Clone Systems Expands Penetration Testing With Same-Day Automated Testing and Managed PCI Pen Tests

Automated penetration tests start at $1,995, while engineer-led testing supports PCI DSS 4.0.1 requirements across SAQ A-EP and SAQ D environments.

PHILADELPHIA, Oct. 13, 2026 /PRNewswire/ -- Clone Systems, Inc., a PCI SSC Approved Scanning Vendor since 2007, today announced an expanded penetration testing offering designed to make testing easier to start, manage and retest.

Organizations can now purchase automated penetration testing online and launch testing the same day, or work directly with a certified engineer for a fully managed engagement from scoping through remediation retesting.

The expanded services support PCI DSS 4.0.1 Requirement 11.4, HIPAA, SOC 2, ISO 27001 and cyber insurance requirements, with testing available across networks, applications, APIs, cloud environments and other critical infrastructure.

A scan is not a pen test

Quarterly ASV scanning and penetration testing serve different purposes under PCI DSS.

While an ASV scan identifies vulnerabilities exposed within the cardholder data environment, penetration testing evaluates whether weaknesses can actually be exploited and used to gain access or move deeper into an environment.

For organizations validating under PCI DSS, SAQ A-EP includes an external penetration testing requirement, while SAQ D merchants and service providers may require internal and external penetration testing as well as testing of segmentation controls used to reduce PCI scope.

Clone Systems now provides managed penetration testing for PCI environments requiring these assessments, allowing organizations to use the same security provider for both ASV scanning and penetration testing.

Automated testing that proves exploitability

Clone Systems' automated penetration testing is designed to go beyond vulnerability discovery by safely attempting to validate whether identified weaknesses can actually be exploited.

Customers define their targets through the Clone Systems portal and can launch testing within minutes, without waiting for an engineer or installing additional software.

Production-safe testing mapped to MITRE ATT&CK can evaluate external infrastructure, internal networks and Active Directory, cloud environments and web applications. Authenticated web application testing can also test behind the login to reach APIs, application functionality and workflows available only to authenticated users.

Findings are prioritized based on exploitability and potential impact rather than vulnerability severity alone.

After remediation, customers can rerun testing within the same 30-day window to verify that the vulnerability can no longer be exploited.

Reports include an executive summary, technical findings, proof-of-exploit evidence, remediation guidance and retest confirmation.

Engineer-led testing for more complex environments

Organizations with larger or more complex environments can choose fully managed penetration testing led by a Clone Systems security engineer.

Testing is available for external and internal networks, web and mobile applications, APIs, cloud infrastructure, wireless environments, red team exercises and source code review.

Each engagement begins with a scoping call and fixed statement of work. Customers then work directly with the engineer performing the assessment through testing, reporting and remediation.

A remediation retest is included with every managed engagement.

Clone Systems' testing team holds credentials including CISSP and Certified CMMC Professional (CCP), along with specialized training in API penetration testing, malware analysis and DevOps security.

One platform for automated and managed testing

The upgraded platform combines Clone Systems' proprietary testing orchestration, safety controls and reporting with established open source security tools.

This approach allows customers to use multiple testing techniques through a single platform while maintaining centralized findings, remediation guidance and reporting.

"Most merchants find out about the pen test requirement when the SAQ is due, and then hear it will take weeks just to get started," said Elyse Hamilton, Vice President of Business Development at Clone Systems. "We wanted to remove that bottleneck. Straightforward environments can start automated testing immediately, while more complex environments can be scoped and tested directly by an engineer."

Availability and pricing

Clone Systems automated penetration testing is available today with published pricing and online checkout, starting at $1,995 for a 30-day testing window.

Annual automated penetration testing programs start at $5,995 per year, and authenticated web application testing starts at $5,995 for 10 applications.

Managed penetration testing is priced through a fixed statement of work based on scope. Every engagement includes access to Clone Systems' 24/7 security operations center.

Organizations ready to begin testing can view penetration testing pricing and purchase online. Organizations with more complex PCI, application, API, cloud or internal testing requirements can request a scoped penetration test with the Clone Systems team.

About Clone Systems, Inc.

Clone Systems, Inc. has provided managed security and compliance services since 1998, including 24/7 security operations center (SOC) services, security information and event management (SIEM) with endpoint detection and response, managed intrusion prevention, penetration testing and PCI compliance scanning.

Headquartered in Philadelphia with operations in Larnaca, Cyprus, Clone Systems serves customers in finance, retail, healthcare, hospitality and technology worldwide.

Media Contact

Jorja Mandy
Director, Strategic Development
Clone Systems, Inc.
[email protected]

SOURCE Clone Systems Inc.