{“lastseen”:”2025-12-19T22:05:10″,”description”:”## **Executive Summary**\\n\\n**PCI DSS 4.0.1 compliance** mandates stricter security controls for web applications and APIs. Key updates include maintaining an inventory of custom software (PCI 6.3.2) and managing payment page scripts to prevent skimming attacks (PCI 6.4.3). Organizations must also adopt risk-based vulnerability prioritization (PCI 11.3.1.1), perform authenticated internal vulnerability scans (PCI 11.3.1.2), implement mechanisms to detect payment page tampering (PCI 11.6.1), and support continuous compliance to meet these requirements.\\n\\nThis blog explains what those expanded requirements mean in practice and how organizations can operationalize them using a unified application security approach with Qualys TotalAppSec.\\n\\n## Introduction\\n\\n2025 has been a milestone year for organizations operating in the payment ecosystem. As of April 1, all merchants and third-party payment service providers are now required to comply with the expanded set of PCI DSS 4.0 controls\u201451 new requirements in total. These changes introduced stronger protections around authentication, encryption, logging, and continuous security monitoring, prompting many organizations to reassess and modernize their security programs, processes, and tooling.\\n\\nDuring this peak holiday shopping season, organizations involved in online payment processing must be more vigilant than ever. Attackers increasingly target web applications, APIs, and client-side scripts to launch skimming, fraud, malware injection, and account takeover attacks, often when transaction volumes and business impact are at their highest.\\n\\nThis blog is designed for security leaders, AppSec teams, compliance managers, developers, and anyone responsible for securing digital payment experiences under PCI DSS 4.0.1. It breaks down the updated requirements related to web applications and APIs, explains how these changes affect day-to-day operations, and outlines how organizations can modernize their application security practices to reduce risk, strengthen payment integrity, and prepare confidently for QSA assessments.\\n\\n## Key Web Application and API Security Changes in PCI DSS 4.0.1\\n\\nPCI DSS 4.0.1 introduced several new or strengthened requirements explicitly focused on **PCI DSS web application requirements** and **PCI DSS API security**. These updates reflect a broader shift where attackers are increasingly targeting application-layer weaknesses, rather than relying solely on infrastructure. Below are the most relevant changes for AppSec teams.\\n\\n### Inventory of Bespoke\/Custom Software (PCI 6.3.2)\\n\\nOrganizations must maintain a complete and up-to-date inventory of all custom software, including custom web applications, APIs, and third-party components embedded within them. This is foundational for vulnerability management, risk assessment, and patch planning.\\n\\n### **Payment Page Script Management (PCI 6.4.3)**\\n\\nAny script loaded or executed in the consumer\u2019s browser on a payment page must be inventoried, authorized, and validated for integrity. This requirement directly targets the rise of Magecart-style skimming attacks and malicious JavaScript injection.\\n\\n### **Risk-Based Treatment of Non-Critical Vulnerabilities (PCI 11.3.1.1)**\\n\\nAccording to PCI DSS 4.0.1, even vulnerabilities with a severity level below high or critical must be addressed, depending on the context and risk. Organizations must show evidence of risk-based prioritization, not just CVSS scores.\\n\\n### **Mandatory Authenticated Internal Vulnerability Scans (PCI 11.3.1.2)**\\n\\nInternal scanners must authenticate to applications and systems. This change ensures more comprehensive coverage, including logic flaws, protections, and application paths that are not publicly visible.\\n\\n### **Tamper-Detection for Payment Pages (PCI 11.6.1)**\\n\\nOrganizations must implement controls to detect unauthorized changes to payment pages, including injected or altered scripts, modified HTTP headers, and content modifications that may compromise security controls. The objective is to detect and stop web skimming attacks early.