Authenticated Internal Vulnerability Scan
PCIComplianceHubLast updated
An internal vulnerability scan performed with credentials that let the scanner log in to each system component and inspect it from the inside, rather than probing it only across the network. Authenticated scanning finds missing patches, insecure local configurations and vulnerable packages that an unauthenticated scan cannot see. PCI DSS Requirement 11.3.1.2 requires internal scans to be authenticated, with sufficient privileges on systems that accept credentials, a documented list of systems that cannot, and scanning accounts managed under Requirement 8.2.2 where they could also be used for interactive login. This was future-dated at publication and became mandatory on 31 March 2025.
Applies to. Applies to the internal scans that 11.3.1 requires at least once every three months, with high-risk and critical vulnerabilities (as ranked under 6.3.1) resolved and rescanned, the scan tool kept up to date, and a qualified, organisationally independent tester. 11.3.1.2 sets the authentication conditions: sufficient privileges on systems that accept credentials, a documented list of systems that cannot, and management under 8.2.2 where the scanning account could also be used for interactive login. The assessor examines the scan tool configuration (11.3.1.2.a) and the scan results (11.3.1.2.b), not just a written policy.
Example. A distributor's scanner holds a service account with enough rights to read patch levels and installed packages on its payment servers and on the workstations in the order-entry office. The quarterly authenticated scan reports an unpatched library on the payment application server that the earlier network-only scan had rated clean, because the vulnerable version was only visible from inside the host. Two embedded label printers that cannot take credentials are recorded as exceptions in the scan documentation.
Limits. Authenticated scanning is a property of the internal scan, not a separate scan: it changes nothing about the quarterly cadence, the risk ranking or the rescan rule in 11.3.1. It is not required for external scans: 11.3.2 and 11.3.2.1 run from outside and are judged against the ASV Program Guide and CVSS thresholds, not against credentials. A scan is not authenticated just because the tool was given a password: 11.3.1.2 asks for sufficient privileges, so an account that cannot read patch state or configuration on the target leaves the same blind spots as no account at all. Systems that cannot accept credentials are not exempt from 11.3.1; 11.3.1.2 requires them to be documented, not dropped from the scan.
Related. Internal Vulnerability Scanning, External Vulnerability Scanning, Vulnerability Scanning, Risk Ranking, Patch, Application and System Accounts
Sources. PCI DSS v4.0.1 (June 2024)