SecurityMetrics vs Clone Systems
PCI ASV coverage, buying direct, support and published pricing compared.
SecurityMetrics is one of the largest PCI compliance vendors in the US and most merchants meet it through their payment processor. This page compares its PCI scanning program with Clone Systems for a merchant deciding where to run quarterly ASV scans.
Where SecurityMetrics is strong
- A listed ASV: SecurityMetrics, Inc., with two scan products on the PCI SSC list.
- A full compliance firm offering QSA audits, HIPAA programs, forensics and penetration testing.
- A small-business PCI bundle with SAQ, portal, one external IP scan and a breach warranty up to $100,000, sold largely through acquiring banks. Many processors have standardised on it.
- 24/7 help desk and unlimited rescans during the contract.
- Standalone ASV scanning is also sold online for new targets, separately from the small-business bundle.
Where Clone Systems is different
- A listed PCI ASV since 2007 under its own certificate. See the PCI SSC list.
- Published prices with online checkout and same-day scanning, no sales call.
- Unlimited rescans until you pass.
- Exceptions and false positives reviewed within 24 hours.
- 24/7 support by email and phone.
- No processor in the middle: you buy from the ASV and the attestation is yours to give any bank.
- Penetration testing sold online at a published price with same-day start.
Feature comparison
| Capability | Clone Systems | SecurityMetrics |
|---|---|---|
| Listed PCI ASV under its own certificate | Yes (certificate 4262-01) | Yes (SecurityMetrics, Inc.; two scan products) |
| Buy a scan online in minutes | Yes, same-day scanning | Yes; standalone new-target scans and PCI bundle online; existing-scan renewals by phone |
| Published per-IP scan price | Yes | $150/yr per target standalone; separate bundle from $399/yr |
| Unlimited rescans | Unlimited until you pass | Unlimited during contract |
| Exception review time | Within 24 hours | Help within 48 hours |
| Support hours and channels | 24/7 email and phone | 24/7 help desk: phone, chat, ticket |
| Sold direct to merchants vs through processors | Direct to merchants | Mainly processors and ISOs; direct enrollment available |
| SAQ tool | Yes, included | Yes |
| Attestation of Scan Compliance | Yes, after passing | Yes |
| Trust seal | Yes, free with scanning | Not in the published bundle |
| Penetration testing with a published price | Yes, automated and managed testing | Yes, quoted |
| Breach warranty | No | Up to $100,000 in the bundle |
| QSA audits | No; works alongside your QSA | Yes |
Published pricing, side by side
| Module | Clone Systems | SecurityMetrics |
|---|---|---|
| PCI ASV scan, 1 IP | $185/yr | $150/yr standalone per target; PCI bundle from $399/yr (one IP) |
| PCI ASV scan, 10 IPs | $625/yr | Not published |
| PCI ASV scan, 25 IPs | $1,575/yr | Not published |
| Automated external penetration test | From $1,995 | Quoted |
| Support | Included 24/7 | Included |
Checked on Nov 4 2026 against each vendor's public pages and the PCI SSC list. Tell us if something has changed.
The official store lists a $150 annual standalone scan for one IP or web domain, separately from the $399 small-business bundle. Existing-scan renewals require contacting support; standalone scanning does not establish inclusion of the bundle’s SAQ or warranty.
Who should choose which
Choose SecurityMetrics if your processor's program is bundled into your merchant account and you want the SAQ, scan and reporting handled inside that program, or you need a QSA audit from the same firm.
Choose Clone Systems if you want to buy the scan directly at a published price, scan today, keep rescans unlimited, get exceptions answered in 24 hours, and hold an attestation you can hand to any bank.
PCI ASV scanning: how the process compares
- Buying. SecurityMetrics: Yes; standalone new-target scans and PCI bundle online; existing-scan renewals by phone. Clone Systems sells PCI ASV scanning online with same-day portal access and scanning.
- Attestation turnaround. Both listed ASVs provide an Attestation of Scan Compliance after passing. Clone Systems issues it automatically after each passing scan; no separate SecurityMetrics attestation turnaround is published in the sources linked here.
- Reviews and exceptions. SecurityMetrics: Help within 48 hours. Clone Systems reviews exceptions and false positives within 24 hours, with decisions attached to future scans.
- Rescans. SecurityMetrics: Unlimited during contract. Clone Systems includes unlimited rescans until you pass on every plan.
Switching from SecurityMetrics to Clone Systems
Your attestation is portable; if you were enrolled through a processor, check whether the processor waives its program fee with an outside attestation (some document an opt-out, some do not); keep the SecurityMetrics program running until your first Clone Systems attestation is in hand; SAQ answers transfer by hand (Clone's SAQ module is included).
PCI DSS requires a passing external scan from a listed ASV every 90 days; it does not require any particular vendor, and the Council's own ASV guide tells merchants to compare several. Whether your processor waives its PCI program fee when you bring your own attestation is processor-specific: some document an opt-out, some do not. Ask your processor in writing, then run both for one quarter if you want the overlap. Read the Council's ASV guide.
Use code SWITCH20 for 20% off your first Clone Systems scanning order
SecurityMetrics and any product names are trademarks of their owners. Clone Systems is not affiliated with SecurityMetrics. Details were checked against public documentation and the PCI SSC list on Nov 4 2026. Tell us if something has changed.