\\n\\n## From PCI DSS 4.0.1 Requirements to Operational Application Security\\n\\nTo effectively meet these expanded requirements, organizations must implement a robust application security platform that delivers continuous visibility, rigorous testing, and prioritized risk management across both web applications and APIs. Qualys TotalAppSec is explicitly designed for this purpose, integrating API and web application testing, web malware detection, and comprehensive application risk management into a single, powerful solution. It proactively discovers web applications and APIs, even those that are currently unknown or unmanaged, identifies vulnerabilities, assesses contextual risks, and provides clear, actionable insights.\\n\\nWith capabilities such as deep crawling, authenticated scanning, and continuous monitoring, TotalAppSec empowers organizations to operationalize the heightened application security requirements of PCI DSS 4.0.1 and maintain a strong, defensible application security posture over time.\\n\\n## How TotalAppSec supports PCI DSS 4.0.1 Requirements\\n\\nBelow is a streamlined summary of how TotalAppSec maps to key PCI DSS 4.0.1 controls. \\n\\n### **Section 6: Develop and maintain secure systems and software**\\n\\n**PCI Section**| **PCI Requirements**| **Applicable to TotalAppSec?**| **TotalAppSec Capabilities** \\n—|—|—|— \\n6.3.1| **I** dentifying and Managing Vulnerabilities | Yes| TotalAppSec supports this requirement by: \\n \\n- tracking 100+ security bulletins to add new signatures \\n \\n- assigning contextual risk ratings (critical\/high\/medium\/low) \\n \\n- helping teams assess impact beyond severity alone \\n \\n- scanning all web applications and APIs for both known and emerging vulnerabilities \\n \\nTogether, these capabilities help organizations continuously identify, prioritize, and remediate vulnerabilities in alignment with PCI\u2019s risk-ranking standards. \\n6.3.2| **I** nventory of bespoke and custom software| Yes| TotalAppSec automatically discovers known and unknown web applications and APIs through: \\n \\n- Web application crawling \\n \\n- API gateway integrations \\n \\n- TotalCloud connectors \\n \\n- Analysis of internal and external hosts \\n \\nThis creates and maintains the complete application inventory required by PCI DSS 6.3.2. \\n6.4.1| Protect public-facing web applications | Yes| TotalAppSec scans public-facing web applications and APIs for vulnerabilities using automated, intelligent application security testing. It helps organizations identify new threats and maintain continuous testing for vulnerabilities. \\n6.4.3| Manage payment page scripts | Yes| TotalAppSec includes specialized detections (QIDs) for payment page security, including: \\n \\n- QID 153008: identification of payment pages \\n \\n- QID 153009: detection of JavaScript on payment pages \\n \\n- QID 150545: detection of JavaScript loaded from external servers \\n \\n- QID 150621: inventory of all JavaScript assets \\n \\n- QID 150288: Incorrect Sub Resource Integrity (SRI) cryptographic hash \\n \\n- QID 150206: Content-Security-Policy Not Implemented \\n \\n- QID 150226: detection of pages collecting sensitive information without authentication \\n \\nThese controls directly support script inventory, authorization, and integrity validation. \\n \\n### **Section 11: Test Security of Systems and Networks Regularly**\\n\\n**PCI Section**| **PCI requirements**| **Applicable to TotalAppSec?**| **TotalAppSec Capabilities** \\n—|—|—|— \\n11.3.1| Internal vulnerability scans | Yes| TotalAppSec helps organizations to meet these requirements by: \\n \\n- scanning internal web applications and APIs \\n \\n- ranking vulnerabilities using contextual risk \\n \\n- supporting both scheduled and on-demand rescans \\n \\n- offering authenticated scanning \\n \\n- maintaining role-based access control \\n \\n- continuously updating tests via Qualys Threat Research \\n \\nThis ensures consistent compliance with PCI 11.3.1 and 11.3.1.2. \\n11.3.2| External vulnerability scans | Yes| TotalAppSec supports external scanning of web applications and APIs and allows organizations to: \\n \\n- rescan as needed \\n \\n- submit TotalAppSec scan results to the Qualys PCI ASV platform for attestation \\n \\n- include web application and API results in attestation reports \\n11.6| Tamper detection for payment pages | Yes| TotalAppSec implements specific QIDs to detect unauthorized changes that could indicate a skimming attack: \\n \\n- QID 150206: missing or incorrect Content-Security-Policy (CSP) headers \\n \\n- QID 150288: incorrect Subresource Integrity (SRI) hashes \\n \\nThese detections help identify script manipulation and content