unit Standard application pentest $3,495 (10 external IPs or domains, includes authenticated web app testing) 4,000 credits, about $4,000 (one application and its primary APIs) Larger applications $6,495 (50 external IPs or domains) 8,000 to 32,000 credits for large, complex, and enterprise applications Internal network, 25 hosts $2,995 Not found Annual program From $5,995 a year Continuous testing, custom pricing Retest Included for 30 days Included for six months Prices as published by each vendor, checked October 6, 2026. Aikido prices its pentests in credits at one dollar per credit. The two companies count scope differently (targets and hosts against applications), so matched sizes are approximate. Who should choose which Choose Aikido if you are a software team that wants a deep, code-aware test of one application and its APIs, you already use or want a developer security platform, and you value a six-month retest window. Choose Clone Systems if you need your networks tested as well as your apps, you want an internal test, you need a PCI Approved Scanning Vendor, or you want the lowest published price for a test that starts today with nothing to connect. If your auditor or customer is asking Both companies produce reports written for SOC 2 and ISO 27001 audits, and both issue a letter of attestation. The question to settle before you buy is scope. If the request says "penetration test of your environment" or names external and internal testing, as PCI DSS Requirement 11.4 and the FTC Safeguards Rule do, an application-only test leaves the network side open. If the request is specifically about one web application, either test can answer it. See what is in a Clone Systems report and the note you can send your auditor first. Frequently asked questions Does Aikido test networks or only applications? Aikido's pentest covers one application and its primary APIs. Its site describes testing frontend apps, web apps, and APIs. We found no external network or internal network penetration test on Aikido's site. Clone Systems tests both. Do I have to give Aikido my source code? Not for a standard pentest, though Aikido says code access significantly improves results. Its rightsized pricing and its pay-later option require a connected repository. Clone Systems needs no code access. Is Aikido a PCI Approved Scanning Vendor? We found no ASV listing claimed on Aikido's site. Clone Systems has been a PCI Approved Scanning Vendor since 2007. Which costs less? For a single external target, Clone Systems is $1,995. Aikido's standard application pentest is 4,000 credits at one dollar per credit. Larger scopes are priced differently on each side, so compare the tables above against your own scope. Can I use both? Yes. Some companies run Aikido inside their development process and buy a Clone Systems test for the network, the internal side, or the PCI scan. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST Prices and product details are taken from each vendor's public website and help documentation, checked October 6, 2026. Aikido is a trademark of Aikido Security. Clone Systems is not affiliated with Aikido Security. Spotted something out of date? Tell us and we will update it. See also: Vulnerability management platforms compared, Intruder vs Clone Systems, Pentera vs Clone Systems --- ## Intruder vs Clone Systems (2026): Pen Testing Compared URL: https://www.clone-systems.com/intruder-vs-clonesystems HOME PLATFORM COMPARISON INTRUDER VS CLONE SYSTEMS Intruder vs Clone Systems An on-demand AI pentest of one web app, and a vulnerability scanner, compared with automated penetration testing of networks and web apps from a PCI Approved Scanning Vendor. Intruder is a vulnerability scanning company registered in England, founded in 2015, with more than 3,000 customers, that added an on-demand AI penetration test for web applications in 2026. Clone Systems is an independent security testing company since 1998 and a PCI Approved Scanning Vendor since 2007 that sells automated external and internal penetration testing, PCI ASV scanning, and vulnerability scanning online. This page compares the two using only what each company publishes about its own products. Where Intruder is strong Intruder's AI pentest is quick and focused. You connect a code repository, scope the test, and launch it in minutes, and Intruder says most tests run in minutes to hours with a report the same day. Findings point to the exact source file and line. Retesting is free and unlimited. The company is a CREST member and SOC 2 Type II compliant, and its scanner plans cover external systems, web apps, APIs, cloud accounts, and, on the Pro plan, internal systems through an agent. For a software team that wants a code-aware test of a single web app, plus a scanner it already uses, it is a strong option. Where Clone Systems is different Networks as well as one app. Intruder's help documentation says its AI pentest tests a single web application, not your whole external network. Clone Systems tests your internet-facing systems and, with the internal test, your office network and Active Directory. No code repository required. Intruder lists a connectable GitHub, GitLab, or Bitbucket repository as a prerequisite. Clone Systems tests from the outside with nothing to connect. A PCI Approved Scanning Vendor. Intruder's own PCI page says its underlying scanner is an ASV and that Intruder itself is not, so you still engage an ASV separately. Clone Systems has been on the ASV list since 2007 and sells the ASV scan in the same cart. Lower published price. Clone Systems' external test is $1,995 for one target over 30 days. Intruder's AI pentest is $3,500 per test, or $12,000 for a pack of four. Engineers when you need them. Intruder says a human in the loop is not necessary for web app pentesting. If your auditor disagrees, a Clone Systems engineer can perform the test on the same platform, or you can move to a full managed penetration test. Feature comparison Capability Clone Systems Intruder Automated external penetration test (networks and web apps) One web application per test Automated internal network penetration test - (internal scanning on the Pro plan) Authenticated web application testing Code repository required - (not needed) Required PCI Approved Scanning Vendor - (states it is not) PCI ASV scan in the same cart - Human-led penetration test available - Published price with online checkout Retests Inside your 30-day window Free and unlimited Executive and technical reports Letter of attestation Not found Continuous vulnerability scanning plans Published pricing, side by side Test Clone Systems Intruder One external target, 30 days $1,995 Not offered as a unit Web application pentest $3,495 (10 external IPs or domains, includes authenticated web app testing) $3,500 per test (one web application) Four tests $6,495 (50 external IPs or domains, one 30-day window) $12,000 for a four-test pack Internal network, 25 hosts $2,995 Not offered as a pentest Annual program From $5,995 a year Not found Retest Included for 30 days Free and unlimited PCI ASV scan $185 a year (1 IP or domain) Not an ASV Prices as published by each vendor, checked October 6, 2026. Intruder's scanner plan prices are shown on its pricing page by plan and are not repeated here. The two companies count scope differently (targets and hosts against one application), so matched sizes are approximate. Who should choose which Choose Intruder if you want a code-aware AI test of a single web application with unlimited free retests, and a vulnerability scanner with a free tier to go with it. Choose Clone Systems if you need your networks tested as well as your app, you want an internal test, you need a PCI Approved Scanning Vendor, or you want the lowest published price for a test that starts today with nothing to connect. If your auditor or customer is asking Intruder's report is routinely used for SOC 2, ISO 27001, and PCI DSS, by Intruder's own account, and Clone Systems' reports are built for the same audits. The difference is scope. PCI DSS Requirement 11.4 asks for internal and external penetration testing, and the FTC Safeguards Rule asks for a test of your information systems. A single web application test answers neither on its own. See what is in a Clone Systems report and the note you can send your auditor first. Frequently asked questions Is Intruder a PCI Approved Scanning Vendor? No. Intruder's own PCI page says its underlying scanner is an ASV and that Intruder itself is not. Clone Systems has been a PCI Approved Scanning Vendor since 2007 and sells the ASV scan online. Does Intruder's AI pentest cover my network? No. Intruder's help documentation says it tests a single web application, not your whole external network. Clone Systems tests external networks, internal networks, and web applications. Do I need to connect my code to use Intruder's pentest? Yes. A connectable GitHub, GitLab, or Bitbucket repository is listed as a prerequisite. Clone Systems needs no code access. Which costs less? For a single external target, Clone Systems is $1,995. Intruder's AI pentest is $3,500 per test. Compare the tables above against your own scope. Can I keep Intruder's scanner and use Clone Systems for the pentest? Yes. The two do not conflict. Many companies keep a scanner they like and buy a Clone Systems test for the network, the internal side, or the PCI scan. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST Prices and product details are taken from each vendor's public website and help documentation, checked October 6, 2026. Intruder is a trademark of Intruder Systems Ltd. Clone Systems is not affiliated with Intruder. Spotted something out of date? Tell us and we will update it. See also: Vulnerability management platforms compared, Aikido vs Clone Systems, Pentera vs Clone Systems --- ## Pentera vs Clone Systems (2026): Pen Testing Compared URL: https://www.clone-systems.com/pentera-vs-clonesystems HOME PLATFORM COMPARISON PENTERA VS CLONE SYSTEMS Pentera vs Clone Systems Enterprise automated security validation compared with automated penetration testing you can buy online today. Pentera is an enterprise security validation platform founded in 2015 and headquartered in Burlington, Massachusetts, with more than 1,200 enterprise customers by its own account. Clone Systems is an independent security testing company since 1998 and a PCI Approved Scanning Vendor since 2007 that sells automated external and internal penetration testing online. The two serve different buyers. This page says plainly where each fits, using only what each company publishes about its own products. Where Pentera is strong Pentera is built for large security teams that want to test continuously. Its platform runs agentless against internal networks (Pentera Core), internet-facing assets (Pentera Surface), and cloud environments on AWS and Azure (Pentera Cloud), emulating real attack techniques in live production under customer-controlled guardrails, with ransomware emulation and credential exposure testing. It integrates with enterprise tooling and is sold through a sales process with a live demo. For a company with a security operations team, a large estate, and an enterprise budget, it is a category leader. Where Clone Systems is different Bought online, starts today. Clone Systems publishes every price and sells online with no sales call. Pentera's site offers a demo and a conversation with its team; the only published price we found is its AWS Marketplace listing at $120,000 for a 12-month contract. Sized for a normal business. A Clone Systems external test is $1,995 for one target over 30 days, and an internal test is $2,995 for up to 25 hosts. Pentera is sold as an enterprise platform. A defined 30-day window with a dated report. Many buyers need one test with a report dated this year for an auditor, an insurer, or a customer. Clone Systems is built around that. Pentera is built around continuous validation. A PCI Approved Scanning Vendor. Clone Systems has been on the PCI Council's ASV list since 2007 and sells the ASV scan in the same cart. We found no Approved Scanning Vendor claim on Pentera's site; Pentera uses "ASV" to mean automated security validation. Engineers when you need them. If your auditor wants a person to run the test, a Clone Systems engineer can perform it on the same platform, or you can move to a full managed penetration test. Feature comparison Capability Clone Systems Pentera Automated external penetration test Yes (Pentera Surface) Automated internal network penetration test Yes (Pentera Core) Cloud environment testing Cloud identity and configuration within the test Yes (Pentera Cloud, AWS and Azure) Ransomware emulation - Continuous validation Annual program available Published price with online checkout - (AWS Marketplace listing only) Buy without a sales call - One-time 30-day test - PCI Approved Scanning Vendor Not found PCI ASV scan in the same cart - Human-led penetration test available - Executive and technical reports Published pricing, side by side Test Clone Systems Pentera One external target, 30 days $1,995 Not offered Ten external targets, 30 days $3,495 (includes authenticated web app testing) Not offered Internal network, 25 hosts $2,995 Not offered as a unit Internal network, 250 hosts $12,995 Not published Annual program From $5,995 a year $120,000 for a 12-month contract (AWS Marketplace listing); private offers on request PCI ASV scan $185 a year (1 IP or domain) Not offered Prices as published by each vendor, checked October 6, 2026. Pentera does not publish prices on its own website; the figure shown is its public AWS Marketplace listing. Scope is counted differently on each side, so this table compares how each is bought rather than matched sizes. Who should choose which Choose Pentera if you run a security operations team, want continuous validation across a large internal, external, and cloud estate, and buy enterprise software through procurement. Choose Clone Systems if you need a penetration test this month with a report you can hand to an auditor, insurer, or customer, you want to buy it online for a few thousand dollars, or you need a PCI Approved Scanning Vendor. If your auditor or customer is asking Most requests for a penetration test ask for one thing: an independent test, with evidence of real exploit attempts, and proof that what was found was fixed, dated within the last year. Both platforms attempt real exploitation. The difference is that Clone Systems packages that as a single purchase with a 30-day window and a report at the end, while Pentera packages it as a continuous enterprise program. See what is in a Clone Systems report and the note you can send your auditor first. Frequently asked questions How much does Pentera cost? Pentera does not publish prices on its website. Its AWS Marketplace listing shows $120,000 for a 12-month contract, with private offers on request. Clone Systems publishes every price, starting at $1,995 for an external test. Can I buy Pentera online? Not from its website, which offers a demo and a conversation with its team. Clone Systems is bought online and starts the same day. Is Pentera a PCI Approved Scanning Vendor? We found no Approved Scanning Vendor claim on Pentera's site. Pentera uses the letters ASV to mean automated security validation. Clone Systems has been a PCI Approved Scanning Vendor since 2007. Is Pentera a penetration test? Pentera describes its platform as automated security validation and also as automated pentesting; it attempts real exploitation in your environment. Whether a continuous platform satisfies a specific audit request is a question for your auditor. Clone Systems is sold as a penetration test with a defined scope, window, and report. Who is each one for? Pentera is for enterprise security teams. Clone Systems is for any business that needs a real test, bought online, at a published price. SEE PRICING AND BUY ONLINE TALK TO A SPECIALIST Prices and product details are taken from each vendor's public website and AWS Marketplace listing, checked October 6, 2026. Pentera is a trademark of Pentera. Clone Systems is not affiliated with Pentera. Spotted something out of date? Tell us and we will update it. See also: Vulnerability management platforms compared, Aikido vs Clone Systems, Intruder vs Clone Systems --- ## Resource Center: PCI, Penetration Testing and Managed Security Guides | Clone Systems URL: https://www.clone-systems.com/resources HOME/RESOURCE CENTER Resource Center Free tools and plain-language guides for PCI DSS, penetration testing and security compliance, before you talk to anyone. Interactive tools Managed Security PCI SAQ guides Penetration testing guides PCI scanning guides Compare vendors FREE TOOL · MOST POPULAR Which PCI SAQ do I need? Answer the questions an assessor would ask and see which questionnaire applies to you. Start the SAQ Finder FREE TOOL Which pen test do I need? Answer a few questions and get the type of test that fits. FREE TOOL Founder Security Check What your startup needs now, and what can wait. FREE TOOL Trust Seal Builder Add a live security seal to your site. Guides All Managed Security PCI SAQ guides Penetration testing guides PCI scanning guides Compare vendors Managed Security SIEM vs SOC vs EDR vs MDR vs XDR: what they mean and which you need Five acronyms explained in plain English, and how Managed SOC + SIEM covers them. PCI SAQ guides PCI DSS Requirement 10 Explained Logging, monitoring and retention rules in plain English, and how Managed SOC + SIEM covers them. PCI SAQ guides Which PCI SAQs require a penetration test? See which questionnaires put a pen test on your list. PCI SAQ guides SAQ A For merchants who fully outsource card payments online. PCI SAQ guides SAQ A-EP For e-commerce sites that control the payment page. PCI SAQ guides SAQ B For merchants using imprint machines or dial-out terminals. PCI SAQ guides SAQ B-IP For standalone terminals that connect over the internet. Show all (6) COST AND BASICS Penetration testing guides How much does a penetration test cost? What drives the price and what a fair quote looks like. Penetration testing guides What is in a penetration test report What you get at the end and who you hand it to. Penetration testing guides PCI DSS Requirement 11.4 explained What PCI requires for penetration testing, in plain words. BY COMPLIANCE FRAMEWORK Penetration testing guides Pen tests for SOC 2 What your SOC 2 auditor expects to see. Penetration testing guides Pen tests for HIPAA How pen testing fits into HIPAA risk analysis. Penetration testing guides Pen tests for ISO 27001 Where a pen test fits in your ISO 27001 controls. Show all (8) PCI scanning guides PCI scan cost in 2026 What quarterly ASV scans cost and what's included. PCI scanning guides PCI scan deadlines When your scans are due and what happens if you miss one. PCI scanning guides What is a PCI compliance scan? What the quarterly ASV scan checks, who needs it, and how to pass. PCI scanning guides Failed your PCI scan? The most common failures and how to fix them. PCI scanning guides What free website scanners miss Why a free scan isn't the same as a PCI scan. Compare vendors Vulnerability management comparison The major vendors side by side. Compare vendors Clone Systems vs Qualys Price, coverage and who each is best for. Compare vendors Clone Systems vs Tenable Price, coverage and who each is best for. Compare vendors Clone Systems vs Rapid7 Price, coverage and who each is best for. Compare vendors Clone Systems vs Fortra Price, coverage and who each is best for. Compare vendors Clone Systems vs Aikido Price, coverage and who each is best for. Show all (6) Still not sure what you need? Talk to a specialist and get a straight answer. Talk to a specialist See all blog posts --- ## Founder Security Check | Clone Systems URL: https://www.clone-systems.com/startups HOME FOUNDER SECURITY CHECK Is your app ready for its first "is this secure ?" question? Answer three quick questions and we will tell you exactly what you need, put it in your cart, and get you to checkout in under a minute. PCI APPROVED SCANNING VENDOR SINCE 2007 PCI is the security standard every bank and card network must meet to keep payment data safe. Our scanning is built to that bar, which makes it one of the strictest ways to test a website or app, and the report carries weight with the people asking. 1 OF 3 What did you build? A website A web app or SaaS product Both WHY FOUNDERS COME TO US You built it fast. Now someone wants proof it is safe. It usually starts with one message. A bigger customer sends a security questionnaire. A partner asks for a pentest report before they will integrate. An investor asks what you have done about security. You built the product in weeks, and now you have days to answer a question you have never been asked before. Most founders hit the same wall at this point. A manual penetration test starts at $5,000 and takes weeks to schedule. The cheap AI scanners produce a checklist, but nobody on the other side of the table takes a $9 scan seriously. You need something in between, and you need it now. That is exactly what this page is. Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same scans and automated pentests that banks and payment providers accept from us are available here, one asset at a time, bought online in minutes, with reports you can send to whoever is asking. PCI SSC Approved Scanning Vendor since 2007 Reports accepted for PCI, customer questionnaires, and due diligence No software to install, nothing touches your code Offices in Philadelphia and Larnaca, real people on the phone at 800-414-0321 WHAT HAPPENS NEXT What happens after you check out 1 Log in Your portal login is created at checkout. You are in within minutes. 2 Add your domain Enter the domain or app you want tested. Nothing to install. 3 Get your report Your scan runs and the report lands in your portal, ready to download and send. FAQ Founder questions Does Stripe or PayPal handle PCI for me? Is an automated pentest enough for a customer security questionnaire? What if I have more than one app or domain? Preparing for SOC 2? See penetration testing for SOC 2. Website (leave blank) CONTACT US Send us a message Tell us a little about your question and how to reach you. A real person will get back to you. Fields marked * are required. Full name* Email* Company name* Job title* Phone* Topic* Select a topic How did you hear about us?