An Approved Scanning Vendor (ASV) is a provider authorized by the PCI Security Standards Council to conduct external vulnerability scans for organizations subject to PCI DSS. These scans check internet-facing systems for vulnerabilities and other issues that could expose the cardholder data environment.
ASV scanning is a technical validation activity, not a substitute for security controls, evidence collection, or a Qualified Security Assessor’s review. Organizations use scan results to identify and remediate weaknesses, then obtain passing results as required for PCI compliance. A passing scan supports compliance evidence, but does not prove that every system or security control is safe.