tampering that violate PCI 11.6.1. \\n \\n## How TotalAppSec Helps Organizations Achieve PCI DSS 4.0.1 Compliance\\n\\n### Web application and API Discovery and Inventory\\n\\nTotalAppSec delivers automated, continuous discovery of web applications and APIs by mapping your entire attack surface \u2014 including shadow apps, forgotten subdomains, and undocumented endpoints. It identifies both openly exposed and hidden assets using active crawling, API schema analysis, and connecting to API gateways or cloud environments. This provides security teams with an up-to-date, authoritative inventory of all applications and APIs, including their security testing status, ensuring that nothing critical is missed and every asset is ready for risk assessment and scanning. This comprehensive discovery and inventory capability helps with compliance with PCI section 6.3.2. \\n\\n\\n\\n### Web Application and API Risk Assessment\\n\\nTotalAppSec delivers comprehensive application and API security testing capabilities designed to protect both internet-facing and internal web applications and APIs. It supports authenticated scanning, enabling thorough assessment of application and API security. The platform can identify and test for both known and emerging vulnerabilities, helping organizations stay ahead of evolving threats. \\n\\nTotalAppSec assigns risk ratings that consider threat context, vulnerability severity, and the criticality of affected assets, providing actionable insights for prioritization. It also maintains a centralized inventory of scripts and actively monitors payment pages and other sensitive areas to detect unauthorized changes, helping prevent potential attacks. \\n\\nBy combining deep vulnerability detection with contextual risk analysis and continuous monitoring, TotalAppSec empowers organizations to strengthen their application security posture, reduce exposure to cyber threats, ensure the integrity of critical digital assets, and achieve compliance with PCI sections 6.3.1, 6.3.2, 6.4.1, 6.4.3, 11.3.1, 11.3.2, and 11.6.\\n\\n### Submit Full Scan Results for PCI Attestation\\n\\nWith TotalAppSec, organizations can perform comprehensive scans of their web applications and APIs, leveraging advanced capabilities such as deep crawling, progressive scanning, authenticated testing, and granular scanning controls. These features ensure high-quality, high-coverage assessments that uncover vulnerabilities across both known and previously unseen assets. Once scans are completed, customers can seamlessly submit the results for PCI attestation, ensuring they meet the documentation and rigor required for PCI DSS compliance. This unified workflow streamlines compliance efforts by combining robust scanning technology with the ability to produce attestation-ready reports, reducing manual effort and improving overall security assurance.\\n\\nScreenshot\\n\\n## Why TotalAppSec is Essential for PCI DSS 4.0.1 Compliance\\n\\nWhile many organizations previously relied on the Qualys PCI Compliance solution, PCI DSS 4.0.1 introduces new expectations that place greater emphasis on application-layer security. These requirements include deeper application-level testing, broader coverage of the attack surface, and script integrity monitoring.\\n\\nAddressing these areas requires application security capabilities that extend beyond traditional compliance-focused scanning. Qualys TotalAppSec helps organizations do this by:\\n\\n * performing advanced crawling and high coverage scanning for both internal and external apps,\\n * discovering and inventorying web applications and APIs automatically,\\n * detecting malware and script tampering,\\n * supporting authenticated scanning and risk-based prioritization,\\n * allowing submission of results for PCI attestation.\\n\\n\\n\\n## Conclusion\\n\\nPCI DSS 4.0.1 shifts payment security toward continuous compliance and stronger application-layer protection. As attackers increasingly target web applications and APIs, organizations must maintain ongoing visibility, testing, and risk-based decision-making across their application environments. Aligning application security practices with PCI DSS 4.0.1 helps reduce exposure, strengthen payment integrity, and approach QSA assessments with confidence. Qualys TotalAppSec supports this approach by unifying application discovery, testing, monitoring, and contextual risk insight in a single platform.