* Select an option Message* I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send message No spam, ever. --- ## Which PCI SAQs Require a Penetration Test? (v4.0.1) | Clone Systems URL: https://www.clone-systems.com/pci-saq-penetration-testing HOME PCI SAQ PENETRATION TESTING Which PCI SAQs require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. Five of the ten PCI DSS self-assessment questionnaires require some form of penetration testing: SAQ D for service providers, SAQ D for merchants, SAQ A-EP, SAQ C and SAQ B-IP. The other five (SAQ A, B, C-VT, P2PE and SPoC) do not. Your quarterly ASV scan covers Requirement 11.3.2. A penetration test covers Requirement 11.4. They are different requirements. SAQ WHO USES IT PENETRATION TEST REQUIRED? WHAT IT ASKS FOR SAQ D Service Provider Businesses that store, process or transmit card data for other businesses Yes Internal and external testing every 12 months, retesting, and segmentation testing every 6 months (11.4.1 to 11.4.6; 11.4.7 for multi-tenant providers) SAQ D Merchant Merchants that store card data or do not fit another SAQ Yes Internal and external testing every 12 months, retesting, and segmentation testing if used (11.4.1 to 11.4.5) SAQ A-EP Ecommerce sites whose own pages affect the payment form Yes External penetration testing every 12 months, plus retesting SAQ C Payment application on a system connected to the internet When segmentation reduces scope Segmentation testing every 12 months (11.4.5) SAQ B-IP Standalone payment terminals connected over IP When segmentation reduces scope Segmentation testing every 12 months (11.4.5) SAQ A Ecommerce fully outsourced to a PCI compliant processor No Quarterly ASV scans are still required (11.3.2) SAQ B Imprint machines or standalone dial-out terminals No None SAQ C-VT Virtual terminal on one isolated computer No None SAQ P2PE PCI listed point-to-point encryption terminals only No None SAQ SPoC Software-based PIN entry on a phone or tablet No None Not sure which SAQ you file? Your acquiring bank or payment processor tells you which SAQ to complete. If you buy PCI ASV scanning from Clone Systems, your SAQ type is in your portal. Not sure which SAQ you file? Use the SAQ Finder Find the right penetration test READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Who runs your test Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing. Frequently asked questions Does my ASV scan count as a penetration test? No. ASV scans meet Requirement 11.3.2. Penetration testing is Requirement 11.4. SAQs that include 11.4 need both. How often is a PCI penetration test required? At least every 12 months and after any significant change. Service providers test segmentation every 6 months. Does SAQ A require a penetration test? No. SAQ A merchants still need passing quarterly ASV scans under Requirement 11.3.2. Can a penetration test be done remotely? Yes. Clone Systems performs every test remotely, including internal tests, using a secure connection into your environment. Will my assessor accept the report? Clone Systems reports are written for PCI assessors, with methodology, scope, proof for each finding and retest results. Related: PCI DSS Requirement 11.4, PCI ASV scanning, external network penetration testing, internal network and Active Directory testing, web application penetration testing and penetration test reports. Source: PCI Security Standards Council, PCI DSS v4.0.1 Self-Assessment Questionnaires. PCI Security Standards Council document library --- ## Does SAQ D Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-d-merchant-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ D MERCHANT Does SAQ D require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. Yes. SAQ D merchants must complete internal and external penetration testing at least every 12 months and after any significant change, under PCI DSS v4.0.1 Requirement 11.4. If you use segmentation to reduce your PCI scope, those controls must be tested too. What SAQ D asks for REQUIREMENT IN PLAIN LANGUAGE HOW OFTEN 11.4.1 A documented testing methodology covering your whole cardholder data environment, its boundary, and both network and application layers Kept current 11.4.2 Internal penetration test Every 12 months and after significant changes 11.4.3 External penetration test Every 12 months and after significant changes 11.4.4 Fix exploitable findings and retest to prove the fix After each test 11.4.5 Test segmentation controls, if you use segmentation to reduce scope Every 12 months and after changes What your assessor or acquirer will look for The methodology document. Scope showing every system tested. The report, with proof for each finding. Evidence of retesting. Segmentation test results, if segmentation is used. Who performed the test and their qualifications. How Clone Systems covers SAQ D Automated external penetration test From $1,995. Covers 11.4.3. Buy online and start the same day. Automated internal penetration test From $2,995 for 25 hosts. Covers 11.4.2. Engineer-led penetration test Covers all of 11.4, including segmentation testing, web applications, APIs and mobile apps, with a written report and free retest. Retesting is included with every test, which covers 11.4.4. Pairs with your quarterly ASV scan Your SAQ D also requires passing quarterly external ASV scans (11.3.2) and internal vulnerability scans (11.3.1). Clone Systems runs both on the same platform as your penetration test, so scope is already known. PCI ASV scanning. Who runs your test Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing. A recent SAQ D engagement A Pacific Northwest payment processing company, with web and mobile apps its business customers use to invoice, collect and send payments, validates PCI DSS with SAQ D for service providers. Clone Systems engineers tested the full platform remotely: the web application, the mobile apps, the APIs, and the external and internal networks. Every finding was written up for the assessor, with proof and a free retest of each fix. The assessor accepted the reports on the first submission. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does an automated penetration test count for SAQ D? Many assessors accept automated penetration test reports, especially for simpler environments. If your assessor requires an engineer-led test, Clone Systems engineers can perform it. What counts as a significant change? Examples include new systems in the cardholder data environment, network changes, major application releases and new payment flows. When in doubt, ask your assessor. Do I need segmentation testing? Only if you use segmentation to reduce your PCI scope. If you do, it is required every 12 months and after changes to those controls. How long does a penetration test take? Automated tests can start the same day you buy them. Engineer-led tests are scheduled after a short scoping call. Related: PCI SAQ penetration testing, PCI DSS Requirement 11.4, internal network and Active Directory testing, external network penetration testing, penetration test reports and the pen test finder. --- ## SAQ D Service Provider Penetration Test | Clone Systems URL: https://www.clone-systems.com/saq-d-service-provider-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ D SERVICE PROVIDER Does SAQ D for service providers require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. Yes. Service providers that validate with SAQ D must complete internal and external penetration testing at least every 12 months and after any significant change, and must test segmentation controls at least every 6 months under PCI DSS v4.0.1 Requirement 11.4. Multi-tenant providers must also support their customers' own testing. What SAQ D for service providers asks for REQUIREMENT IN PLAIN LANGUAGE HOW OFTEN 11.4.1 A documented testing methodology covering your whole cardholder data environment, its boundary, and both network and application layers Kept current 11.4.2 Internal penetration test Every 12 months and after significant changes 11.4.3 External penetration test Every 12 months and after significant changes 11.4.4 Fix exploitable findings and retest to prove the fix After each test 11.4.5 Test segmentation controls, if you use segmentation to reduce scope Every 12 months and after changes 11.4.6 Service providers test segmentation controls more often Every 6 months and after changes 11.4.7 Multi-tenant service providers support their customers' external penetration testing Ongoing What your assessor will look for The methodology document. Scope covering every system in the cardholder data environment, including APIs and customer-facing apps. The report, with proof for each finding. Evidence of retesting. Segmentation test results from the last two 6-month cycles. Who performed the test and their qualifications. How Clone Systems covers SAQ D for service providers Engineer-led penetration test Covers all of 11.4: internal, external, web applications, mobile apps and APIs, with a written report and a free retest. Segmentation testing every 6 months Engineers test the controls that keep your cardholder data environment separate, on the schedule 11.4.6 requires. Automated testing between engagements Automated external tests from $1,995 and internal tests from $2,995 help you retest after changes without waiting for the next engagement. Retesting is included with every test, which covers 11.4.4. Pairs with your quarterly ASV scan SAQ D also requires passing quarterly external ASV scans (11.3.2) and internal vulnerability scans (11.3.1). Clone Systems runs both on the same platform as your penetration test, so scope is already known. PCI ASV scanning. Who runs your test Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing. A recent SAQ D service provider engagement A Pacific Northwest payment processing company, with web and mobile apps its business customers use to invoice, collect and send payments, validates PCI DSS with SAQ D for service providers. Their SAQ required internal and external penetration testing, a retest of every fix, and segmentation testing every six months. Clone Systems engineers tested the full platform remotely: the web application, the mobile apps, the APIs, and the external and internal networks. Every finding was written up for the assessor, with proof and a free retest of each fix. The assessor accepted the reports on the first submission. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Why do service providers test segmentation every 6 months instead of 12? Service providers handle card data for many businesses, so PCI DSS Requirement 11.4.6 asks them to confirm segmentation twice as often as merchants. What does 11.4.7 mean for multi-tenant providers? If customers share your environment, you must support their ability to run external penetration tests, for example with a documented process and timely access. Does an automated penetration test count for a service provider? Assessors usually expect engineer-led testing for service providers. Automated tests are useful for retesting after changes between engagements. Can the whole test be done remotely? Yes. Clone Systems performs every test remotely, including internal and segmentation testing, using a secure connection into your environment. Related: PCI SAQ penetration testing, SAQ D merchant penetration testing, PCI DSS Requirement 11.4, API penetration testing, mobile app penetration testing, web application penetration testing and penetration test reports. --- ## Does SAQ A-EP Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-a-ep-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ A-EP Does SAQ A-EP require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. Yes. Ecommerce merchants that validate with SAQ A-EP must complete external penetration testing at least every 12 months and after any significant change, under PCI DSS v4.0.1 Requirement 11.4. The test covers the website and systems that control how the payment form reaches your customers, even though a third party processes the card. What SAQ A-EP asks for REQUIREMENT IN PLAIN LANGUAGE HOW OFTEN 11.4.1 A documented testing methodology covering the systems that affect your payment page, at both the network and application layer Kept current 11.4.3 External penetration test of your website and the systems that serve the payment page Every 12 months and after significant changes 11.4.4 Fix exploitable findings and retest to prove the fix After each test 11.4.5 Test segmentation controls, if you use segmentation to reduce scope Every 12 months and after changes Why SAQ A-EP sites are in scope On SAQ A-EP, your own website delivers or influences the payment form, for example with a direct post form or JavaScript that loads the processor's fields. If an attacker changes your page, they can capture card numbers before they reach the processor. The penetration test checks that your web servers, content management system and scripts cannot be used that way. What your assessor or acquirer will look for The methodology document. Scope listing the website, web servers and any system that can change the payment page. The report, with proof for each finding. Evidence of retesting. Who performed the test and their qualifications. How Clone Systems covers SAQ A-EP Automated external penetration test From $1,995 for a 30 day testing window, including authenticated web application testing. Covers 11.4.3. Buy online and start the same day. Engineer-led web application penetration test For custom checkouts, APIs and complex sites, with a written report and free retest. Quarterly PCI ASV scanning SAQ A-EP also requires passing quarterly external ASV scans of the same site (11.3.2), from $185 a year. Retesting is included with every test, which covers 11.4.4. Who runs your test Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions My processor handles the card. Why do I need a penetration test? On SAQ A-EP your website still controls how the payment form reaches the customer. If your site is compromised, card data can be captured before it reaches the processor, so PCI DSS requires testing your site. What is the difference between SAQ A and SAQ A-EP? SAQ A sites fully hand off payment to the processor with a redirect or iframe and cannot affect the payment page. SAQ A-EP sites can affect it, so many more requirements apply, including penetration testing. Does an automated penetration test count for SAQ A-EP? Many assessors accept automated penetration test reports for SAQ A-EP websites. If yours requires an engineer-led test, Clone Systems engineers can perform it. How fast can I get it done? The automated external test can be bought online and started the same day, with a 30 day window to test and retest. Related: PCI SAQ penetration testing, PCI DSS Requirement 11.4, web application penetration testing, external network penetration testing, automated penetration testing and penetration test reports. --- ## Does SAQ C Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-c-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ C Does SAQ C require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. Only for segmentation. SAQ C does not require a full internal or external penetration test. If you use segmentation to keep your payment application system separate from the rest of your network, PCI DSS v4.0.1 Requirement 11.4.5 requires a penetration test of those segmentation controls at least every 12 months and after any change to them. SAQ C also requires quarterly internal vulnerability scans and quarterly ASV scans. What SAQ C asks for in Requirement 11 REQUIREMENT IN PLAIN LANGUAGE HOW OFTEN 11.4.5 Penetration test of segmentation controls, if you use segmentation to reduce scope, by a qualified and independent tester Every 12 months and after changes to segmentation 11.3.1 Internal vulnerability scans, with high-risk and critical findings fixed and rescanned Every 3 months 11.3.2 External vulnerability scans by a PCI Approved Scanning Vendor, with a passing result Every 3 months 11.3.2.1 External scans after any significant change After significant changes 11.2.1 Check for authorized and unauthorized wireless access points Every 3 months What a segmentation test proves Segmentation is what keeps the rest of your business network out of PCI scope. The test confirms, from the systems that should be out of scope, that they cannot reach the payment application system. If segmentation fails, your whole network can fall into scope, and SAQ C may no longer be the right questionnaire. What your assessor or acquirer will look for Results from the most recent segmentation test. Proof that every segmentation method in use was tested. Evidence that the tester was qualified and independent. Four quarters of passing ASV scans. Four quarters of internal scans with high-risk findings resolved. How Clone Systems covers SAQ C Segmentation penetration test Clone Systems engineers test every segmentation control remotely and confirm your payment system is isolated, with a written report and free retest. Covers 11.4.5. Internal vulnerability scanning Quarterly internal scans with guided remediation, from $1,095 a year. Covers 11.3.1. PCI ASV scanning Quarterly external scans by an Approved Scanning Vendor since 2007, from $185 a year. Covers 11.3.2. Who runs your test Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does SAQ C require an internal or external penetration test? No. SAQ C only includes Requirement 11.4.5, the penetration test of segmentation controls. Many merchants still choose a full test to meet insurance, customer or acquirer expectations. What if I do not use segmentation? Then 11.4.5 does not apply. Without segmentation, your whole network is usually in scope, so check with your acquirer that SAQ C is still the right SAQ. Who can perform the segmentation test? A qualified internal resource or a qualified external third party with organizational independence. It does not have to be a QSA or ASV. Can a segmentation test be done remotely? Yes. Clone Systems performs segmentation testing remotely using a secure connection into your environment. Related: PCI SAQ penetration testing, PCI DSS Requirement 11.4, internal network and Active Directory testing, PCI ASV scanning and penetration test reports. --- ## Does SAQ B-IP Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-b-ip-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ B-IP Does SAQ B-IP require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. Only for segmentation. SAQ B-IP does not require a full internal or external penetration test. If you use segmentation to keep your IP-connected payment terminals separate from the rest of your network, PCI DSS v4.0.1 Requirement 11.4.5 requires a penetration test of those segmentation controls at least every 12 months and after any change to them. SAQ B-IP also requires quarterly ASV scans. What SAQ B-IP asks for in Requirement 11 REQUIREMENT IN PLAIN LANGUAGE HOW OFTEN 11.4.5 Penetration test of segmentation controls, if you use segmentation to isolate the terminals, by a qualified and independent tester Every 12 months and after changes to segmentation 11.3.2 External vulnerability scans by a PCI Approved Scanning Vendor, with a passing result Every 3 months Why segmentation matters for IP terminals Standalone IP terminals often share a network with office computers, guest Wi-Fi or point of sale systems. Segmentation keeps those systems out of PCI scope. The test confirms that nothing else on your network can reach the terminals. If it can, the rest of the network may fall into scope and SAQ B-IP may no longer apply. Our guide on proving SAQ B-IP eligibility walks through the checks. What your assessor or acquirer will look for Results from the most recent segmentation test. Proof that every segmentation method in use was tested. Evidence that the tester was qualified and independent. Four quarters of passing ASV scans. How Clone Systems covers SAQ B-IP Segmentation penetration test Clone Systems engineers test your segmentation remotely and confirm the terminals are isolated, with a written report and free retest. Covers 11.4.5. PCI ASV scanning Quarterly external scans by an Approved Scanning Vendor since 2007, from $185 a year. Covers 11.3.2. Who runs your test Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does SAQ B-IP require an internal or external penetration test? No. SAQ B-IP only includes Requirement 11.4.5, the penetration test of segmentation controls. What if my terminals are not segmented? Then 11.4.5 does not apply, but your other systems may be in scope. Confirm with your acquirer that SAQ B-IP is still the right SAQ. Who can perform the segmentation test? A qualified internal resource or a qualified external third party with organizational independence. It does not have to be a QSA or ASV. Can it be done remotely? Yes. Clone Systems performs segmentation testing remotely using a secure connection into your environment. Related: PCI SAQ penetration testing, SAQ C penetration testing, PCI DSS Requirement 11.4, PCI ASV scanning and proving SAQ B-IP eligibility. --- ## Does SAQ A Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-a-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ A Does SAQ A require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. No. SAQ A does not include penetration testing. It does include quarterly external vulnerability scans by a PCI Approved Scanning Vendor under Requirement 11.3.2, and scans after significant changes under 11.3.2.1. If your site does not pass those scans, you cannot complete SAQ A. What SAQ A asks for in Requirement 11 REQUIREMENT IN PLAIN LANGUAGE HOW OFTEN 11.3.2 External vulnerability scans by a PCI Approved Scanning Vendor, with a passing result Every 3 months 11.3.2.1 External scans after any significant change After significant changes 11.4 Penetration testing Not required for SAQ A Who qualifies for SAQ A SAQ A is for ecommerce and mail or phone order merchants that fully outsource card handling to a PCI compliant processor, for example with a redirect or an embedded payment frame, and never store, process or transmit card data themselves. The merchant must also confirm their site is not susceptible to attacks from scripts that could affect the payment process. If your own pages can change how the payment form loads, you likely need SAQ A-EP instead, which does require a penetration test. How Clone Systems covers SAQ A PCI ASV scanning Quarterly external scans by an Approved Scanning Vendor since 2007, with free rescans and guided remediation, from $185 a year. Covers 11.3.2 and 11.3.2.1. Optional external penetration test Not required for SAQ A, but often requested by cyber insurers and business customers. Automated external tests from $1,995, bought online and started the same day. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does SAQ A require an ASV scan? Yes. Under PCI DSS v4.0.1, SAQ A includes Requirement 11.3.2, quarterly external scans by an Approved Scanning Vendor with a passing result. Why do I need a scan if my processor handles the card? The scan checks the website that sends customers to the payment page. If that site is compromised, customers can be sent to a fake payment page. Do I need a penetration test for SAQ A? No. Some insurers and customers still ask for one, and Clone Systems sells automated external tests online if you need a report. What if my site fails the ASV scan? Fix the findings and rescan. Clone Systems includes free rescans and guided remediation with every ASV plan. Related: PCI SAQ penetration testing, SAQ A-EP penetration testing, PCI ASV scanning, failed PCI scan and PCI DSS SAQ A update. --- ## Does SAQ B Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-b-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ B Does SAQ B require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. No. SAQ B has no Requirement 11 section, so it does not require a penetration test, internal scans or ASV scans. It is for merchants that take cards only with imprint machines or standalone terminals that dial out over a phone line, with no internet connection and no card data stored electronically. When SAQ B stops applying IF YOU ADD YOU LIKELY MOVE TO WHAT THAT ADDS An internet-connected (IP) terminal SAQ B-IP Quarterly ASV scans and segmentation testing if used A point-of-sale system or payment software on a computer SAQ C Quarterly internal and ASV scans and segmentation testing if used A website that takes payments through a hosted payment page SAQ A Quarterly ASV scans Stored card data on any computer SAQ D for merchants Full penetration testing and scanning Who qualifies for SAQ B The official SAQ B lists these conditions. All must be true for this payment channel: You use only an imprint machine and/or standalone dial-out terminals connected over a phone line to your processor. The terminals are not connected to any other systems in your business. The terminals are not connected to the internet. You do not store card data electronically. Any card data you keep is on paper only, such as receipts or printed reports, and is never received electronically. SAQ B can apply to in-person and mail or phone order merchants. It does not apply to ecommerce or to service providers. How Clone Systems can help PCI SAQ Finder Not sure SAQ B still fits? Answer the eligibility questions in a few minutes. PCI ASV scanning Needed as soon as you add an IP terminal or a website, from $185 a year. Penetration testing when someone asks for it Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does SAQ B require an ASV scan? No. SAQ B has no Requirement 11 items. Dial-out terminals do not connect to the internet, so there is nothing for an ASV scan to test. My terminal uses Wi-Fi or an Ethernet cable. Is that still SAQ B? No. A terminal that connects over the internet points to SAQ B-IP, which requires quarterly ASV scans. Can I use SAQ B for phone orders? Yes, if you key phone or mail orders into the same standalone dial-out terminal or imprint machine and do not store the card data electronically. Who decides which SAQ I use? Your acquiring bank or the payment brands. Clone Systems is a PCI Approved Scanning Vendor, not a QSA. Related: PCI SAQ penetration testing, PCI SAQ Finder, SAQ B-IP penetration testing, SAQ C penetration testing and Resource Center. --- ## Does SAQ C-VT Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-c-vt-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ C-VT Does SAQ C-VT require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. No. SAQ C-VT has no Requirement 11 section, so it does not require a penetration test, internal scans or ASV scans. It is for merchants that type one transaction at a time into a PCI DSS compliant virtual terminal in a web browser, on a computer that is isolated from everything else. When SAQ C-VT stops applying IF YOU LIKELY MOVE TO WHAT THAT ADDS The computer is shared or connected to other systems SAQ D for merchants Full penetration testing and scanning You attach a card reader or use point-of-sale software SAQ C Quarterly internal and ASV scans and segmentation testing if used You add a website that takes payments through a hosted payment page SAQ A for that channel Quarterly ASV scans Who qualifies for SAQ C-VT The official SAQ C-VT lists these conditions. All must be true for this payment channel: Your only payment processing is a virtual terminal accessed in a web browser. The virtual terminal is provided and hosted by a PCI DSS compliant third-party service provider. The computer used for it is isolated at a single location and not connected to other locations or systems, for example by a firewall or network segmentation. The computer has no software that stores card data, such as batch processing or store-and-forward. No card readers or other devices that capture card data are attached. You do not receive, send or store card data electronically any other way. Any card data you keep is on paper only and is never received electronically. SAQ C-VT can apply to in-person and mail or phone order merchants. It does not apply to ecommerce or to service providers. How Clone Systems can help PCI SAQ Finder Confirm SAQ C-VT still fits in a few minutes. Network vulnerability assessment Check that the virtual terminal computer really is isolated from the rest of your network. Penetration testing when someone asks for it Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does SAQ C-VT require an ASV scan? No. SAQ C-VT has no Requirement 11 items. Can staff use the virtual terminal computer for email or browsing? Using it for other work makes it harder to keep it isolated. If it connects to other systems, SAQ C-VT may no longer apply. Can I use SAQ C-VT for phone orders? Yes, if staff type each phone or mail order into the virtual terminal one at a time and do not store the card data electronically. Who decides which SAQ I use? Your acquiring bank or the payment brands. Clone Systems is a PCI Approved Scanning Vendor, not a QSA. Related: PCI SAQ penetration testing, PCI SAQ Finder, SAQ C penetration testing, SAQ B penetration testing and Resource Center. --- ## Does SAQ P2PE Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-p2pe-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ P2PE Does SAQ P2PE require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. No. SAQ P2PE has no Requirement 11 section, so it does not require a penetration test, internal scans or ASV scans. It is for merchants that take cards only through payment terminals from a validated, PCI-listed point-to-point encryption (P2PE) solution, so they never have access to clear-text card data. When SAQ P2PE stops applying IF YOU LIKELY MOVE TO WHAT THAT ADDS Your terminals are encrypted but not a PCI-listed P2PE solution SAQ B-IP or SAQ C ASV scans and segmentation testing if used You add a website that takes payments through a hosted payment page SAQ A for that channel Quarterly ASV scans You store card data on any computer SAQ D for merchants Full penetration testing and scanning Who qualifies for SAQ P2PE The official SAQ P2PE lists these conditions. All must be true for this payment channel: All payment processing goes through a validated, PCI-listed P2PE solution. The only systems in your business that store, process or transmit card data are the terminals from that P2PE solution. You do not otherwise receive, send or store card data electronically. Any card data you keep is on paper only and is never received electronically. You have put in place every control in the P2PE Instruction Manual (PIM) from your P2PE solution provider. SAQ P2PE can apply to in-person and mail or phone order merchants who key orders only into the P2PE terminal. It does not apply to ecommerce or to service providers. How to confirm your solution is P2PE Ask your processor whether your terminals are part of a validated P2PE solution, then look it up on the PCI Security Standards Council list of validated P2PE solutions. "Encrypted" or "end-to-end encrypted" terminals are not the same as a PCI-listed P2PE solution. How Clone Systems can help PCI SAQ Finder Confirm SAQ P2PE still fits in a few minutes. PCI ASV scanning Needed as soon as you add a website or a non-P2PE terminal, from $185 a year. Penetration testing when someone asks for it Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does SAQ P2PE require an ASV scan? No. SAQ P2PE has no Requirement 11 items. Is every encrypted terminal P2PE? No. Only solutions validated and listed by the PCI Security Standards Council qualify for SAQ P2PE. What is the P2PE Instruction Manual? The guide your P2PE solution provider gives you for installing, inspecting and handling the terminals. Following it is a condition of using SAQ P2PE. Who decides which SAQ I use? Your acquiring bank or the payment brands. Clone Systems is a PCI Approved Scanning Vendor, not a QSA. Related: PCI SAQ penetration testing, PCI SAQ Finder, SAQ B-IP penetration testing, SAQ B penetration testing and Resource Center. --- ## Does SAQ SPoC Require a Penetration Test? | Clone Systems URL: https://www.clone-systems.com/saq-spoc-penetration-test HOME PCI SAQ PENETRATION TESTING SAQ SPOC Does SAQ SPoC require a penetration test? PCI DSS v4.0.1. Last reviewed October 2026. No. SAQ SPoC has no Requirement 11 section, so it does not require a penetration test, internal scans or ASV scans. It is for merchants that take in-person payments with a phone or tablet and a secure card reader that are part of a validated, PCI-listed Software-based PIN Entry on COTS (SPoC) solution. When SAQ SPoC stops applying IF YOU LIKELY MOVE TO WHAT THAT ADDS Your app and reader are not part of a PCI-listed SPoC or P2PE solution SAQ C or SAQ D Scanning and testing requirements You take phone or mail orders Another SAQ for that channel Use the SAQ Finder You add a website that takes payments through a hosted payment page SAQ A for that channel Quarterly ASV scans Who qualifies for SAQ SPoC The official SAQ SPoC lists these conditions. All must be true for this payment channel: All payment processing is card-present only. All card entry is through a secure card reader for PIN (SCRP) that is part of a validated SPoC solution listed by the PCI Security Standards Council. The only systems that store, process or transmit card data are those in the validated SPoC solution. You do not otherwise receive, send or store card data electronically. This payment channel is not connected to any other systems or networks in your business. Any card data you keep is on paper only and is never received electronically. You have put in place every control in the SPoC user guide from your solution provider. SAQ SPoC does not apply to kiosks, self-checkout, mail or phone orders, ecommerce, or service providers. Merchants using magnetic stripe readers that are not PTS-listed are not eligible. How Clone Systems can help PCI SAQ Finder Confirm SAQ SPoC still fits in a few minutes. PCI ASV scanning Needed as soon as you add a website or another internet-connected payment channel, from $185 a year. Penetration testing when someone asks for it Cyber insurers and business customers often ask for a pen test even when PCI does not. Automated external tests from $1,995. READY WHEN YOU ARE One team for 11.3 and 11.4 Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment. Buy an automated pen test Get a managed pen test quote Frequently asked questions Does SAQ SPoC require an ASV scan? No. SAQ SPoC has no Requirement 11 items. Does any tap-to-pay app qualify? No. Only solutions validated and listed by the PCI Security Standards Council as SPoC solutions qualify for SAQ SPoC. Ask your processor. Can I use the same phone for other things? Yes. The SAQ allows general-purpose phones and tablets, as long as you follow the SPoC user guide and the payment channel is not connected to your other systems. Who decides which SAQ I use? Your acquiring bank or the payment brands. Clone Systems is a PCI Approved Scanning Vendor, not a QSA. Related: PCI SAQ penetration testing, PCI SAQ Finder, SAQ P2PE penetration testing, SAQ C penetration testing and Resource Center. --- ## Which PCI SAQ Do I Need? Free SAQ Finder (PCI DSS v4.0.1) | Clone Systems URL: https://www.clone-systems.com/which-pci-saq-do-i-need PCI SAQ FINDER Which PCI SAQ do I need? Answer the same eligibility questions an assessor would ask. You will see which self-assessment questionnaire most likely applies, whether it requires a penetration test or ASV scans, and how to complete it. This tool gives general guidance based on the PCI DSS v4.0.1 SAQ eligibility criteria. Clone Systems is a PCI Approved Scanning Vendor (ASV), not a Qualified Security Assessor (QSA). Your acquiring bank or the payment brands decide which SAQ you must use. Confirm your result with your acquirer or a QSA before you file. STEP 1 Do you store, process or transmit card data on behalf of other businesses (for example as a payment gateway, processor, hosting provider or managed service provider)? Yes No The ten PCI SAQs at a glance SAQ Who it is for Pen test required SAQ D Service Provider Businesses that store, process or transmit card data for other businesses Yes SAQ D Merchant Merchants that store card data or do not fit another SAQ Yes SAQ A-EP Ecommerce sites whose own pages affect the payment form Yes SAQ C Payment application on a system connected to the internet When segmentation reduces scope SAQ B-IP Standalone payment terminals connected over IP When segmentation reduces scope SAQ A Ecommerce fully outsourced to a PCI compliant processor No SAQ B Imprint machines or standalone dial-out terminals No SAQ C-VT Virtual terminal on one isolated computer No SAQ P2PE PCI listed point-to-point encryption terminals only No SAQ SPoC Software-based PIN entry on a phone or tablet No FAQ Who decides which SAQ I use? Your acquiring bank or the payment brands. This finder gives guidance only. Is Clone Systems a QSA? No. Clone Systems is a PCI Approved Scanning Vendor. We perform ASV scans and penetration tests; a QSA or your acquirer confirms your SAQ. What if I accept cards more than one way? Each channel may qualify for a different SAQ. Many acquirers then require SAQ D for merchants. --- ## What a Penetration Test Costs in 2026 | Clone Systems URL: https://www.clone-systems.com/penetration-test-cost HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING A REAL PENETRATION TEST USED TO COST $10,000 A real penetration test used to cost $10,000 For twenty years, a penetration test meant hiring a consulting firm, waiting four to six weeks for a slot, paying $5,000 to $20,000, and getting a PDF that described your systems as they were on one day. Most businesses that needed one never got one, because of the price and the wait. That has changed. This page explains what a pen test is, why it cost so much, what automated testing does differently, and what each option costs today. What a penetration test actually is A vulnerability scan finds weaknesses. A penetration test tries to use them, the way an attacker would, to show what could really happen: which findings can be chained together, how far an intruder could get, and what they could reach. That difference is why auditors ask for one. SOC 2, HIPAA, ISO 27001, and PCI DSS Requirement 11.4 all call for penetration testing, and a scan alone doesn't satisfy them. Why it cost $10,000 Because a person did it. A consultant's week costs a consultant's week, plus scoping calls, a report written by hand, and a queue of other clients ahead of you. The result was thorough, but it was also a snapshot: the day after the test, every new deployment and every new vulnerability disclosure made it a little less true. And a test you can only afford once a year is a test that's out of date for eleven months of it. What changed The techniques a tester uses on the first day of an engagement, the reconnaissance, the exploit attempts, the chaining of findings, can now run as software. Automated penetration testing does that part on demand: you define the scope, it starts in minutes, it attempts real exploitation safely, and it reports what it could actually reach, not just what looked vulnerable. It doesn't replace a senior tester for the hardest problems, business logic flaws, and custom applications. It does put a real test within reach of every business, as often as they need it. What it costs now FEATURE CONSULTANT PEN TEST AUTOMATED PEN TEST (CLONE SYSTEMS) MANAGED PEN TEST (CLONE SYSTEMS) Who does the work A consulting team Our platform, running attacker techniques Our engineers Time to start 4 to 6 weeks, typically Minutes Scoped by email, scheduled within days Duration 1 to 3 weeks of testing Results in days; 30-day window to retest Depends on scope How often you can run it Once a year, usually As often as you buy a window; annual programs available Per engagement Report Written by hand Executive summary and technical findings, with retesting Written by our engineers, auditor-ready Price $5,000 to $20,000 per test External from $1,995 (1 asset, 30 days); internal from $2,995 (25 hosts, 30 days) Priced per engagement; scoping link on request How to buy Proposal and contract Online, today Request a quote Which one do you need? You need a pen test for an auditor or a customer questionnaire, on a deadline. Start with the automated external pen test. It produces the report most auditors accept for external testing, and you can have it this week. See the specific requirements for SOC 2, HIPAA, ISO 27001, PCI DSS 11.4, FTC Safeguards Rule, Cyber insurance, Customer security questionnaires, New York DFS, and Microsoft 365 certification. You need to know what an attacker could reach from inside your network. The automated internal pen test, from $2,995 for 25 hosts. You have a custom web application, complex business logic, or an auditor who insists on a human. Managed penetration testing by Clone Systems engineers. Ask for the scoping link and you'll get a fixed price for your environment. You're not sure. Start with the automated external test. Its findings tell you whether a deeper test is worth the money. Why Clone Systems Clone Systems has been a PCI Approved Scanning Vendor since 2007 and runs more than 100 million vulnerability checks a day. Automated pen testing runs on the same platform as our scanning, so a scan finding can be tested for real exploitability without switching tools. Every package includes retesting after you fix things, and the optional AI Remediation Assistant explains each finding in plain language, privately, in our own data center. Comparing vendors? See Aikido vs Clone Systems, Intruder vs Clone Systems, and Pentera vs Clone Systems. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test packages and buy online · Request managed pen test scoping Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. Consultant pricing ranges are typical market figures for a small to mid-size external engagement in 2026 and vary by scope. Need an engineer-led test? We also run external network penetration testing, internal network and Active Directory testing, web application penetration testing, API penetration testing, cloud penetration testing, mobile app penetration testing, wireless penetration testing, red team assessments, secure source code review. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to see what a real test finds? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test packages and buy online Talk to a specialist --- ## Penetration Test Report: What Is In It and Will Auditors Accept It URL: https://www.clone-systems.com/penetration-test-report HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING WHAT IS IN YOUR PENETRATION TEST REPORT, AND WILL YOUR AUDITOR ACCEPT IT? What is in your penetration test report, and will your auditor accept it? This is the question people ask right before they buy. Here is the plain answer, what the report contains, what auditors look for, a note you can send your auditor today, and what happens if they want a person to run the test. The short answer Many auditors accept our automated penetration test reports, especially for PCI DSS in environments that are not complex. The decision always belongs to your auditor, insurer, or customer, so the safest move is to ask them before you buy. It takes one message, and we wrote it for you further down this page. What the report contains Every test ends with two reports you can export from the portal: an executive report for the people who sign things, and a technical report for the people who fix things. Together they include: An executive summary in plain language Technical detail for each confirmed finding, with proof-of-exploit evidence The MITRE ATT&CK tactic and technique behind each finding Remediation guidance for each finding Retest confirmation, showing that a fix was tested again and held Reports for every type of test: external network penetration testing, internal network and Active Directory testing, web application penetration testing, API penetration testing, mobile app penetration testing, cloud penetration testing and wireless penetration testing. What auditors look for Auditors rarely care which tool ran the test. They check a short list, and this is how the test answers each item. An independent tester. Clone Systems is an outside company with no stake in your systems. We have done security testing since 1998 and have been a PCI Approved Scanning Vendor since 2007. A real attempt to break in. The test safely attempts real exploitation, credential reuse, and privilege escalation. It does not stop at listing possible weaknesses. A defined scope. You set the targets, the exclusions, and the testing window in the portal before the test starts. A recognized method. Every finding is mapped to MITRE ATT&CK, the public framework that describes how real attackers work. Proof that fixes worked. You can fix a finding and run the same test again inside your 30-day window. The retest result goes in the report. A note on PCI DSS PCI DSS Requirement 11.4 does not require your penetration tester to be a QSA or an ASV. It asks for a qualified tester who is independent of the systems being tested, a documented method, and a repeat test to confirm that what was found has been fixed. Our reports are built to give your assessor that evidence. Ask your auditor before you buy Copy this note, fill in the brackets, and send it to your auditor, insurer, or customer. We plan to meet our penetration testing requirement with an automated penetration test from Clone Systems, an independent security testing company in business since 1998 and a PCI Approved Scanning Vendor since 2007. The test attempts real exploitation of our in-scope systems from [outside, inside, or both]. The report includes an executive summary, technical detail with proof-of-exploit evidence for each confirmed finding, remediation guidance, and retest confirmation after we fix what it finds. Is this acceptable for [SOC 2, PCI DSS 11.4, HIPAA, our policy renewal, your vendor review]? If you need an engineer to perform the test, Clone Systems can provide that as well. If your auditor wants a person to run the test You have two options, and neither one means starting over somewhere else. Engineer-performed test. One of our engineers runs the test for you on the same platform, as an add-on to your order. Managed penetration test. A full engagement led by our testing team and scoped to your environment. This is the right fit for complex environments and for the business logic flaws and creative attack chains that automation cannot find. For either one, talk to a specialist and tell us what your auditor asked for. A summary you can forward Customers and insurers often want proof that a test happened without seeing the technical detail. Copy this summary onto your own letterhead, fill it in from your executive report, and send it. Keep the full report private. Penetration test summary Company: [your company name] Tested by: Clone Systems, Inc., an independent third party Type of test: [external, internal, or web application] penetration test Test window: [start date] to [end date] Scope: [number of systems and a short description] Result: [number] findings were confirmed exploitable. [All, or number] have been fixed and confirmed closed by retest on [date]. The full technical report is available under a confidentiality agreement. Signed: [name, title, date] This page is general information, not legal or audit advice. Your auditor, insurer, or customer decides what they will accept. Not sure which test you need? Answer a few questions. See pen test pricing and buy online · Talk to a specialist Related: penetration test cost, SOC 2, PCI DSS 11.4, cyber insurance, customer questionnaires, the report your SOC 2 auditor checks, a pen test report is evidence QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## SOC 2 Penetration Testing Requirements | Clone Systems URL: https://www.clone-systems.com/soc-2-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR SOC 2 Penetration testing for SOC 2 If you're preparing for a SOC 2 audit, your auditor is going to ask for a penetration test. SOC 2 never uses those words, which is why so many companies find out late. This page explains where the expectation comes from, what a report needs to show, and how to get one this week without a consulting engagement. What SOC 2 actually says The Trust Services Criteria don't list "penetration test" as a control. Two criteria create the expectation. CC4.1 asks you to "perform ongoing and/or separate evaluations" that your controls are present and functioning. CC7.1 asks you to detect "susceptibilities to newly discovered vulnerabilities." Auditors have settled on a practical reading: at least one external penetration test a year (internal too, if your infrastructure is in scope), with a written methodology and evidence that findings were fixed. Show up without one and expect an exception in your report or a delay. What your auditor needs to see A dated report covering the systems in your SOC 2 scope The methodology used and the severity of each finding Proof that findings were remediated and retested A test performed within the audit period (usually the last 12 months) Getting it done this week Clone Systems automated external penetration testing runs attacker techniques against your internet-facing systems, starts in minutes, and produces an executive summary plus technical findings with retesting included. From $1,995 for one asset over 30 days; $3,495 for 10. Add the internal penetration testing from $2,995 if your servers or office network are in scope. If your auditor asks for a human-led test or your product has complex business logic, managed penetration testing by Clone Systems engineers is scoped per environment. Why Clone Systems PCI Approved Scanning Vendor since 2007, 100 million vulnerability checks a day, published prices, buy online. Startups on their first SOC 2 can start with the founder package. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. Buy a pen test and start today · Request managed pen test scoping Related A real penetration test used to cost $10,000 Penetration testing for HIPAA Penetration testing for ISO 27001 Penetration testing for PCI DSS Requirement 11.4 Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice. Need an engineer-led test? See web application penetration testing, API penetration testing, cloud penetration testing and external network penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. Buy a pen test and start today Request managed pen test scoping --- ## HIPAA Penetration Testing Requirements | Clone Systems URL: https://www.clone-systems.com/hipaa-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR HIPAA Penetration testing for HIPAA HIPAA doesn't say "penetration test" anywhere. It says something broader that a pen test is the most direct way to satisfy. This page explains the rule, what OCR looks for, and how a covered entity or business associate can get a defensible test done quickly. What the Security Rule actually says §164.308(a)(1)(ii)(A) requires an accurate and thorough risk analysis of the risks to electronic protected health information. §164.308(a)(8) requires a "periodic technical and nontechnical evaluation" of how well your safeguards meet the rule. The Office for Civil Rights treats technical testing of your internet-facing and internal systems as part of that evaluation. HIPAA is the least prescriptive framework about frequency and method, which means the burden is on you to show you did something real, documented it, and acted on it. What a defensible HIPAA test shows The systems that store, process, or transmit ePHI were in scope Findings rated by severity, with dates Remediation and retesting of anything that could expose ePHI An annual cadence, or after major changes to systems Getting it done this week Automated external penetration testing from Clone Systems covers your internet-facing systems: patient portals, telehealth endpoints, web applications, remote access. From $1,995 for one asset. Internal penetration testing, from $2,995 for 25 hosts, covers the network where ePHI lives. Authenticated web application scanning, from $5,995 a year for 10 applications, tests behind the login where patient data is handled. Managed penetration testing by our engineers is available when a human-led engagement is required. Why Clone Systems Clone Systems has served healthcare organizations for over two decades and has been a PCI Approved Scanning Vendor since 2007. Published prices, buy online, results in days. What is changing In January 2025 the Department of Health and Human Services proposed an update to the HIPAA Security Rule that would require a penetration test at least once every 12 months and vulnerability scans at least every six months. The update is not final yet, and the government's current schedule projects a final decision in July 2027. Getting on a yearly testing rhythm now means nothing changes for you when it lands. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. Buy a pen test and start today · Request managed pen test scoping Related A real penetration test used to cost $10,000 Penetration testing for SOC 2 Penetration testing for ISO 27001 Penetration testing for PCI DSS Requirement 11.4 Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice. Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing, web application penetration testing and cloud penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. Buy a pen test and start today Request managed pen test scoping --- ## ISO 27001 Penetration Testing | Clone Systems URL: https://www.clone-systems.com/iso-27001-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR ISO 27001 Penetration testing for ISO 27001 ISO 27001:2022 doesn't mandate a penetration test by name, but two Annex A controls make it the expected evidence, and certification bodies now ask for it as a matter of course. This page covers the controls, what your certification auditor wants, and how to get a test done inside your ISMS boundary this week. What ISO 27001:2022 actually says Control 8.8, management of technical vulnerabilities, requires you to obtain information about vulnerabilities in the systems you use, evaluate your exposure, and take action. Control 8.29, security testing in development and acceptance, requires security testing to be defined and carried out. Together they mean: test your systems for real, on a schedule, record what you found, and fix it. Certification bodies generally expect at least an annual penetration test aligned to the ISMS scope, with a documented procedure and risk-based remediation. What your certification auditor needs A test covering the assets inside your ISMS boundary A documented method and severity scale Findings tracked into your risk treatment plan Evidence of retesting after fixes A recurring cadence, at least yearly Getting it done this week Clone Systems automated external penetration testing, from $1,995, covers internet-facing assets. Internal penetration testing, from $2,995 for 25 hosts, covers the internal network. External vulnerability scanning, from $595 a year for 10 IPs, gives you the ongoing monitoring control 8.8 asks for between tests. Every package includes retesting. Managed penetration testing by Clone Systems engineers is available for scopes that need a human tester. Why Clone Systems PCI Approved Scanning Vendor since 2007, scanning engine tested annually by the PCI Council, published prices, buy online. The report is written to be dropped into an ISMS evidence folder. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. Buy a pen test and start today · Request managed pen test scoping Related A real penetration test used to cost $10,000 Penetration testing for SOC 2 Penetration testing for HIPAA Penetration testing for PCI DSS Requirement 11.4 Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice. Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing, web application penetration testing and cloud penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. Buy a pen test and start today Request managed pen test scoping --- ## PCI DSS Requirement 11.4 Penetration Testing Explained URL: https://www.clone-systems.com/pci-dss-penetration-test-requirement-11-4 HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR PCI DSS REQUIREMENT 11.4 Penetration testing for PCI DSS Requirement 11.4 Of all the compliance frameworks, PCI DSS is the one that spells penetration testing out. Requirement 11.4 says what to test, how often, and what to do with the results. This page explains each part in plain language and how to meet it from the same platform you use for your ASV scans. What Requirement 11.4 actually says 11.4.1: You have a documented penetration testing methodology, covering the whole cardholder data environment and its boundaries, that includes application and network testing. 11.4.2: Internal penetration testing at least every 12 months and after any significant infrastructure or application change. 11.4.3: External penetration testing at least every 12 months and after any significant infrastructure or application change. 11.4.4: Exploitable vulnerabilities found by testing are corrected and the fix is verified by retesting. 11.4.5: If you use segmentation to isolate the cardholder data environment, segmentation controls are tested at least every 12 months and after any change to them. 11.4.6: Service providers test segmentation at least every six months and after any change. 11.4.7: Multi-tenant service providers support their customers' testing. A penetration test is not the same as your quarterly ASV scan. Requirement 11.3 covers scanning; 11.4 covers testing. You need both. Getting it done this week Clone Systems sells both halves of 11.4 online. Automated external penetration testing, from $1,995 for one asset (30 days), covers 11.4.3. Automated internal penetration testing, from $2,995 for 25 hosts, covers 11.4.2. Retesting is included, which is 11.4.4. Both run on the same platform as your ASV scanning, so the systems in scope are already known. Segmentation testing and any test where your QSA requires a human tester are handled by managed penetration testing from Clone Systems engineers, scoped per environment. Why Clone Systems A PCI Approved Scanning Vendor since 2007. The same company that runs your quarterly ASV scans can run your annual penetration test, and your QSA gets one consistent set of reports. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. Buy a pen test and start today · Request managed pen test scoping Related A real penetration test used to cost $10,000 Penetration testing for SOC 2 Penetration testing for HIPAA Penetration testing for ISO 27001 Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice. Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing and web application penetration testing. Which SAQs require a penetration test?. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. Buy a pen test and start today Request managed pen test scoping --- ## FTC Safeguards Rule Penetration Testing | Clone Systems URL: https://www.clone-systems.com/ftc-safeguards-rule-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR THE FTC SAFEGUARDS RULE Penetration testing for the FTC Safeguards Rule If your business handles consumer financial information, the FTC Safeguards Rule probably applies to you, even if you have never thought of yourself as a financial institution. Car dealerships, tax preparers, and mortgage brokers are all on the list. The rule asks for a penetration test every year and a vulnerability assessment every six months. This page explains who is covered, what the rule says, and how to get both done this week without hiring a consulting firm. Who the rule covers The rule applies to non-bank "financial institutions," and the FTC defines that broadly. Its own examples include: Automobile dealerships that lease vehicles or arrange financing Tax preparers and accountants who prepare income tax returns Mortgage brokers and lenders Payday lenders and finance companies Collection agencies Check cashers and wire transfer businesses Credit counselors and some financial advisors Real estate settlement services Guides by industry: auto dealerships, tax and accounting firms, mortgage brokers and lenders. What the rule says Section 314.4(d)(2) of the rule (16 CFR Part 314) says that unless you have continuous monitoring in place, you must conduct "annual penetration testing" of your information systems and vulnerability assessments "at least every six months," and again whenever your operations change in a material way. The rule defines a penetration test as an attempt "to circumvent or defeat the security features of an information system" from outside or inside your systems. A vulnerability scan on its own does not meet that definition. You need both. The small business exception If you keep customer information on fewer than 5,000 consumers, section 314.6 exempts you from the specific testing schedule above. You still have to protect customer information and regularly test your safeguards, and many small firms run the same tests anyway because an insurer, a lender, or a software partner asks for them. Both requirements, one checkout Automated external penetration test, from $1,995 for a 30-day window (1 external IP or domain). It starts the same day, safely attempts real exploitation, includes retests after you fix things, and ends with a report you can hand to an examiner. Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts), for your office network. External vulnerability scanning, from $595 a year (10 IPs), run on a schedule so the every-six-months assessment is covered all year. When you need an engineer If your examiner, insurer, or attorney asks for a test led by a named engineer, our managed penetration testing team does that. This page is general information, not legal advice. Ask your attorney or compliance advisor how the rule applies to your business. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: SOC 2, HIPAA, ISO 27001, PCI DSS 11.4, penetration test cost Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing and wireless penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## Penetration Testing for Auto Dealerships: FTC Safeguards Rule URL: https://www.clone-systems.com/auto-dealership-ftc-safeguards-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR AUTO DEALERSHIPS UNDER THE FTC SAFEGUARDS RULE Penetration testing for auto dealerships under the FTC Safeguards Rule If your dealership arranges financing or leases vehicles, the FTC treats you as a financial institution. That puts you under the Safeguards Rule, which asks for a penetration test every year and a vulnerability assessment every six months. Here is what that means for a dealership, and how to get it done this week without a sales call. Why a dealership counts as a financial institution The FTC's own guidance for dealers says that dealers who finance, or help arrange financing for, vehicles for consumers are financial institutions under the Safeguards Rule. Dealers that lease vehicles for longer than 90 days are covered as well. It does not matter that a bank or a captive lender ends up holding the loan. If your finance office collects the application, you hold the customer's information, and the rule applies to you. What you are protecting A single deal jacket holds almost everything a criminal needs: a credit application, a Social Security number, a driver's license copy, income and employment details, and insurance information. Multiply that by every customer still in your systems. The rule covers that information wherever it sits, including your website and lead forms, your showroom and back office network, your Wi-Fi, and the remote access your staff and vendors use. What the rule asks for Section 314.4(d)(2) of the rule (16 CFR Part 314) says that unless you have continuous monitoring in place, you must conduct "annual penetration testing" of your information systems and vulnerability assessments "at least every six months," and again whenever your operations change in a material way. The rule defines a penetration test as an attempt "to circumvent or defeat the security features of an information system" from outside or inside your systems. A vulnerability scan on its own does not meet that definition. You need both. What about your DMS and CRM vendors The FTC's dealer guidance treats a vendor as a service provider when it receives, maintains, processes, or can access your customer information. You are expected to require those vendors to keep safeguards in place and to check on them from time to time. Ask each vendor for its most recent penetration test summary. Their test covers their platform. It does not cover your own network, your website, your Wi-Fi, or the computers in your finance office. Those are yours to test. The small dealer exception If you keep customer information on fewer than 5,000 consumers, section 314.6 exempts you from the fixed testing schedule above. The count is the number of consumers whose information you keep, so past customers still in your systems count too. You still have to protect customer information and regularly test your safeguards, and many smaller stores run the same tests anyway because an insurer or a lender asks for them. Why dealers are testing now Since 2024 the rule also requires you to notify the FTC within 30 days of discovering a security event that involves the unencrypted information of at least 500 consumers. A test that finds the open door first is far cheaper than that notice. Both requirements, one checkout Automated external penetration test, from $1,995 for a 30-day window (1 external IP or domain). You set the scope, it starts in minutes, it safely attempts real exploitation, it includes retests after you fix things, and it ends with a report you can hand to an examiner, an insurer, or your attorney. Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts), for the showroom, service, and finance office network. External vulnerability scanning, from $595 a year (10 IPs), run on a schedule so the every-six-months assessment is covered all year. Dealer groups with several stores: the Standard external test covers 10 external IPs or domains for $3,495, and annual programs start at $5,995 a year. When you need an engineer If your examiner, insurer, or attorney asks for a test led by a named engineer, our managed penetration testing team does that. This page is general information, not legal advice. Ask your attorney or compliance advisor how the rule applies to your business. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: FTC Safeguards Rule overview, tax and accounting firms, mortgage brokers and lenders, cyber insurance, penetration test cost Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing and wireless penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## Penetration Testing for Tax Preparers and Accounting Firms URL: https://www.clone-systems.com/tax-preparer-ftc-safeguards-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR TAX PREPARERS AND ACCOUNTING FIRMS UNDER THE FTC SAFEGUARDS RULE Penetration testing for tax preparers and accounting firms under the FTC Safeguards Rule If you prepare income tax returns for a living, the FTC treats your firm as a financial institution. That puts you under the Safeguards Rule. Most preparers know about the written security plan. Fewer know the rule also asks larger firms for a penetration test every year and a vulnerability assessment every six months. Here is how it works and how to get it done before filing season. Why a tax practice counts as a financial institution The rule's own list of examples includes "an accountant or other tax preparation service that is in the business of completing income tax returns." The IRS repeats this in Publication 4557, its data security guide for tax professionals. It applies to solo preparers, enrolled agents, CPA firms, and bookkeeping firms that prepare returns. The plan is step one. Testing is step two. When you apply for or renew your PTIN, the form asks you to confirm you know the law requires a written information security plan. The IRS publishes a template for that plan in Publication 5708. A plan on paper says what you intend to do. The Safeguards Rule also expects you to check that it works. IRS Publication 4557 puts it this way: design and implement a safeguards program, and regularly monitor and test it. What the rule asks for Section 314.4(d)(2) of the rule (16 CFR Part 314) says that unless you have continuous monitoring in place, you must conduct "annual penetration testing" of your information systems and vulnerability assessments "at least every six months," and again whenever your operations change in a material way. The rule defines a penetration test as an attempt "to circumvent or defeat the security features of an information system" from outside or inside your systems. A vulnerability scan on its own does not meet that definition. You need both. What you are protecting Client files hold Social Security numbers, bank account numbers for refunds, W-2s, prior year returns, and copies of identification. Criminals use stolen client files to file false returns in your clients' names. The systems in scope are the ones you control: your office network, your workstations and laptops, remote access for staff who work from home, your website, and any client portal you host. The small firm exception If you keep customer information on fewer than 5,000 consumers, section 314.6 exempts you from the fixed testing schedule above. Count carefully. The count is the number of consumers whose information you keep, so clients from prior years who are still in your files count too. Either way you still need the written plan and you still have to test your safeguards regularly. Many smaller firms run the same tests anyway because a cyber insurance application asks for them. Why fall is the time to test A test in the fall gives you time to fix what it finds before client documents start arriving in January. The 30-day window includes retests, so you can confirm each fix and start the season with a clean, dated report. Both requirements, one checkout Automated external penetration test, from $1,995 for a 30-day window (1 external IP or domain). You set the scope, it starts in minutes, it safely attempts real exploitation, it includes retests after you fix things, and it ends with a report you can keep with your written security plan. Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts), for your office network and workstations. External vulnerability scanning, from $595 a year (10 IPs), run on a schedule so the every-six-months assessment is covered all year. Internal vulnerability scanning, from $1,095 a year (up to 128 internal IPs), for the computers inside your office. When you need an engineer If your insurer, a client, or your attorney asks for a test led by a named engineer, our managed penetration testing team does that. This page is general information, not legal advice. Ask your attorney or compliance advisor how the rule applies to your business. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: FTC Safeguards Rule overview, auto dealerships, mortgage brokers and lenders, cyber insurance, penetration test cost Need an engineer-led test? See external network penetration testing and internal network and Active Directory testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## Penetration Testing for Mortgage Brokers and Lenders URL: https://www.clone-systems.com/mortgage-broker-ftc-safeguards-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR MORTGAGE BROKERS AND LENDERS UNDER THE FTC SAFEGUARDS RULE Penetration testing for mortgage brokers and lenders under the FTC Safeguards Rule Mortgage brokers and non-bank mortgage lenders are financial institutions under the FTC Safeguards Rule. The rule asks for a penetration test every year and a vulnerability assessment every six months. Here is what that means for a mortgage company, and how to get it done this week without a sales call. Why a mortgage company is covered The rule names mortgage brokers in its own list of examples, because brokering loans is a financial activity. The FTC's guidance also lists mortgage lenders, and the rule lists real estate settlement services. Banks and federally insured credit unions answer to their own regulators instead. If you are a broker, a non-bank lender, or a settlement company, the FTC rule is the one that applies to you. Your state examiner may ask too The Conference of State Bank Supervisors, the group that represents state financial regulators, published a model data security law for non-bank financial companies in 2023. It is largely based on the FTC Safeguards Rule. If your state regulator examines you, you may be asked about the same testing. Companies licensed in New York also answer to the New York Department of Financial Services. What you are protecting A loan file is one of the most complete records of a person that exists: the application, tax returns, pay stubs, bank statements, a credit report, and a Social Security number. The systems in scope are the ones you control: your website and online application forms, your office and branch networks, the laptops your loan officers carry, and the remote access your staff use. What the rule asks for Section 314.4(d)(2) of the rule (16 CFR Part 314) says that unless you have continuous monitoring in place, you must conduct "annual penetration testing" of your information systems and vulnerability assessments "at least every six months," and again whenever your operations change in a material way. The rule defines a penetration test as an attempt "to circumvent or defeat the security features of an information system" from outside or inside your systems. A vulnerability scan on its own does not meet that definition. You need both. What about your loan origination system If your loan software is hosted by a vendor, that vendor is your service provider under the rule. You are expected to require it to keep safeguards in place and to check on it from time to time. Ask the vendor for its most recent penetration test summary. Their test covers their platform. Your own network, website, and computers are yours to test. The small company exception If you keep customer information on fewer than 5,000 consumers, section 314.6 exempts you from the fixed testing schedule above. The count is the number of consumers whose information you keep, so borrowers from past years who are still in your files count too. You still have to protect customer information and regularly test your safeguards. Both requirements, one checkout Automated external penetration test, from $1,995 for a 30-day window (1 external IP or domain). You set the scope, it starts in minutes, it safely attempts real exploitation, it includes retests after you fix things, and it ends with a report you can hand to an examiner. Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts), for your office or branch network. External vulnerability scanning, from $595 a year (10 IPs), run on a schedule so the every-six-months assessment is covered all year. Companies with several branches or websites: the Standard external test covers 10 external IPs or domains for $3,495, and annual programs start at $5,995 a year. When you need an engineer If your examiner, insurer, or attorney asks for a test led by a named engineer, our managed penetration testing team does that. This page is general information, not legal advice. Ask your attorney or compliance advisor how the rule applies to your business. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: FTC Safeguards Rule overview, New York DFS, auto dealerships, tax and accounting firms, penetration test cost Need an engineer-led test? See external network penetration testing and internal network and Active Directory testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## Penetration Testing for Cyber Insurance | Clone Systems URL: https://www.clone-systems.com/cyber-insurance-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR CYBER INSURANCE Penetration testing for cyber insurance Your cyber insurance application or renewal form has a question about penetration testing. Answering "yes, within the last 12 months" takes a real test and a dated report. This page explains what insurers ask, why a scan is not the same thing, and how to get a report before your renewal date. What insurers ask Forms differ by carrier, but the questions are similar: Do you conduct penetration testing? How often? Which kinds: external network, internal network, web application? Is it done by an outside party? Insurers generally want to see testing within the last 12 months. Why the answer matters The application becomes part of your policy. An answer that turns out to be inaccurate can cause problems when you file a claim. If you have only run vulnerability scans, say so, or get a penetration test and answer yes with a report to back it up. A scan is not a penetration test A vulnerability scan lists known weaknesses. A penetration test attempts to exploit them and shows how far an attacker could get. Insurers ask about them separately. Get the report before your renewal Automated external penetration test, from $1,995 for a 30-day window (1 external IP or domain). Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts). Annual programs from $5,995 per year, so the answer stays "at least annually" every renewal. Each test starts the same day, includes retests after you fix findings, and ends with an executive summary and a technical report. If your carrier wants an engineer-led test Requirements vary by insurer, so ask your broker what your carrier accepts. If they ask for a test led by a named engineer, our managed penetration testing team does that. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: SOC 2, HIPAA, ISO 27001, PCI DSS 11.4, penetration test cost Need an engineer-led test? See external network penetration testing and internal network and Active Directory testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## A Customer Asked for Your Penetration Test Report | Clone Systems URL: https://www.clone-systems.com/vendor-security-questionnaire-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING A CUSTOMER ASKED FOR YOUR PENETRATION TEST REPORT A customer asked for your penetration test report A bigger company wants to buy from you, and their security team sent a questionnaire. One line asks for your most recent independent penetration test. If you do not have one, the deal waits. This page explains what they want to see and how to get it this week. What the questionnaire is asking Standard questionnaires such as the SIG and the CAIQ, and most custom ones, ask the same things: Has an independent third party tested your systems in the last 12 months? What was in scope? Were the findings fixed? Can you share a summary? What a good report shows The date and the scope of the test That an independent party ran it The method used Findings ranked by severity, with proof Evidence that fixes were retested Get it this week Standard external penetration test, $3,495 for a 30-day window: 10 external IPs or domains, with authenticated web application testing included. This is the usual fit for a software company. Starter external penetration test, $1,995 for a 30-day window: 1 external IP or domain. Buy online, start the same day, fix what it finds, retest inside the window, then send your customer the executive summary instead of the full technical detail. If the customer asks for a human-led test Some enterprise customers specify a test led by a named engineer. Our managed penetration testing team does that. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: SOC 2, HIPAA, ISO 27001, PCI DSS 11.4, penetration test cost Need an engineer-led test? See web application penetration testing, API penetration testing and cloud penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## NYDFS Penetration Testing: What 23 NYCRR 500 Requires | Clone Systems URL: https://www.clone-systems.com/nydfs-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR THE NEW YORK DFS CYBERSECURITY REGULATION Penetration testing for the New York DFS cybersecurity regulation If your company holds a license, registration, or charter from the New York Department of Financial Services, its cybersecurity regulation applies to you. That covers banks, insurers and insurance agencies, mortgage companies, money transmitters, and other financial businesses licensed in New York. The regulation asks for penetration testing every year, from both inside and outside your systems. This page explains what it says and how to get both tests done without a consulting engagement. What the regulation says Section 500.5 of the regulation (23 NYCRR Part 500) requires covered entities to conduct penetration testing "from both inside and outside" the boundaries of their information systems, at least annually, by a "qualified internal or external party." It also requires automated scans of your systems for vulnerabilities, and prompt fixes ranked by risk. Inside and outside means two tests The outside test checks what an attacker on the internet can reach: your public websites, remote access, and anything else exposed. The inside test starts from a foothold on your network and shows how far an intruder could move. An external test on its own does not satisfy the regulation. You need both. The small company exemption Smaller covered entities, for example those with fewer than 20 employees, may qualify for a limited exemption under section 500.19 that removes the annual penetration testing requirement. Check section 500.19 or ask your compliance advisor before you rely on it. Many exempt firms still test because their insurer or a business partner asks for it. Both tests, one checkout Automated external penetration test, from $1,995 for a 30-day window (1 external IP or domain). Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts). Vulnerability scanning on a schedule, from $595 a year for external (10 IPs) and from $1,095 a year for internal. Each test starts the same day, safely attempts real exploitation, includes retests after you fix findings, and ends with an executive summary and a technical report for your records and your examiner. When you need an engineer If your examiner or your own policy calls for a test led by a named engineer, our managed penetration testing team does that. This page is general information, not legal advice. Ask your attorney or compliance advisor how the regulation applies to your business. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: SOC 2, HIPAA, ISO 27001, PCI DSS 11.4, FTC Safeguards Rule, cyber insurance, penetration test cost Need an engineer-led test? See external network penetration testing, internal network and Active Directory testing and web application penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## Penetration Testing for Microsoft 365 App Certification | Clone Systems URL: https://www.clone-systems.com/microsoft-365-certification-penetration-test HOME BLOGS & ANNOUNCEMENTS PENETRATION TESTING PENETRATION TESTING FOR MICROSOFT 365 APP CERTIFICATION Penetration testing for Microsoft 365 app certification If you are taking an app for Teams, Outlook, or Microsoft 365 through Microsoft 365 Certification, a penetration test report is one of the pieces of evidence you will be asked for. This page explains what Microsoft's requirements say the test must cover and how to get the report without a long consulting engagement. What Microsoft asks for Microsoft's certification requirements say penetration testing is mandatory for any app that connects to services not hosted or managed by Microsoft. The test must: Take place every 12 months Be conducted by "a reputable independent company" Cover web application testing, both authenticated and unauthenticated Cover external infrastructure, and internal infrastructure where it applies Run against the live production environment that supports the app Include your full external footprint, such as IP addresses, URLs, and API endpoints, documented in the report What a matching test looks like Standard external penetration test, $3,495 for a 30-day window: 10 external IPs or domains, with authenticated web application testing included. This is the usual fit for an app that has a login. Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts), if your environment has internal infrastructure in scope. You set the scope yourself in the portal, so your full external footprint can be listed and appears in the report. Fix, retest, then submit The test runs inside a 30-day window. Fix what it finds, retest inside the same window, and submit the report that shows the issues closed. If the reviewer wants an engineer-led test Microsoft's certification analysts decide whether the evidence meets their requirements. If they ask for a test led by a named engineer, our managed penetration testing team does that. Microsoft, Microsoft 365, Teams, and Outlook are trademarks of the Microsoft group of companies. Clone Systems is not affiliated with Microsoft. Not sure which test you need? Answer a few questions. Will your auditor accept it? See what is in the report. See pen test pricing and buy online · Talk to a specialist Related: SOC 2, HIPAA, ISO 27001, PCI DSS 11.4, FTC Safeguards Rule, cyber insurance, penetration test cost Need an engineer-led test? See web application penetration testing, API penetration testing and cloud penetration testing. QUICK FACTS: PENETRATION TESTING PRICE Automated penetration testing from $1,995 for a 30-day testing window. Annual programs from $5,995 per year. SCOPE External and internal infrastructure, plus authenticated web application testing from $2,495. HOW TO BUY Published prices, ordered online. Expert-led manual testing is scoped with our team. VENDOR Clone Systems, managed security and penetration testing since 1998. See penetration testing pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to get your pen test done this week? Automated penetration testing from Clone Systems starts at $1,995 for an external test and $2,995 for an internal test. Buy it online, start in minutes, and retest for free within your 30-day window. See pen test pricing and buy online Talk to a specialist --- ## Failed a PCI Scan? What to Do Right Now (2026) | Clone Systems URL: https://www.clone-systems.com/failed-pci-scan HOME BLOGS & ANNOUNCEMENTS PCI COMPLIANCE FAILED YOUR PCI SCAN? HERE'S WHAT TO DO RIGHT NOW. Failed your PCI scan? Here's what to do right now. If your payment processor, bank, or scanning vendor just told you that you failed a [PCI scan](/pci-asv-scan-external-vulnerability-scanning), take a breath. A failed scan is not a fine, not a breach, and not the end of your ability to take cards. It is a list of things to fix, and most merchants pass on the next scan once they know what the list means. This page walks you through it in plain language. First, understand what "failed" means A PCI ASV scan is an outside check of your internet-facing systems (your website, your server, your firewall) by a PCI Approved Scanning Vendor. It fails if the scanner finds any issue rated medium severity or higher (a CVSS score of 4.0 or above), or any issue the PCI Council calls an automatic failure, such as an exposed database or a known-vulnerable version of software. One finding is enough to fail the whole scan. That is why a site that has been fine for years can suddenly fail after a certificate expires or a hosting provider changes a setting. Second, decide which of the three situations you're in It's a real problem. Something on your side needs fixing: an old TLS version, an expired certificate, an open port, unpatched software. This is the most common case. Our guides on the common reasons scans fail and what to fix before your next scan cover each one. Fix it, then rescan. It's a false positive. The scanner flagged something that isn't actually a risk in your setup. This happens more than people expect (see the list below). You don't fix it, you dispute it with evidence. It's out of scope. The scan hit something that isn't yours or isn't part of your card environment: a shared IP at your host, a neighbor's system, a decommissioned server still in DNS. You correct the scope and rescan. The famous false positives These trip up merchants every quarter. Each one is real, well known, and disputable. The TCP source port firewall issue. Some firewalls let traffic through if it comes from certain source ports (often 20, 53, or 88). Scanners flag it as a firewall bypass. If your firewall actually filters by destination and state, this is disputable with your firewall configuration as evidence. CDN and proxy findings. If your site sits behind a CDN or a web application firewall, the scanner is looking at the CDN's servers, not yours. Findings about the CDN's TLS settings or headers are usually the CDN's responsibility and are disputable with the CDN's own documentation. Load balancers and multiple IPs. A load balancer can answer differently on each scan, and a scan of one IP can surface a backend server that isn't in scope. Our guide on load balancers and PCI ASV scanning explains how to scope these correctly. The scanner was blocked. If your firewall or hosting provider blocked the scanner's addresses, the scan is incomplete and can be reported as a failure. Whitelist the ASV scanner range first, then rescan. We give our scanner range to customers directly. Our whitelisting guide has the steps. A patched version that still reports the old number. Some Linux distributions backport security fixes without changing the version number the scanner sees. Disputable with the package changelog showing the fix. How to dispute a finding Under the PCI ASV program, you can dispute any finding you believe is a false positive, is compensated for by another control, or is out of scope. You submit evidence, the ASV reviews it, and if it holds up, the finding is marked as an exception and no longer fails the scan. With Clone Systems, you submit disputes and exception requests inside the portal under Options. Our security team reviews them, usually within 24 hours, and you rescan as soon as the exception is approved. Rescans are free and unlimited until you pass. Your deadline PCI requires a passing scan every three months, and your processor usually expects one by the end of each calendar quarter: March 31, June 30, September 30, and December 31. Some processors charge a monthly non-compliance fee once you miss the date. The fee stops once you submit a passing scan, so the goal is speed, not perfection: fix or dispute the findings, rescan, and pass. Our guide on PCI scan deadlines covers the dates and what processors typically require. If you don't have a scanning vendor, or want a second opinion You can buy a PCI ASV scan from Clone Systems online and run it today. Starter is $185 a year for one IP or domain, and every package includes unlimited rescans until you pass, so a failed first scan costs nothing extra. You get the same attestation report your processor asks for. If your findings are hard to read, the optional AI Remediation Assistant explains each one in plain language and tells you what to change; it runs privately in our own data center, so your scan data never goes to an outside AI service. Buy a PCI scan and run it today · Talk to a specialist Guides for the specific fixes Common reasons PCI ASV scans fail and how to resolve them What to fix before your next ASV scan Whitelisting the ASV scanner for a valid PCI scan Load balancers and PCI ASV scanning Making sense of PCI ASV reports PCI scan deadlines Why you still need an ASV scan with a payment provider checkout What is a PCI compliance scan Clone Systems has been a PCI Security Standards Council Approved Scanning Vendor since 2007. This page is general guidance, not a substitute for your processor's specific requirements. QUICK FACTS: PCI ASV SCANNING PRICE $185 per year for 1 IP or domain. $625 per year for 10. $1,575 per year for 25. INCLUDED Quarterly PCI ASV scans, unlimited rescans, and the Attestation of Scan Compliance after a passing scan. HOW TO BUY Order online with no sales call. Portal access is created automatically when payment goes through. VENDOR Clone Systems, a PCI SSC Approved Scanning Vendor since 2007, in business since 1998. Code 5COST: 5% off eligible PCI ASV scanning purchases. See PCI scan pricing Prices verified September 9, 2026 READY WHEN YOU ARE Need to pass your next PCI scan? Our automated PCI ASV scan is bought and run online today. Every package includes unlimited rescans until you pass, so a failed first scan costs nothing extra. Buy a PCI scan Talk to a specialist --- ## What Free Website Scanners Miss | Clone Systems URL: https://www.clone-systems.com/what-free-website-scanners-miss HOME BLOGS & ANNOUNCEMENTS VULNERABILITY SCANNING WHAT YOUR FREE WEBSITE SCANNER MISSES What your free website scanner misses Type your domain into any free "website security checker" and you get a green badge in ten seconds. It feels good. It also tells you almost nothing about whether an attacker could get in. This page explains what those free tools actually check, what they skip, and what the scan standard used by the card industry looks at instead. What a free checker actually does Most free scanners run a handful of quick, harmless tests from the outside: is your SSL certificate valid, do you send a few recommended security headers, is your software version visibly out of date, is your site on a malware blacklist. They finish in seconds because they don't probe anything. They read what your site announces about itself and grade it. That's useful for catching an expired certificate. It is not a security assessment. What