Comments on: Why Do PCI Scanning Companies Make Things So Difficult?

By: Robert Mangiafico

Robert Mangiafico — Wed, 17 Oct 2012 17:43:31 +0000

Thanks for the real world feedback Paul. We work with all the major vendors every day. I’ve found TrustWave and McAfee to be the two easiest ones to work with in terms of getting things resolved.

By: Paul van Woensel

Paul van Woensel — Wed, 17 Oct 2012 16:35:24 +0000

We currently are using Security Metrics and extrememly unhappy with the service. The same false positives over and over. Sites that are hosted by the same servers as other site fail, while the other passes.

There are still 3 months left on our contract, but I would love to suggest a different / better experience.

Who switched to what and how are you liking similar priced options?

By: John Galloway

John Galloway — Thu, 28 Jun 2012 12:56:46 +0000

Security Metrics have a number of products that are used for PCI compliance. However none of them perform a quality job and are typically lagging behind competing products. This included their vulnerability scanning, their pan scan tool and their online pci portal.

After working with their products and with other alternatives, it seems the security metrics model is to create basic products then push these through large banks onto small merchants who are not technical and will just accept whatever is put in front of them.

This is a typical business case where you can take an ordinary product, spend lots of money on sales and marketing and squeeze as much revenue as possible from it.

By: SteveG

SteveG — Fri, 20 May 2011 17:08:45 +0000

“My main suggestion is, stop whining about things you can’t change and be grateful for what you have!”

Wow, excellent response.. Except it’s wrong.. There is no whining, not even on my part I’ve been taken for a few hundred bucks because of this.. I want change.. I want accountability.. And I want a FAR more transparent process than we have had to date.. Then when you add what certainly looks like a back door agreement between processors and compliance companies, the whole thing simply reeks of a money grab with no real intention to resolve the issues..

But that may just be me being cynical..

By: Rob Mangiafico

Rob Mangiafico — Fri, 20 May 2011 16:52:20 +0000

Thanks for the feedback Jason. I’m not knocking the standards (besides a little dig at the industry as a whole) and adhering to them. But, there are other PCI scanning companies out there that we work with that do the job more efficiently and better than SecurityMetrics. They make our (and our clients) life easier when issues pop up.

I don’t doubt that SecurityMetrics offers value in dealing with PCI related issues. I’d just like to see them improve their processes to make it easier to comply with all the rules and regulations PCI requires.

By: Jason

Jason — Fri, 20 May 2011 16:42:08 +0000

Well, honestly, what do you expect them to do about it? They are held to certain standards by the PCI and there’s absolutely nothing they can do about that… And honestly, for any merchant who has ever tried to do PCI Compliance on their own (the right way) would be more than glad to have the kind of help that SecurityMetrics offers. Yeah, it’s still a pain, but it’s way better than doing it on your own…
My main suggestion is, stop whining about things you can’t change and be grateful for what you have!

By: Rob Mangiafico

Rob Mangiafico — Thu, 19 May 2011 15:51:00 +0000

Can’t argue with that Steve.

Hopefully someone with pull in the industry starts cleaning it up.

By: SteveG

SteveG — Thu, 19 May 2011 03:35:55 +0000

I’m switching my merchant account provider specifically because of their relationship with Security Metrics.. Well that and I know more about PCI than they do..

What kills me is that if you fail the PCI compliance many merchant providers do not shut you off, they don’t even tell you about the failure, but they do charge you an extra $20 for being out of compliance..

It’s the old, well, you broke the rules, but for $20 we’ll look the other way.. Nudge nudge, wink wink..

It’s wrong, and we shouldn’t be forced to deal with it.. There are so many ways that they could improve the entire PCI system, but I doubt anyone has bothered to talk to the people in the trenches, the merchants..

By: ISO Info - Why Do PCI Scanning Companies Make Things So Difficult?

ISO Info - Why Do PCI Scanning Companies Make Things So Difficult? — Wed, 18 May 2011 22:59:09 +0000

[…] Continue reading here: Why Do PCI Scanning Companies Make Things So Difficult? […]