\\n\\n* * *\\n\\n**Ready to see it in action**? Start a trial. Existing customers can contact their Technical Account Manager to upgrade from WAS.\\n\\nTry Qualys TotalAppSec Today \\n\\n* * *\\n\\n## Frequently Asked Questions (FAQs)\\n\\n**What Are the New Application Security Requirements in PCI DSS 4.0?**\\n\\nPCI DSS 4.0 introduces enhanced application security requirements, including maintaining an inventory of bespoke software (6.3.2), managing payment page scripts to address e-commerce skimming (6.4.3), ensuring all vulnerabilities\u2014not just critical or high-risk ones\u2014are managed (11.3.1.1), performing authenticated internal vulnerability scans (11.3.1.2), and implementing mechanisms to detect tampering of payment pages (11.6.1). These requirements became mandatory on March 31, 2025.\\n\\n**Why does PCI DSS Place Increased Focus on Web Applications and APIs?**\\n\\nModern payment environments rely heavily on web applications, APIs, and client-side scripts. Attackers increasingly target these application-layer components through techniques such as web skimming, API abuse, and malicious script injection. PCI DSS 4.0.1 reflects this shift by strengthening the expectations for application security.\\n\\n**What Does \u201cRisk-Based Vulnerability Management\u201d Mean in PCI DSS 4.0.1?**\\n\\nPCI DSS 4.0.1 requires organizations to prioritize vulnerabilities based on **contextual risk** , rather than solely on CVSS severity. \\n\\n**Does PCI DSS Require Fixing all Vulnerabilities, Regardless of Severity?**\\n\\nNo. PCI DSS does not mandate the immediate remediation of every vulnerability. It requires organizations to assess vulnerabilities in context, prioritize based on risk, and provide evidence of a defensible, risk-based remediation approach.\\n\\n**Why is Monitoring Payment Pages and Client-Side Scripts Important?**\\n\\nPCI DSS 4.0.1 includes requirements to detect unauthorized changes to payment pages, including injected or modified scripts. These controls are designed to detect web-skimming attacks early, before cardholder data is compromised.\\n\\n**How does Qualys TotalAppSec Support PCI DSS 4.0.1 Application Security Requirements?**\\n\\nQualys TotalAppSec helps organizations support PCI DSS 4.0.1 by providing unified visibility across web applications and APIs, continuous application testing, authenticated scanning, contextual risk insights, and monitoring capabilities. These capabilities help teams operationalize application security requirements and maintain evidence of ongoing application security practices.\\n\\n**Does Qualys TotalAppSec Guarantee PCI DSS Compliance?**\\n\\nNo. Qualys TotalAppSec does not guarantee compliance. PCI DSS compliance is determined through a combination of people, processes, and controls, and validated by a Qualified Security Assessor (QSA). TotalAppSec helps organizations support and demonstrate application security practices aligned with PCI DSS requirements.\\n\\n**How does TotalAppSec Complement Existing PCI Compliance Tools?**\\n\\nTraditional PCI compliance tools focus on infrastructure and control validation. TotalAppSec complements these tools by addressing the expanded application-layer scope in PCI DSS 4.0.1, including web applications, APIs, and client-side risks.\\n\\n## Contributors\\n\\n * Shailesh Soni, Director, Product Management, Cloud Agent Platform\\n * Sheela Serva, Director, Threat Research and Engineering, Web Application Security\\n * Manoj Jaisinghani, Lead Software Engineer, Threat Research and Engineering, Web Application Security\\n * JC Newton, Senior Technical Support Engineer”,”published”:”2025-12-19T21:01:30″,”modified”:”2025-12-19T21:01:30″,”type”:”qualysblog”,”title”:”Your Guide to PCI DSS 4.0.1 Web Application \\u0026 API Controls\u2014and a Simplified Path to Compliance”,”source”:””,”references”:””,”id”:”QUALYSBLOG:E5911A657F4DA6D267E4643F26D18F52″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/blog.qualys.com\/category\/product-tech”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-19T22:05:10″,”description”:”## **Executive Summary**\\n\\n**PCI DSS 4.0.1 compliance** mandates stricter security controls for web applications and APIs. Key updates include maintaining an inventory of custom software (PCI…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,120,7,11,5],"class_list":["post-32331","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-qualysblog","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n