it skips Open ports and services. A free checker looks at your website on port 443. An attacker looks at everything else: a database port left open, a remote desktop service, an old FTP server, a management interface. A full scan probes every port on every address you own. Known vulnerabilities in what's running. Free tools might notice you're on an old version. A real scanner tests for the specific weaknesses in that version, thousands of them, and tells you which ones apply to you. Weak encryption in practice. "Certificate valid" is not the same as "encryption strong." Old TLS versions and weak cipher suites pass a certificate check and fail a real scan. Web application flaws. SQL injection, cross-site scripting, broken authentication. These live in your forms, logins, and search boxes. A header check can't see them; a web application scan is built to find them. The things you forgot you had. A staging server, an old subdomain, a test environment still online. Free checkers scan the address you typed. A proper scan starts by finding every address that belongs to you. Anything on the inside. Free checkers only see the outside. Internal scanning and agent-based scanning look at the systems behind your firewall, where most damage actually happens. What "bank-grade" means When you accept card payments, the card brands require your internet-facing systems to be scanned every quarter by a PCI Approved Scanning Vendor, an ASV. There are only about 80 ASVs in the world, and each one's scanning engine is tested and re-approved by the PCI Security Standards Council every year. The scan has to find any vulnerability rated medium or higher, and one finding fails the whole scan. It is the strictest routine scanning standard in general use, because money is on the line. That standard isn't only for merchants. The same engine that decides whether a bank's merchant passes can scan any website, server, or application. Clone Systems has been an ASV since 2007, runs more than 100 million vulnerability checks a day, and sells that scan online to anyone who wants to know what an attacker would find. Side by side FREE WEBSITE CHECKER CLONE SYSTEMS EXTERNAL SCAN Time to result Seconds Minutes to hours, depending on scope What it looks at The web page you typed in Every port and service on every address you own Certificate check Yes Yes, plus protocol and cipher strength Known vulnerability testing Version lookup at best Thousands of specific checks, updated daily Web application flaws No Yes, with authenticated web app scanning Finds forgotten assets No Yes, discovery is part of the scan Rescans after you fix things Run it again yourself Free, unlimited rescans Explains what to fix A grade Findings with remediation steps, plus an optional AI assistant that explains each one in plain language Accepted by banks and auditors No Yes, from a PCI Approved Scanning Vendor Price Free From $595 a year for 10 IPs; PCI ASV scans from $185 When a free checker is enough If you run a personal blog with no logins, no forms, and no payments, a free checker plus keeping your software updated is a reasonable place to stop. When it isn't If your site takes payments, has customer logins, stores anyone's data, or is something your business would suffer without, a free checker is a false sense of security. The next step doesn't need a security team or a sales call: external vulnerability scanning from Clone Systems starts at $595 a year for 10 IPs, you buy it online, and you can run the first scan today. See scanning packages and buy online · Talk to a specialist Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. QUICK FACTS: VULNERABILITY SCANNING PRICE External vulnerability scanning from $595 per year, ordered online. SCOPE External, internal, and agent-based scanning in one self-managed portal, sized by IP count. STANDARD Checks mapped to PCI DSS, HIPAA, SOC 2, NIST, and ISO 27001 requirements. VENDOR Clone Systems, a PCI SSC Approved Scanning Vendor, in business since 1998. See vulnerability scanning pricing Prices verified September 9, 2026 READY WHEN YOU ARE Ready to see what a real scan finds? External vulnerability scanning from Clone Systems starts at $595 a year for 10 IPs. Buy it online, run your first scan today, and rescan for free whenever you fix something. See scanning packages and buy online Talk to a specialist --- ## PCI Scan Deadline: When Is Your Next Quarterly ASV Scan Due? URL: https://www.clone-systems.com/pci-scan-deadline HOME PCI SCAN DEADLINE When is your next PCI scan due ? The current PCI quarterly scan window (Q4 2026) ends December 31, 2026. 71 days remain. The next window opens January 1, 2027 and ends March 31, 2027. Order a PCI scan How PCI ASV scanning works This page recalculates every day. Today is October 21, 2026. SCAN WINDOWS FOR 2026 The four quarterly scan windows this year. A passing ASV scan is needed inside each window. Next year follows the same calendar quarters. QUARTER WINDOW OPENS WINDOW CLOSES STATUS Q1 2026 January 1, 2026 March 31, 2026 Closed Q2 2026 April 1, 2026 June 30, 2026 Closed Q3 2026 July 1, 2026 September 30, 2026 Closed Q4 2026 October 1, 2026 December 31, 2026 Open now WHAT THE REQUIREMENT SAYS Three things decide your real deadline. At least once every three months PCI DSS 4.0.1 Requirement 11.3.2 requires an external vulnerability scan by an Approved Scanning Vendor at least quarterly, with a passing result. And after any significant change A new public-facing system, a network change, or a payment page update calls for a scan outside the regular cycle. Your acquirer sets the exact due date Most acquirer and processor programs line the requirement up with calendar quarters. Their compliance portal is the final word on your date. RUNNING LATE The fastest path to a passing scan. Scanning is quick. Fixing findings is the part that takes time, so start before the last week of the quarter. 01 Order online Pick the PCI package that matches your IP or domain count. Portal access is created automatically when payment goes through. 02 Launch an instant scan No download and no setup call. Add your public-facing assets and start the scan right away. 03 Fix what fails, then rescan Rescans are unlimited and included, so you can verify each fix until the scan passes. 04 Send the attestation After a passing scan you receive the Attestation of Scan Compliance for your acquirer or QSA. QUICK FACTS: PCI ASV SCANNING PRICE $185 per year for 1 IP or domain. $625 per year for 10. $1,575 per year for 25. INCLUDED Quarterly PCI ASV scans, unlimited rescans, and the Attestation of Scan Compliance after a passing scan. HOW TO BUY Order online with no sales call. Portal access is created automatically when payment goes through. VENDOR Clone Systems, a PCI SSC Approved Scanning Vendor since 2007, in business since 1998. Code 5COST: 5% off eligible PCI ASV scanning purchases. See PCI scan pricing Prices verified September 9, 2026 COMMON QUESTIONS PCI scan deadline questions, answered. When does the current PCI quarterly scan window close? The current PCI quarterly scan window (Q4 2026) ends December 31, 2026. 71 days remain. The next window opens January 1, 2027 and ends March 31, 2027. Most acquirer programs align quarterly ASV scans to calendar quarters; confirm the exact due date in your acquirer's compliance portal. How often does PCI DSS require an ASV scan? PCI DSS 4.0.1 Requirement 11.3.2 requires an external vulnerability scan by a PCI SSC Approved Scanning Vendor at least once every three months, plus a scan after any significant change to internet-facing systems in the cardholder data environment. The scan must produce a passing result. What happens if I miss the quarter? Your acquirer decides how a missed quarter is handled. Many charge a monthly non-compliance fee until a passing scan is on file. The fastest fix is to run a scan as soon as possible, remediate any failing findings, rescan, and submit the Attestation of Scan Compliance. Can I still pass if I order near the end of the quarter? Clone Systems creates portal access automatically when payment goes through, so you can launch a scan right away and rescans are unlimited. Remediation is the part that takes time, so leave room to fix findings before the window closes. READY WHEN YOU ARE Get a passing scan on file before the window closes. Published prices, instant scan launch, unlimited rescans, and the attestation your acquirer asks for. Order a PCI scan Talk to a specialist --- ## White-Label Security Scanning for MSPs | Clone Systems URL: https://www.clone-systems.com/resell-security-services HOME RESELL WHITE-LABEL SECURITY SCANNING FOR MSPS White-Label Security Scanning for Managed Service Providers Launch a branded security scanning service across your client portfolio without building certified infrastructure. Choose a multi-tenant portal, API integration, or referral model, backed by nearly two decades as a PCI SSC ASV. Become a Reseller Request reseller info PCI ASV Approved Scanning Vendor Since 2007 PCI SSC listed White-Label Portal, API, or referral No Audits We hold the certification RESELLER ENABLEMENT Everything an MSP needs to resell PCI ASV scanning. White-label portal, multi-tenant management, API integration, and dedicated reseller support, so your MSP can launch a branded PCI compliance offering without operating your own scanning platform. Fully Branded Portal Customize logo, colors, fonts, and domain so the experience feels like your own product. Clone Systems AI Assistant Upsell our in-portal AI assistant, which drafts remediation steps, exception language, and priority triage under your brand. Multi-Tenant Segmentation Each client is isolated in its own workspace, so you can safely manage many merchants at once. API Integration Embed scan creation, scheduling, and reporting into your platform through secure API endpoints. Referral Option Prefer a hands-off model? After a signed referral agreement, refer clients, earn a percentage of each sale, and let our team deliver the service. Enablement & Training Onboarding, sales materials, API documentation and 24/7 technical support. HOW THE PROGRAM WORKS A simple path to launching a branded security scanning offering. No platform to build. No audits to maintain. Onboard, brand or integrate, then start enrolling clients under your name. 01 Schedule a Demo Tell us about your business and reseller goals on a discovery call. 02 Sales Assessment A reseller representative reviews your needs and sends an intake form. 03 Technology Review We walk you through the portal, APIs, and customization options. 04 Customize & Launch Brand the portal with your logo, colors, and domain, or connect via API. Reseller portals are live within two to three business days of a signed agreement. 05 Grow Revenue Enroll clients and scale the offering while we run the scanning engine. A BRANDED MULTI-TENANT PORTAL A branded portal that feels like your MSP platform. Deliver a seamless client experience through a secure, segmented portal customized with your brand marks, typography, and domain. Each client stays isolated, so you can scale from a handful of accounts to thousands. Custom Look and Feel Upload your logo and choose colors and fonts so every page reflects your brand. Segmentation and Scalability Separate client workspaces protect privacy and let you manage large portfolios efficiently. All Channels Covered Support merchants operating online, in-store, and via mail-order or telephone-order payments. BUILT FOR MANAGED SERVICE PROVIDERS Where MSPs and their clients see immediate value. White-label PCI ASV scanning slots directly into your existing managed services portfolio, whether you serve SMB, mid-market, or enterprise accounts. SMB and Mid-Market MSPs Add PCI compliance to the services you already deliver and generate high-margin recurring revenue. Cloud & Infrastructure MSPs Bundle quarterly PCI ASV scanning with your managed hosting, backup, and infrastructure services. MSSPs & Security-Focused MSPs Complement your managed detection stack with a certified ASV offering under your own brand. vCISO & Compliance MSPs Round out your compliance advisory services with hands-on ASV scanning and Attestation of Scan Compliance delivery. CERTIFIED INFRASTRUCTURE 19 years of PCI ASV trust, so you can focus on selling. Clone Systems has been a PCI SSC listed Approved Scanning Vendor since 2007, maintaining certified scanning infrastructure with consistent reliability. Your program launches on proven technology backed by nearly two decades of PCI ASV expertise, verifiable on the PCI SSC Approved Scanning Vendor list. PCI SSC Listed ASV Verify our Approved Scanning Vendor status directly on the official PCI SSC list. 19 Years of ASV Experience Proven scanning infrastructure with consistent reliability and coverage. No Audit Overhead for You We hold the certification. You focus on your brand, pricing, and clients. RESELLER MODELS Pick the model that fits your business. Portal, API, or referral. Choose the model that best fits your customer relationships and level of involvement. White-Label Portal Give clients a self-service branded portal for scanning and reporting, with wholesale pricing; you set your own price to clients and own the relationship. API Integration Embed scan launch, scheduling, and reporting directly into your product for a native workflow. Referral Model After a signed referral agreement, refer clients to Clone Systems, earn a percentage of each sale, and let our team handle service and support. WHY RESELLERS CHOOSE CLONE SYSTEMS Why MSPs choose the Clone Systems reseller program. Grow your MSP with a high-demand compliance service, retain more customers, and expand faster, no capital outlay, backed by a vendor trusted for 19 years. New Revenue Streams Add a high-demand compliance service and expand your portfolio without building scanning infrastructure. AI Assistant Upsell Attach the Clone Systems AI Assistant as a premium add-on for remediation guidance, exception drafting, and priority triage. Enhanced Brand Control Strengthen trust and loyalty by delivering PCI ASV compliance under your own brand. Infrastructure Managed for You We operate the scanning engine, reporting workflows, and supporting systems, backed by 19 years of PCI ASV expertise. Scalable Client Management Manage many clients efficiently from one dashboard while preserving tenant isolation. Toolkit Add-Ons On Demand Extend your offering with agent-based scanning, credentialed scanning, the Clone Systems AI Assistant, and other CloneGuard modules. SCANNING TOOLKIT ADD-ONS Extend your offering with modules from the CloneGuard toolkit. Start with PCI ASV scanning, or lead with vulnerability scanning or automated penetration testing. Every module in the CloneGuard scanning toolkit, including the AI assistant, can be resold under your brand. Automated Penetration Testing 30-day snapshot pen testing that validates exploitability beyond a standard vulnerability scan. Learn more about Automated Penetration Testing Agent-Based Scanning Optional add-on module for continuous visibility into roaming and cloud workloads. Learn more about Agent-Based Scanning Authenticated Web App Scanning Authenticated scans surface deeper misconfigurations and missing patches inside client assets. Learn more about Authenticated Web App Scanning Clone Systems AI Assistant In-portal AI for remediation guidance, exception drafting, and priority triage. Learn more about the Clone Systems AI Assistant READY TO GET STARTED Launch your branded PCI ASV service, without the platform build. Choose portal, API, or referral. We run the scanning engine, PCI-certified infrastructure, and reporting so your MSP can focus on selling and supporting the offering. Direct reply from a reseller specialist PCI SSC Approved Scanning Vendor since 2007 White-label portal, API, or referral options Toolkit add-ons available whenever you want them Become a Reseller Website (leave blank) RESELLER INQUIRY Talk to our reseller team Tell us about your business and how you want to resell. We'll send program details and wholesale pricing directly to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request reseller info No spam, ever. RESELLER PROGRAM FAQ MSP reseller program questions, answered. Still have questions about the white-label PCI ASV program? Talk to us. Can MSPs fully brand the portal? Yes. Customize the portal with your MSP logo, color palette, fonts, and domain so it feels like an extension of your existing platform. How does multi-tenant management work for MSPs? Every client sits in an isolated tenant workspace. Your MSP team manages all accounts from one dashboard, while data, scans, and reports stay segmented per client. Do you offer an API instead of a portal? Yes. MSPs can embed our ASV scanning engine into their existing platform, PSA, or client portal using secure API endpoints for scan orchestration, scheduling, and reporting. What if we prefer a hands-off referral model? The referral option is designed for that. After a signed referral agreement, refer clients to Clone Systems, earn a percentage of each sale, and let our team handle delivery and support. Who owns the client relationship? In the white-label and API models, your MSP owns the pricing, contracts, and customer relationship. Clone Systems runs the underlying scanning infrastructure behind the scenes. Can we add other scanning modules for our clients? Yes. Start with white-label PCI ASV scanning and add modules from the CloneGuard scanning toolkit at any time, including agent-based scanning, credentialed scanning, and the Clone Systems AI Assistant. Do we need to maintain our own PCI-certified environment? No. Clone Systems maintains the PCI-certified infrastructure, scanning engine, reporting systems, and ongoing updates so your MSP avoids annual audit overhead. Is managed security part of this reseller program? No. This program covers scanning tools only. Reselling our managed security services is a separate program with different onboarding and enablement. What support do MSP resellers receive? Onboarding, training materials, sales enablement content, API documentation and 24/7 technical support to launch and grow the offering. --- ## White-Label Security Scanning for Payment Providers | Clone Systems URL: https://www.clone-systems.com/payment-processors-white-label-pci HOME RESELL WHITE-LABEL SECURITY SCANNING FOR PAYMENT PROVIDERS White-Label Security Scanning for Payment Providers Help your merchants complete PCI DSS 4.0.1 Requirement 11.3.2 quarterly ASV scans and SAQs under your payment brand, via a multi-tenant portal or embedded API, backed by our continuous PCI SSC ASV certification. Become a Reseller Request reseller info PCI ASV Approved Scanning Vendor Since 2007 PCI SSC listed White-Label Portal, API, or referral No Audits We hold the certification RESELLER ENABLEMENT Everything a payment provider needs to resell PCI ASV. White-label portal, embedded API, SAQ support, and 24-hour exception handling, so merchants stay compliant without leaving your ecosystem. Fully Branded Portal Customize logo, colors, fonts, and domain so the experience feels like your own product. Clone Systems AI Assistant Upsell our in-portal AI assistant, which drafts remediation steps, exception language, and priority triage under your brand. Multi-Tenant Segmentation Each client is isolated in its own workspace, so you can safely manage many merchants at once. API Integration Embed scan creation, scheduling, and reporting into your platform through secure API endpoints. Referral Option Prefer a hands-off model? After a signed referral agreement, refer clients, earn a percentage of each sale, and let our team deliver the service. Enablement & Training Onboarding, sales materials, API documentation and 24/7 technical support. HOW THE PROGRAM WORKS A simple path to launching a branded security scanning offering. No platform to build. No audits to maintain. Onboard, brand or integrate, then start enrolling clients under your name. 01 Schedule a Demo Tell us about your business and reseller goals on a discovery call. 02 Sales Assessment A reseller representative reviews your needs and sends an intake form. 03 Technology Review We walk you through the portal, APIs, and customization options. 04 Customize & Launch Brand the portal with your logo, colors, and domain, or connect via API. Reseller portals are live within two to three business days of a signed agreement. 