PCI PTS pre and post compliance testing is offensive security testing of payment devices around formal approval, carried out by security specialists, separate from the PCI Recognized Laboratories that run the evaluation itself. Pre compliance testing hunts for weaknesses in a payment terminal before it is submitted for PTS POI evaluation, so they can be fixed first. Post compliance testing checks that the device stays resilient after approval, as firmware and hardware revisions ship.
Few firms offer this as a stated service. It needs a hardware security lab, payment-device expertise and offensive research capability, and much of that capacity sits inside the recognised labs, which are listed on our PCI PTS compliance testing page. We list one firm here, PCA Cyber Security, because it is the only one we found that publishes this service. It is also a paid partner of this directory, though its listing on this page is not a paid placement. We will add others as we find public evidence of the same work.
Related: PCI PTS compliance testing companies · Automotive pen testing companies · PCI DSS pen testing
PCI PTS (PIN Transaction Security) approval is granted after a formal evaluation carried out by a PCI Recognized Laboratory against the PTS POI security requirements. That lab evaluation is a structured, standards-driven assessment. It is not the same thing as adversarial, offensive security testing that tries to break the device the way a real attacker would.
Pre and post compliance testing is that adversarial layer. Before a device is submitted, a pre compliance engagement puts the terminal through physical and tamper attacks, side-channel analysis, fault injection, firmware extraction and review, and cryptographic implementation analysis, so the manufacturer finds and fixes weaknesses before a lab, or an attacker, does. After approval, post compliance testing re-tests the device as firmware updates and hardware revisions ship, because approval is a point-in-time status and real devices keep changing.
The firms able to do this are offensive security specialists with a hardware lab and embedded and payment-device experience. Some recognised labs also offer certification preparation and payment security consulting alongside formal evaluation, so if a lab is already evaluating your device, ask what it offers before and after approval.
Munich- and Budapest-based embedded cybersecurity experts focused on financial services, automotive and mobility, manufacturing and industrial automation, energy and more. The services and platform go beyond compliance, supporting the requirements of the Cyber Resilience Act, PCI PTS, UN R155, ISO/SAE 21434 and other standards and regulations.
It is offensive security testing of payment devices around the PCI PTS approval process. Pre compliance testing finds and helps fix vulnerabilities in a terminal before it is submitted for formal PTS POI evaluation. Post compliance testing re-validates the device after approval as firmware and hardware change. It is adversarial testing by security specialists, not the formal lab evaluation itself.
A PCI Recognized Laboratory performs the formal, standards-driven PTS POI evaluation that leads to approval. Pre and post compliance testing is separate: offensive, adversarial security testing that tries to break the device the way a real attacker would, to find weaknesses before or after the formal evaluation. The two are complementary but distinct disciplines.
Formal evaluations are expensive and slow, and a device that fails on a fundamental weakness wastes that time and cost. A pre compliance offensive test surfaces tamper, side-channel, fault-injection, firmware, and cryptographic weaknesses early, so they can be remediated before submission, improving the odds of a clean approval.
Few firms state it as a service. It needs a hardware security lab, embedded and payment-device expertise and offensive research capability. PCA Cyber Security, a paid partner of this directory, offers it. Some recognised labs offer certification preparation and payment security consulting alongside formal evaluation; they are listed on our PCI PTS compliance testing page. We add firms here as we find public evidence of the service.