05 Grow Revenue Enroll clients and scale the offering while we run the scanning engine. A BRANDED MULTI-TENANT PORTAL A merchant compliance portal branded as yours. Deliver ASV scanning and SAQ workflows through a secure, segmented portal styled with your brand marks, typography, and domain. Merchants experience compliance as part of your platform, not a third-party add-on. Merchant-Ready Look and Feel Upload your logo and colors so every page reflects your payment brand and merchant onboarding flow. Isolated Merchant Workspaces Each merchant is segmented from the next, protecting cardholder data boundaries and simplifying support. All Card-Acceptance Channels Support e-commerce, in-person, and mail-order or telephone-order merchant environments from one program. BUILT FOR PAYMENT PROVIDERS Where payment brands see immediate value. From acquiring banks to fintech platforms, white-label PCI ASV scanning becomes a recurring revenue line and a merchant-retention lever. Acquirers & Payment Processors Give portfolio merchants a compliant path to quarterly ASV scans and SAQ completion under your brand. Payment Facilitators & PayFacs Roll compliance into merchant onboarding so PayFac sub-merchants stay covered from day one. ISOs & Merchant Services Add a high-margin compliance service to your portfolio without building or auditing your own scanning platform. Acquiring Banks & BINs Reduce portfolio risk and non-compliance fees by making ASV scanning part of your merchant program. CERTIFIED INFRASTRUCTURE 19 years of PCI ASV trust, so you can focus on selling. Clone Systems has been a PCI SSC listed Approved Scanning Vendor since 2007, maintaining certified scanning infrastructure with consistent reliability. Your program launches on proven technology backed by nearly two decades of PCI ASV expertise, verifiable on the PCI SSC Approved Scanning Vendor list. PCI SSC Listed ASV Verify our Approved Scanning Vendor status directly on the official PCI SSC list. 19 Years of ASV Experience Proven scanning infrastructure with consistent reliability and coverage. No Audit Overhead for You We hold the certification. You focus on your brand, pricing, and clients. RESELLER MODELS Pick the model that fits your business. Portal, API, or referral. Choose the model that best fits your customer relationships and level of involvement. White-Label Portal Give clients a self-service branded portal for scanning and reporting, with wholesale pricing; you set your own price to clients and own the relationship. API Integration Embed scan launch, scheduling, and reporting directly into your product for a native workflow. Referral Model After a signed referral agreement, refer clients to Clone Systems, earn a percentage of each sale, and let our team handle service and support. WHY RESELLERS CHOOSE CLONE SYSTEMS Why payment providers choose the reseller program. Reduce non-compliance across your merchant portfolio, add a recurring revenue line, and deepen every account relationship, no certified scanning environment required. New Revenue Streams Add a high-demand compliance service and expand your portfolio without building scanning infrastructure. AI Assistant Upsell Attach the Clone Systems AI Assistant as a premium add-on for remediation guidance, exception drafting, and priority triage. Enhanced Brand Control Strengthen trust and loyalty by delivering PCI ASV compliance under your own brand. Infrastructure Managed for You We operate the scanning engine, reporting workflows, and supporting systems, backed by 19 years of PCI ASV expertise. Scalable Client Management Manage many clients efficiently from one dashboard while preserving tenant isolation. Toolkit Add-Ons On Demand Extend your offering with agent-based scanning, credentialed scanning, the Clone Systems AI Assistant, and other CloneGuard modules. SCANNING TOOLKIT ADD-ONS Extend your offering with modules from the CloneGuard toolkit. Start with PCI ASV scanning, or lead with vulnerability scanning or automated penetration testing. Every module in the CloneGuard scanning toolkit, including the AI assistant, can be resold under your brand. Automated Penetration Testing 30-day snapshot pen testing that validates exploitability beyond a standard vulnerability scan. Learn more about Automated Penetration Testing Agent-Based Scanning Optional add-on module for continuous visibility into roaming and cloud workloads. Learn more about Agent-Based Scanning Authenticated Web App Scanning Authenticated scans surface deeper misconfigurations and missing patches inside client assets. Learn more about Authenticated Web App Scanning Clone Systems AI Assistant In-portal AI for remediation guidance, exception drafting, and priority triage. Learn more about the Clone Systems AI Assistant READY TO GET STARTED Compliance built into your payment platform. Portal, API, or referral. We run the scanning engine, PCI-certified infrastructure, and reporting so your merchants get quarterly ASV scans and SAQ support under your payment brand. Direct reply from a reseller specialist PCI SSC Approved Scanning Vendor since 2007 White-label portal, API, or referral options Toolkit add-ons available whenever you want them Become a Reseller Website (leave blank) RESELLER INQUIRY Talk to our reseller team Tell us about your business and how you want to resell. We'll send program details and wholesale pricing directly to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request reseller info No spam, ever. RESELLER PROGRAM FAQ Payment provider reseller questions, answered. Still have questions about the white-label PCI ASV program? Talk to us. Can we brand the merchant portal as our own? Yes. Customize the portal with your logo, color palette, fonts, and domain so merchants experience PCI ASV scanning as part of your payment brand. Do you support SAQ workflows for merchants? Yes. A complementary SAQ module is included so merchants can complete their Self-Assessment Questionnaire alongside their quarterly ASV scan in the same portal. Can we embed ASV scanning inside our merchant onboarding? Yes. Payment providers can wire scan creation, cadence, and reporting into their merchant onboarding or portal using our secure API endpoints. How is merchant data segmented? The platform is built for multi-tenant use with secure per-merchant segmentation so each merchant workspace is isolated and cardholder-data boundaries are preserved. Do you support e-commerce, in-person, and MOTO merchants? Yes. The portal supports e-commerce, in-person, and mail-order or telephone-order transaction environments across your merchant base. Who owns the merchant relationship? In the white-label and API models, you own the pricing and merchant relationship. Clone Systems runs the underlying certified scanning infrastructure behind the scenes. Can we add other scanning modules for merchants? Yes. Start with white-label PCI ASV scanning and add modules from the CloneGuard scanning toolkit at any time, including agent-based scanning, credentialed scanning, and the Clone Systems AI Assistant. Do we need to maintain our own PCI-certified scanning environment? No. Clone Systems maintains the PCI-certified infrastructure, scanning engine, and reporting so your payment brand avoids annual audit overhead and risk. Is managed security part of this program? No. This reseller program covers PCI ASV scanning and scanning toolkit modules. Reselling managed security services is a separate program. --- ## White-Label Security Scanning for Hosting Providers | Clone Systems URL: https://www.clone-systems.com/hosting-providers-white-label-pci HOME RESELL WHITE-LABEL SECURITY SCANNING FOR HOSTING & CLOUD White-Label Security Scanning for Hosting & Cloud Providers Give hosting customers a branded PCI ASV scanning add-on for what already lives on your infrastructure. Multi-tenant portal, embedded API, or referral option, backed by our PCI SSC ASV certification since 2007. Become a Reseller Request reseller info PCI ASV Approved Scanning Vendor Since 2007 PCI SSC listed White-Label Portal, API, or referral No Audits We hold the certification RESELLER ENABLEMENT Everything a hosting provider needs to resell PCI ASV. White-label portal, multi-tenant customer management, API integration, and dedicated reseller support, so your hosting or cloud platform can bundle certified PCI scanning without operating the engine. Fully Branded Portal Customize logo, colors, fonts, and domain so the experience feels like your own product. Clone Systems AI Assistant Upsell our in-portal AI assistant, which drafts remediation steps, exception language, and priority triage under your brand. Multi-Tenant Segmentation Each client is isolated in its own workspace, so you can safely manage many merchants at once. API Integration Embed scan creation, scheduling, and reporting into your platform through secure API endpoints. Referral Option Prefer a hands-off model? After a signed referral agreement, refer clients, earn a percentage of each sale, and let our team deliver the service. Enablement & Training Onboarding, sales materials, API documentation and 24/7 technical support. HOW THE PROGRAM WORKS A simple path to launching a branded security scanning offering. No platform to build. No audits to maintain. Onboard, brand or integrate, then start enrolling clients under your name. 01 Schedule a Demo Tell us about your business and reseller goals on a discovery call. 02 Sales Assessment A reseller representative reviews your needs and sends an intake form. 03 Technology Review We walk you through the portal, APIs, and customization options. 04 Customize & Launch Brand the portal with your logo, colors, and domain, or connect via API. Reseller portals are live within two to three business days of a signed agreement. 05 Grow Revenue Enroll clients and scale the offering while we run the scanning engine. A BRANDED MULTI-TENANT PORTAL PCI ASV scanning bundled with your hosting plans. Offer scanning as a branded upsell inside your existing hosting portal. Customers see one experience, your platform, your domain, your look and feel, with certified ASV scanning powering it behind the scenes. Hosting-Native Branding Match your control panel look and feel with your brand marks, typography, and domain across the scanning experience. Isolated Customer Tenants Each hosting customer is segmented from the next, protecting data boundaries across shared, VPS, dedicated, and cloud plans. Fits Any Hosting Footprint Cover public-facing web, DNS, mail, and application infrastructure across any hosting environment. BUILT FOR HOSTING & CLOUD Where hosting brands see immediate value. White-label PCI ASV scanning becomes a bundled upsell that ties customers deeper into your platform, whether you run shared hosting, VPS, dedicated, or cloud infrastructure. Web & Dedicated Hosting Providers Add ASV scanning as a bundled or upsell tier across shared, VPS, and dedicated hosting plans. Cloud & IaaS Providers Offer certified scanning across customer workloads running in your cloud, without asking them to procure a separate ASV. Managed WordPress & E-Commerce Hosts Cover merchants running on managed WordPress, WooCommerce, Magento, and other e-commerce stacks. Data Center & Colocation Providers Extend your compliance value to customers with colocated infrastructure and hybrid deployments. CERTIFIED INFRASTRUCTURE 19 years of PCI ASV trust, so you can focus on selling. Clone Systems has been a PCI SSC listed Approved Scanning Vendor since 2007, maintaining certified scanning infrastructure with consistent reliability. Your program launches on proven technology backed by nearly two decades of PCI ASV expertise, verifiable on the PCI SSC Approved Scanning Vendor list. PCI SSC Listed ASV Verify our Approved Scanning Vendor status directly on the official PCI SSC list. 19 Years of ASV Experience Proven scanning infrastructure with consistent reliability and coverage. No Audit Overhead for You We hold the certification. You focus on your brand, pricing, and clients. RESELLER MODELS Pick the model that fits your business. Portal, API, or referral. Choose the model that best fits your customer relationships and level of involvement. White-Label Portal Give clients a self-service branded portal for scanning and reporting, with wholesale pricing; you set your own price to clients and own the relationship. API Integration Embed scan launch, scheduling, and reporting directly into your product for a native workflow. Referral Model After a signed referral agreement, refer clients to Clone Systems, earn a percentage of each sale, and let our team handle service and support. WHY RESELLERS CHOOSE CLONE SYSTEMS Why hosting providers choose the reseller program. Increase ARPU per hosting customer, reduce churn with a stickier bundled service, and grow your compliance footprint, no certified infrastructure required. New Revenue Streams Add a high-demand compliance service and expand your portfolio without building scanning infrastructure. AI Assistant Upsell Attach the Clone Systems AI Assistant as a premium add-on for remediation guidance, exception drafting, and priority triage. Enhanced Brand Control Strengthen trust and loyalty by delivering PCI ASV compliance under your own brand. Infrastructure Managed for You We operate the scanning engine, reporting workflows, and supporting systems, backed by 19 years of PCI ASV expertise. Scalable Client Management Manage many clients efficiently from one dashboard while preserving tenant isolation. Toolkit Add-Ons On Demand Extend your offering with agent-based scanning, credentialed scanning, the Clone Systems AI Assistant, and other CloneGuard modules. SCANNING TOOLKIT ADD-ONS Extend your offering with modules from the CloneGuard toolkit. Start with PCI ASV scanning, or lead with vulnerability scanning or automated penetration testing. Every module in the CloneGuard scanning toolkit, including the AI assistant, can be resold under your brand. Automated Penetration Testing 30-day snapshot pen testing that validates exploitability beyond a standard vulnerability scan. Learn more about Automated Penetration Testing Agent-Based Scanning Optional add-on module for continuous visibility into roaming and cloud workloads. Learn more about Agent-Based Scanning Authenticated Web App Scanning Authenticated scans surface deeper misconfigurations and missing patches inside client assets. Learn more about Authenticated Web App Scanning Clone Systems AI Assistant In-portal AI for remediation guidance, exception drafting, and priority triage. Learn more about the Clone Systems AI Assistant READY TO GET STARTED Bundle certified PCI scanning with your hosting or cloud plans. Portal, API, or referral. We run the scanning engine and PCI-certified infrastructure so your hosting platform can add ASV scanning as a bundled or upsell tier under your brand. Direct reply from a reseller specialist PCI SSC Approved Scanning Vendor since 2007 White-label portal, API, or referral options Toolkit add-ons available whenever you want them Become a Reseller Website (leave blank) RESELLER INQUIRY Talk to our reseller team Tell us about your business and how you want to resell. We'll send program details and wholesale pricing directly to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request reseller info No spam, ever. RESELLER PROGRAM FAQ Hosting reseller program questions, answered. Still have questions about the white-label PCI ASV program? Talk to us. Can we brand the scanning portal to match our hosting control panel? Yes. The white-label portal can be customized with your hosting brand marks, typography, and domain so the experience feels like part of your control panel. Does it work across shared, VPS, dedicated, and cloud? Yes. Any public-facing IP address or fully qualified domain name in the cardholder data environment is in scope, regardless of hosting type. Can we embed scanning into our existing hosting portal? Yes. Hosting providers can trigger scans, manage cadence, and deliver reports into their existing control panel or customer portal using secure API endpoints. How is customer data segmented across our hosting base? The platform is built for multi-tenant use with secure segmentation so each hosting customer workspace is isolated and their data remains separate. Can we bundle scanning into a hosting plan tier? Yes. You own the packaging and pricing. Bundle scanning into a premium hosting tier, sell it as a standalone add-on, or offer it à la carte. Can we add other scanning modules for customers? Yes. Start with white-label PCI ASV scanning and add modules from the CloneGuard scanning toolkit at any time, including agent-based scanning, credentialed scanning, and the Clone Systems AI Assistant. Do we need to maintain our own PCI-certified scanning environment? No. Clone Systems maintains the PCI-certified infrastructure and scanning engine so your hosting brand avoids annual ASV audit overhead. Is managed security part of this program? No. This reseller program covers PCI ASV scanning and scanning toolkit modules. Reselling managed security services is a separate program. --- ## White-Label Security Scanning for QSAs & Compliance Resellers URL: https://www.clone-systems.com/white-label-pci-for-qsas HOME RESELL WHITE-LABEL SECURITY SCANNING FOR QSAS White-Label Security Scanning for QSAs Deliver quarterly ASV scanning and evidence-ready reporting to your assessment clients under your own brand, via a multi-tenant portal or API, grounded in our long-standing PCI SSC ASV certification. Become a Reseller Request reseller info PCI ASV Approved Scanning Vendor Since 2007 PCI SSC listed White-Label Portal, API, or referral No Audits We hold the certification RESELLER ENABLEMENT Everything a QSA or consultant needs to resell PCI ASV. White-label portal, multi-tenant client management, API integration, and dedicated reseller support, so your QSA firm or compliance practice can offer certified ASV scanning without operating the platform. Fully Branded Portal Customize logo, colors, fonts, and domain so the experience feels like your own product. Clone Systems AI Assistant Upsell our in-portal AI assistant, which drafts remediation steps, exception language, and priority triage under your brand. Multi-Tenant Segmentation Each client is isolated in its own workspace, so you can safely manage many merchants at once. API Integration Embed scan creation, scheduling, and reporting into your platform through secure API endpoints. Referral Option Prefer a hands-off model? After a signed referral agreement, refer clients, earn a percentage of each sale, and let our team deliver the service. Enablement & Training Onboarding, sales materials, API documentation and 24/7 technical support. HOW THE PROGRAM WORKS A simple path to launching a branded security scanning offering. No platform to build. No audits to maintain. Onboard, brand or integrate, then start enrolling clients under your name. 01 Schedule a Demo Tell us about your business and reseller goals on a discovery call. 02 Sales Assessment A reseller representative reviews your needs and sends an intake form. 03 Technology Review We walk you through the portal, APIs, and customization options. 04 Customize & Launch Brand the portal with your logo, colors, and domain, or connect via API. Reseller portals are live within two to three business days of a signed agreement. 05 Grow Revenue Enroll clients and scale the offering while we run the scanning engine. A BRANDED MULTI-TENANT PORTAL A branded portal for your assessment clients. Give clients ASV scanning, exception handling, and Attestation of Scan Compliance delivery through a secure portal customized with your firm's brand marks, typography, and domain, in the format acquirers and QSAs expect. Assessment-Ready Reporting AoSC, Executive Summary, Vulnerability Details, and remediation reports formatted to the ASV Program Guide and ready to attach. Isolated Client Workspaces Each assessed entity sits in its own tenant so scope boundaries stay clean across engagements. Consistent Cadence Support Automate quarterly scan scheduling so clients stay aligned with PCI DSS 4.0.1 Requirement 11.3.2 between assessments. BUILT FOR QSAS & COMPLIANCE FIRMS Where compliance resellers see immediate value. White-label PCI ASV scanning becomes a natural extension of your engagement, whether you run a full QSA practice, a vCISO service, or an ISA-led compliance team. Qualified Security Assessors (QSAs) Offer in-house ASV scanning to assessment clients and reinforce your role as a trusted compliance advisor. PCI Advisory & Consulting Firms Bundle quarterly ASV scanning into your PCI DSS 4.0.1 advisory engagements under your firm's brand. vCISO & GRC Providers Round out your virtual CISO or GRC offering with a certified ASV service delivered under your name. ISA-Led Compliance Teams Give ISA-supported enterprise programs a branded ASV workflow tied to their internal compliance function. CERTIFIED INFRASTRUCTURE 19 years of PCI ASV trust, so you can focus on selling. Clone Systems has been a PCI SSC listed Approved Scanning Vendor since 2007, maintaining certified scanning infrastructure with consistent reliability. Your program launches on proven technology backed by nearly two decades of PCI ASV expertise, verifiable on the PCI SSC Approved Scanning Vendor list. PCI SSC Listed ASV Verify our Approved Scanning Vendor status directly on the official PCI SSC list. 19 Years of ASV Experience Proven scanning infrastructure with consistent reliability and coverage. No Audit Overhead for You We hold the certification. You focus on your brand, pricing, and clients. RESELLER MODELS Pick the model that fits your business. Portal, API, or referral. Choose the model that best fits your customer relationships and level of involvement. White-Label Portal Give clients a self-service branded portal for scanning and reporting, with wholesale pricing; you set your own price to clients and own the relationship. API Integration Embed scan launch, scheduling, and reporting directly into your product for a native workflow. Referral Model After a signed referral agreement, refer clients to Clone Systems, earn a percentage of each sale, and let our team handle service and support. WHY RESELLERS CHOOSE CLONE SYSTEMS Why QSAs and compliance firms choose the program. Extend your compliance offering with a recurring service, deepen client relationships between assessments, and deliver more value under your firm's brand. New Revenue Streams Add a high-demand compliance service and expand your portfolio without building scanning infrastructure. AI Assistant Upsell Attach the Clone Systems AI Assistant as a premium add-on for remediation guidance, exception drafting, and priority triage. Enhanced Brand Control Strengthen trust and loyalty by delivering PCI ASV compliance under your own brand. Infrastructure Managed for You We operate the scanning engine, reporting workflows, and supporting systems, backed by 19 years of PCI ASV expertise. Scalable Client Management Manage many clients efficiently from one dashboard while preserving tenant isolation. Toolkit Add-Ons On Demand Extend your offering with agent-based scanning, credentialed scanning, the Clone Systems AI Assistant, and other CloneGuard modules. SCANNING TOOLKIT ADD-ONS Extend your offering with modules from the CloneGuard toolkit. Start with PCI ASV scanning, or lead with vulnerability scanning or automated penetration testing. Every module in the CloneGuard scanning toolkit, including the AI assistant, can be resold under your brand. Automated Penetration Testing 30-day snapshot pen testing that validates exploitability beyond a standard vulnerability scan. Learn more about Automated Penetration Testing Agent-Based Scanning Optional add-on module for continuous visibility into roaming and cloud workloads. Learn more about Agent-Based Scanning Authenticated Web App Scanning Authenticated scans surface deeper misconfigurations and missing patches inside client assets. Learn more about Authenticated Web App Scanning Clone Systems AI Assistant In-portal AI for remediation guidance, exception drafting, and priority triage. Learn more about the Clone Systems AI Assistant READY TO GET STARTED Add ASV scanning to your compliance practice. Portal, API, or referral. We run the certified scanning engine and reporting so your QSA firm or advisory practice can extend PCI ASV scanning to every client under your brand. Direct reply from a reseller specialist PCI SSC Approved Scanning Vendor since 2007 White-label portal, API, or referral options Toolkit add-ons available whenever you want them Become a Reseller Website (leave blank) RESELLER INQUIRY Talk to our reseller team Tell us about your business and how you want to resell. We'll send program details and wholesale pricing directly to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request reseller info No spam, ever. RESELLER PROGRAM FAQ QSA & compliance reseller questions, answered. Still have questions about the white-label PCI ASV program? Talk to us. Can we brand the portal as our QSA or advisory firm? Yes. The white-label portal can be aligned to your firm's brand, typography, and domain so clients experience ASV scanning as part of your compliance service. Do reports meet the ASV Program Guide requirements? Yes. Every passing scan produces the three ASV Program Guide deliverables: the Attestation of Scan Compliance, the Executive Summary, and the Vulnerability Details report, plus a remediation report with prioritized fix guidance. How does exception handling work under the ASV Program Guide? Findings can qualify for exceptions per the ASV Program Guide. Submit the exception in-portal with evidence, get a 24-hour decision, and approved exceptions stay attached to future scans. Can we manage many client engagements from one dashboard? Yes. The platform is built for multi-tenant use so your firm can manage many assessed entities from a single console while keeping each client isolated. Do you offer an API for advisory workflows? Yes. Firms can wire scan creation, scheduling, and reporting into their existing GRC platform or client portal using secure API endpoints. Who owns the client relationship? Your firm owns the pricing and client relationship. Clone Systems runs the underlying certified scanning infrastructure and reporting in the background. Can we add other scanning modules for clients? Yes. Start with white-label PCI ASV scanning and add modules from the CloneGuard scanning toolkit at any time, including agent-based scanning, credentialed scanning, and the Clone Systems AI Assistant. Do we need to maintain our own PCI-certified scanning environment? No. Clone Systems maintains the PCI-certified infrastructure so your firm avoids the recurring cost and exposure of standing up your own ASV. Is managed security part of this program? No. This reseller program covers PCI ASV scanning and scanning toolkit modules. Reselling managed security services is a separate program. --- ## White-Label Security Scanning for Custom Industries | Clone Systems URL: https://www.clone-systems.com/white-label-pci-asv-custom-industries HOME RESELL WHITE-LABEL SECURITY SCANNING FOR CUSTOM INDUSTRIES White-Label Security Scanning for Custom Industries Retail, marketing, SaaS, healthcare, franchise, and vertical platforms. Resell white-label PCI ASV scanning tailored to your industry, with multi-tenant portal, embedded API, and toolkit add-ons on demand. Become a Reseller Request reseller info PCI ASV Approved Scanning Vendor Since 2007 PCI SSC listed White-Label Portal, API, or referral No Audits We hold the certification RESELLER ENABLEMENT Everything a vertical platform needs to resell PCI ASV. White-label portal, multi-tenant customer management, API integration, and dedicated reseller support, so your industry platform can offer certified PCI scanning without operating the engine. Fully Branded Portal Customize logo, colors, fonts, and domain so the experience feels like your own product. Clone Systems AI Assistant Upsell our in-portal AI assistant, which drafts remediation steps, exception language, and priority triage under your brand. Multi-Tenant Segmentation Each client is isolated in its own workspace, so you can safely manage many merchants at once. API Integration Embed scan creation, scheduling, and reporting into your platform through secure API endpoints. Referral Option Prefer a hands-off model? After a signed referral agreement, refer clients, earn a percentage of each sale, and let our team deliver the service. Enablement & Training Onboarding, sales materials, API documentation and 24/7 technical support. HOW THE PROGRAM WORKS A simple path to launching a branded security scanning offering. No platform to build. No audits to maintain. Onboard, brand or integrate, then start enrolling clients under your name. 01 Schedule a Demo Tell us about your business and reseller goals on a discovery call. 02 Sales Assessment A reseller representative reviews your needs and sends an intake form. 03 Technology Review We walk you through the portal, APIs, and customization options. 04 Customize & Launch Brand the portal with your logo, colors, and domain, or connect via API. Reseller portals are live within two to three business days of a signed agreement. 05 Grow Revenue Enroll clients and scale the offering while we run the scanning engine. A BRANDED MULTI-TENANT PORTAL A branded compliance experience shaped to your industry. Deliver PCI ASV scanning through a secure, segmented portal shaped to your brand, typography, and domain. Whatever your vertical, retail, marketing, SaaS, healthcare, or beyond, customers see your brand at every step. Industry-Native Branding Match your platform look and feel with your brand marks, typography, and domain across the scanning experience. Isolated Customer Tenants Each end-customer is segmented, protecting data boundaries across your portfolio of accounts. Fits Any Vertical Footprint Cover public-facing web, application, and integration infrastructure across the environments your industry uses. BUILT FOR VERTICAL PLATFORMS Verticals already reselling PCI ASV under their brand. If your customers accept card payments in any channel, they need quarterly ASV scans. Bundle it into your platform under your name. Retail & E-Commerce Platforms Add ASV scanning to POS, e-commerce, and omnichannel platforms so merchants stay compliant end to end. Marketing & Digital Agencies Offer PCI compliance scanning as a productized service alongside the websites and stores you build and manage. SaaS & Vertical Software Embed compliance into your vertical SaaS so customers never leave your product to get scanned. Healthcare, Franchise & Beyond Any industry that processes card payments benefits from a branded ASV offering wrapped into your customer experience. CERTIFIED INFRASTRUCTURE 19 years of PCI ASV trust, so you can focus on selling. Clone Systems has been a PCI SSC listed Approved Scanning Vendor since 2007, maintaining certified scanning infrastructure with consistent reliability. Your program launches on proven technology backed by nearly two decades of PCI ASV expertise, verifiable on the PCI SSC Approved Scanning Vendor list. PCI SSC Listed ASV Verify our Approved Scanning Vendor status directly on the official PCI SSC list. 19 Years of ASV Experience Proven scanning infrastructure with consistent reliability and coverage. No Audit Overhead for You We hold the certification. You focus on your brand, pricing, and clients. RESELLER MODELS Pick the model that fits your business. Portal, API, or referral. Choose the model that best fits your customer relationships and level of involvement. White-Label Portal Give clients a self-service branded portal for scanning and reporting, with wholesale pricing; you set your own price to clients and own the relationship. API Integration Embed scan launch, scheduling, and reporting directly into your product for a native workflow. Referral Model After a signed referral agreement, refer clients to Clone Systems, earn a percentage of each sale, and let our team handle service and support. WHY RESELLERS CHOOSE CLONE SYSTEMS Why vertical platforms choose the reseller program. Turn PCI compliance into a branded product line, deepen relationships with existing customers, and unlock recurring revenue without building scanning infrastructure. New Revenue Streams Add a high-demand compliance service and expand your portfolio without building scanning infrastructure. AI Assistant Upsell Attach the Clone Systems AI Assistant as a premium add-on for remediation guidance, exception drafting, and priority triage. Enhanced Brand Control Strengthen trust and loyalty by delivering PCI ASV compliance under your own brand. Infrastructure Managed for You We operate the scanning engine, reporting workflows, and supporting systems, backed by 19 years of PCI ASV expertise. Scalable Client Management Manage many clients efficiently from one dashboard while preserving tenant isolation. Toolkit Add-Ons On Demand Extend your offering with agent-based scanning, credentialed scanning, the Clone Systems AI Assistant, and other CloneGuard modules. SCANNING TOOLKIT ADD-ONS Extend your offering with modules from the CloneGuard toolkit. Start with PCI ASV scanning, or lead with vulnerability scanning or automated penetration testing. Every module in the CloneGuard scanning toolkit, including the AI assistant, can be resold under your brand. Automated Penetration Testing 30-day snapshot pen testing that validates exploitability beyond a standard vulnerability scan. Learn more about Automated Penetration Testing Agent-Based Scanning Optional add-on module for continuous visibility into roaming and cloud workloads. Learn more about Agent-Based Scanning Authenticated Web App Scanning Authenticated scans surface deeper misconfigurations and missing patches inside client assets. Learn more about Authenticated Web App Scanning Clone Systems AI Assistant In-portal AI for remediation guidance, exception drafting, and priority triage. Learn more about the Clone Systems AI Assistant READY TO GET STARTED Wrap PCI ASV scanning into your vertical platform. Portal, API, or referral. We run the certified scanning engine and reporting so your industry brand can add PCI ASV scanning as a native part of your customer experience. Direct reply from a reseller specialist PCI SSC Approved Scanning Vendor since 2007 White-label portal, API, or referral options Toolkit add-ons available whenever you want them Become a Reseller Website (leave blank) RESELLER INQUIRY Talk to our reseller team Tell us about your business and how you want to resell. We'll send program details and wholesale pricing directly to you. All fields required except phone. Full name* Job title* Business email* Company* Phone What are you interested in?* Select an option How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Request reseller info No spam, ever. RESELLER PROGRAM FAQ Custom industry reseller questions, answered. Still have questions about the white-label PCI ASV program? Talk to us. Which industries can resell PCI ASV? Any industry whose customers accept card payments. Retail, e-commerce, marketing agencies, SaaS platforms, healthcare providers, franchises, and vertical software providers all resell it under their own brand. Can we brand the portal to match our platform? Yes. The white-label portal can be tuned to your brand system, typography, and domain so the scanning experience feels native to your platform. Can we embed scanning inside our own product? Yes. Vertical platforms can wire scan creation, cadence, and reporting into their existing product using secure API endpoints, so customers never leave your UI. How is data segmented across our customer base? The platform is built for multi-tenant use with secure per-customer segmentation so each end-customer workspace is isolated and their data remains separate. How do we price it to our customers? You own the packaging and pricing. Bundle scanning into a plan tier, sell it as an add-on, or offer it as a standalone compliance product. The commercial model is yours. Can we add other scanning modules on demand? Yes. Start with white-label PCI ASV scanning and add modules from the CloneGuard scanning toolkit whenever your customers need them, including agent-based scanning, credentialed scanning, and the Clone Systems AI Assistant. Do we need to maintain our own PCI-certified environment? No. Clone Systems maintains the PCI-certified infrastructure, scanning engine, and reporting behind the scenes so your brand avoids audit overhead. Is managed security part of this program? No. This reseller program covers PCI ASV scanning and scanning toolkit modules. Reselling managed security services is a separate program. What if we're not sure our vertical fits? Talk to us. If your customers process card payments in any channel, there is almost certainly a fit, and we regularly onboard resellers from industries not on this list. --- ## About Clone Systems | Cybersecurity Since 1998, PCI ASV Since 2007 URL: https://www.clone-systems.com/about-clone-systems HOME COMPANY ABOUT CLONE SYSTEMS Securing businesses since 1998 . Clone Systems is a global Managed Security Service Provider and PCI SSC Approved Scanning Vendor. We protect more than a thousand organizations with 24/7 Security Operations Centers, SIEM, and AI-assisted operations. Schedule a demo Read our story 1998 Securing businesses since 1,000+ Organizations protected worldwide 24/7 SOC coverage across US and EU PCI ASV Approved Scanning Vendor since 2007 OUR STORY Nearly three decades of security leadership. Clone Systems was founded in Philadelphia in 1998 as a security technology company. From the beginning our mandate was simple: build technology businesses can use to defend a security posture they actually own, and stand behind it with real people and round-the-clock support. In 2001 we formalized as a niche Managed Security Service Provider, and in 2004 we activated our first 24/7 PCI-certified data center and US Security Operations Center. In 2007 the PCI Security Standards Council certified us as a global Approved Scanning Vendor, and we have been running quarterly ASV scans for merchants and service providers worldwide ever since. Today we combine that heritage with a modern platform: SIEM aligned to MITRE ATT&CK, a unified scanning portal, mobile apps, an AI assistant, and AI-powered SOAR playbooks. Same people. Same standards. Faster, sharper, always-on. Compliance you can prove Every scan, playbook, and portal is built around evidence a QSA or auditor can actually use. AI with a human in the loop Our AI assistant accelerates triage and remediation, but a senior analyst signs off on outcomes. Straight to the experts Talk to a certified engineer on the first call. No scripted qualifying rounds, no multi-year lock-in. MILESTONES A quarter century of shipping security that works. Every era below is drawn from the actual Clone Systems roadmap. Scroll through the story and each era opens as you reach it. 1998 , 2007 Founding Era Founded as a security technology company in Philadelphia, then formalized as a niche MSSP with a dedicated CISSP team, a PCI-certified data center, a 24/7 Security Operations Center in the US and EU, and became a Global PCI SSC Approved Scanning Vendor. 1998 Clone Systems, Inc. is established Building security technology businesses could use to strengthen their posture. 2001 Formal MSSP launch Managed firewall and IDS/IPS services for retailers and banks, run on our own platform. 2003 CISSP team formed A dedicated Certified Information Systems Security Professionals team with a whatever-it-takes attitude. 2004 PCI-certified data center & US SOC Self-contained infrastructure and 24/7/365 monitoring go live. 2007 Global PCI ASV certification Certified by the PCI SSC to perform vulnerability scans for merchants and service providers worldwide. 2007 Recognized IDS/IPS expertise Industry recognition for managed detection delivered on our own proprietary platform. 2008 , 2013 Scale & Global Reach Launched the CloneGuard security suite, opened offices in New York and London, and activated the European Security Operations Center. 2008 CloneGuard suite launched New wave of security products addressing fast-changing customer needs. 2009 Reseller program White-label and reseller program for VARs, QSAs, and other service providers. 2010 London office opens International expansion to serve European customers and resellers. 2012 Gartner Magic Quadrant recognition Recognized as a niche pure-play MSSP with strong customer marks for delivery. 2013 European SOC activated 24/7/365 monitoring extended across the EU with regional response coverage. 2014 , 2019 Platform Modernization Built SIEM and Log Management, consolidated all scanning services into a single portal, released mobile apps and the Incident Response Platform, and expanded white-label REST APIs. 2014 Proprietary SIEM & Log Management Purpose-built with customers for speed, search, and analyst usability. 2017 REST APIs for scanning White-label resellers can fully embed our scanning platform into their own products. 2017 NextGen SIEMv1 Cloud API integrations, two-phase alerting, and STIX/TAXII custom threat intel. 2018 Unified scanning portal PCI ASV, vulnerability management, and pentesting consolidated into one interface. 2018 Mobile scanning apps iOS and Android apps for managing scans from anywhere. 2019 Incident Response Platform Direct customer view into the SOC for real-time incident review and response. 2020 , 2022 XDR, SOAR & Cloud Integrated SOAR into the IRP, launched CloneGuard ONE for SMB XDR coverage, released the EDR agent, added automated dark web scanning, and re-engineered the scanning stack for PCI DSS 4.0. 2020 SOAR integrated into IRP Interactive customer-facing playbooks streamline SOC investigations. 2020 SIEM v2.0 released Events aligned to the MITRE ATT&CK framework and multiple compliance standards. 2020 EDR agent general availability Multi-platform endpoint threat protection integrated with our SIEM. 2021 Automated dark web scanning New add-on lets clients confirm their data is not being sold on the dark web. 2021 Multi-tenant SIEM with XDR Enterprise-grade SIEM for SMBs, aligned to the most stringent compliance frameworks. 2022 ASV 4.0 ready architecture Distributed scan workers, authenticated app checks, smarter throttling, and delta rescans. 2023 , TODAY AI-Assisted Security Stood up a dedicated AI Lab, launched AI Remediation and AI SOC Analyst, shipped AI-powered SOAR with a full audit trail, and relaunched CloneGuard with a rebuilt scanning portal and online checkout. 2023 Pentest Reporting 2.0 Findings mapped to MITRE ATT&CK and CWE, with prioritized remediation and one-click retest. 2023 AI Lab established Safe, private AI projects for log summarization, remediation plans, and analyst assistance. 2024 SAQs on PCI DSS 4.0.1 Aligned to the Council's October 2024 refresh and January 2025 SAQ A updates. 2024 Correlation packs & playbooks New detections for AD enumeration, EDR tampering, DNS zone transfers, and DB password spraying. 2024 AI Remediation & AI SOC Analyst (beta) Internal AI platform converts vulnerability data into step-by-step fix guidance. 2025 AI-powered SOAR (GA) AI runbooks enrich alerts, propose actions with evidence, and execute low-risk containment with human approval. 2025 PCI DSS 4.x future-dated controls complete Full platform support for requirements effective March 31, 2025. 2026 CloneGuard portal relaunch Rebuilt scanning portal with 4x the vulnerability detection library, authenticated web app testing, endpoint agents for remote hosts, and a privately hosted AI assistant. HOW WE PROTECT YOU Four things every Clone Systems customer gets. Written in 2006. Still true today. Modernized with AI-assisted operations, XDR coverage, and PCI DSS 4.0.1 tooling. 24/7 Managed SOC + SIEM Our United States and European Security Operations Centers identify vulnerabilities, monitor threats, and respond in real time, every hour of every day. Proprietary Technology Every platform we run is proprietary Clone Systems technology, built and maintained in-house and delivered as a fixed-cost service so there is no capital expense to your team. Certified Senior Engineers CISSP-led engineers integrate with your team, strengthen your posture, and stay accountable through every incident, exception, and audit cycle. Global Security Experience Insight gathered from securing customers across regulated industries on multiple continents shapes the guidance we bring back to every client. GLOBAL FOOTPRINT Two SOCs. One incident response platform. Clone Systems runs Security Operations Centers in the United States and the European Union, both staffed 24/7/365 by CISSP-led analysts. They share tooling, playbooks, and case history through a single incident response platform, so nothing falls between shifts or between regions. Philadelphia, USA , HQ & SOC Cyprus, EU , European SOC PCI SSC ASV since 2007 AI-powered SOAR (GA 2025) SOC 24/7/365 COVERAGE US + EU SIEM Proprietary FRAMEWORK MITRE ATT&CK STANDARDS PCI, HIPAA, SOC 2, GDPR AI Human-in-the-loop Trusted by Leading Organizations From Fortune 500 enterprises to global retailers, financial institutions, airlines, manufacturers, and healthcare organizations, organizations have trusted Clone Systems to strengthen their security posture since 1998. TALK TO CLONE SYSTEMS Have a question about our company? Tell us what you are working on. A certified engineer will get back to you with straight answers and no long-term lock-in. Website (leave blank) COMPANY INQUIRY Ask us anything Straight answers from a certified engineer. All fields required except phone. Full name* Job title* Business email* Company* Phone What is your inquiry about?* Select a topic How did you hear about us?* Select an option I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send my question No spam, ever. ABOUT CLONE SYSTEMS FAQ Common questions about the company. When was Clone Systems founded and what do you do? Clone Systems was founded in 1998 in Philadelphia as a security technology company and formalized as a Managed Security Service Provider in 2001. Today we deliver PCI ASV scanning, external vulnerability scanning, automated penetration testing, and 24/7 Managed SIEM / SOC-as-a-Service to more than 1,000 organizations worldwide, all on proprietary technology our customers use directly. Are you a PCI SSC Approved Scanning Vendor? Yes. Clone Systems has been a PCI SSC Approved Scanning Vendor since 2007 and is certified to perform PCI ASV scans for merchants and service providers globally. Where are your Security Operations Centers located? We operate 24/7/365 Security Operations Centers in the United States (activated in 2004) and the European Union (activated in 2013). Both SOCs share tooling, playbooks, and a single incident response platform. What makes Clone Systems different from a larger MSSP? We are big enough to run global SOCs and SIEM, and small enough that a certified engineer owns your account end to end. No scripted qualifying rounds, no multi-year lock-in, and no tier-one triage layer between you and the people doing the work. Do you build your own technology? Yes. All of our technology is proprietary and built in-house by Clone Systems, including our SIEM, incident response platform, scanning portal, and AI assistant, delivered as a fixed-cost service. --- ## Contact Clone Systems URL: https://www.clone-systems.com/contact HOME CONTACT Get in touch with Clone Systems . Questions, support, media, careers, or just want to say hello. Send us a message and a real person will get back to you. Send a message Website (leave blank) CONTACT US Send us a message Tell us a little about your question and how to reach you. A real person will get back to you. Fields marked * are required. Full name* Email* Company name* Job title* Phone* Topic* Select a topic How did you hear about us?* Select an option Message* I agree that Clone Systems may use the information above to contact me about my request. See our Privacy Policy.* Send message No spam, ever. OUR LOCATIONS Two offices. One team. USA CORPORATE HQ Philadelphia, PA 130 North 18th St. Suite 1800 Philadelphia, PA 19103 +1-800-414-0321 Eastern Time (UTC−05:00) EU OFFICE Larnaca, Cyprus Makariou III 22 Office 403 Larnaca 6017, Cyprus +357-24022459 Eastern European Time (UTC+02:00) FREQUENTLY ASKED Before you reach out. I'm an existing customer with an urgent issue. Call +1-800-414-0321 or sign in to the customer portal to reach our 24/7 SOC. Active customers also have direct contacts for their account engineer. How fast will I hear back? A real person on our team reviews every submission and gets back to you as soon as possible during business hours, Monday through Friday. Where are your offices? Our corporate headquarters is in Philadelphia, Pennsylvania. Our EU office is in Larnaca, Cyprus. Both are staffed by Clone Systems employees. Visits are by appointment only. I'm from the media or press. Select 'Media or press' in the topic dropdown or email info@clone-systems.com with your outlet and deadline and we'll route your request to the right contact. Do you sell or share the information I submit? No. Information submitted through this form is used only to reply to you. See our privacy policy for full details.