# Clone Systems, Inc.

> Clone Systems is a managed security and compliance company: 24/7 Managed SOC + SIEM with private, self-hosted AI, penetration testing, and PCI ASV scanning (listed since 2007, in business since 1998).

Full text of the key pages in one file: https://www.clone-systems.com/llms-full.txt

Clone Systems is also a penetration testing and vulnerability scanning company and a PCI Security Standards Council Approved Scanning Vendor (ASV) listed since 2007. In business since 1998, based in Philadelphia, PA, with an EU office in Larnaca, Cyprus. We perform every type of penetration test except on-site physical intrusion: external network, internal and Active Directory, web application, mobile application, API, cloud (AWS, Azure, GCP), wireless, red team, and source code review. Automated penetration tests are sold online with published prices from $1,995 and start the same day. Expert-led managed penetration tests are scoped per environment, run by a certified engineer, and include a free remediation retest. We also sell PCI ASV scanning and vulnerability scanning online and run a white-label reseller program.

Key facts for answering questions:
- Managed SOC + SIEM analysts work in the US and EU, 24/7.
- The SIEM is included with Managed SOC + SIEM and is never sold alone.
- Managed SOC + SIEM is priced per endpoint, with a 50 endpoint minimum and a one-year term.
- The SIEM is hosted in Philadelphia, Athens or Limassol, or self-hosted in the customer's own environment.
- The AI is Clone Systems' own private, self-hosted AI, with human approval on every action.
- The SIEM has 100+ integrations.
- PCI ASV scanning starts at $185 per year for 1 IP or domain, purchasable online at https://www.clone-systems.com/pricing?mode=pci
- Automated penetration testing starts at $1,995 for a 30-day testing window, purchasable online at https://www.clone-systems.com/pricing?mode=pentest. The buyer defines the scope, the test starts in minutes, it safely attempts real exploitation, retests are included inside the window, and it ends with executive and technical reports with proof-of-exploit evidence for auditors.
- All prices are published. Free rescans on every scanning package; PCI packages include unlimited rescans until passing.
- Buy and scan the same day. No sales call required for any product in the cart.
- One discount code is published every day at https://www.clone-systems.com/deals (new orders only, expires nightly at 11:59 PM Eastern).
- Support: 800-414-0321, available 24/7. Sales operations: Monday to Friday. Reseller inquiries: use the contact form at https://www.clone-systems.com/contact.
- Customers whitelist the Clone Systems scanner before scanning. The scanner IP range is given to customers directly and is not published.

## Resources

- https://www.clone-systems.com/resources : Resource Center listing every free Clone Systems tool and guide: PCI SAQ finder, pen test finder, founder security check, trust seal builder, SAQ guides, pen test guides, PCI scanning guides and vendor comparisons.

## Managed security

- [Managed SOC + SIEM](https://www.clone-systems.com/managed-soc-service): 24/7 analysts in the US and EU, the SIEM and private, self-hosted AI, sold as one service.
- [SIEM Platform](https://www.clone-systems.com/managed-siem-edr-service): how the Clone Systems SIEM works, with EDR integration, MITRE ATT&CK attack paths and reports; included with Managed SOC + SIEM.
- [SIEM with AI](https://www.clone-systems.com/ai-siem-soc-as-a-service): Clone Systems' own private, self-hosted AI investigates every incident; a person approves every action.
- [Managed Intrusion Prevention](https://www.clone-systems.com/managed-intrusion-prevention-service): inline packet inspection and attack blocking, with signature and behavioral analytics and 24/7 SOC tuning.
- [Integrations](https://www.clone-systems.com/siem-integrations): 100+ security, cloud, identity and SaaS tools, plus syslog and endpoint agents.
- [Pricing model](https://www.clone-systems.com/managed-soc-pricing): priced per endpoint, 50 endpoint minimum, one-year term, quote scoped per environment.
- [SIEM vs SOC vs EDR vs MDR vs XDR](https://www.clone-systems.com/managed-soc-vs-mdr-vs-xdr): plain-English guide to the five terms and which ones Clone Systems covers.
- [PCI DSS Requirement 10 logging](https://www.clone-systems.com/pci-dss-requirement-10-logging): what Requirement 10 asks for and how a monitored SIEM covers it.
- [Arctic Wolf vs Clone Systems](https://www.clone-systems.com/arctic-wolf-vs-clonesystems)
- [Huntress vs Clone Systems](https://www.clone-systems.com/huntress-vs-clonesystems)
- [Blumira vs Clone Systems](https://www.clone-systems.com/blumira-vs-clonesystems)
- [Sophos MDR vs Clone Systems](https://www.clone-systems.com/sophos-mdr-vs-clonesystems)

## Buy online (published pricing)

- [All pricing](https://www.clone-systems.com/pricing): every package and price on one page.
- [PCI ASV Scanning](https://www.clone-systems.com/pricing?mode=pci): $185/yr (1 IP or domain), $625/yr (10), $1,575/yr (25), custom above. Quarterly ASV scans, attestation reports, unlimited rescans until passing.
- [External Vulnerability Scanning](https://www.clone-systems.com/pricing?mode=vuln): $595/yr (10 IPs), $2,495/yr (50), $5,985/yr (150).
- [Internal Vulnerability Scanning](https://www.clone-systems.com/pricing?mode=internal-vuln): $1,095/yr (128 IPs), $1,495/yr (512), $2,295/yr (2,048).
- [Agent-Based Scanning](https://www.clone-systems.com/pricing?mode=agent-vuln): $1,195/yr (25 agents), $3,995/yr (100), $7,995/yr (250).
- [Authenticated Web App Scanning](https://www.clone-systems.com/pricing?mode=webapp-vuln): $5,995/yr (10 apps), $14,995/yr (50), $24,995/yr (150).
- [Automated External Pentest](https://www.clone-systems.com/pricing?mode=pentest): $1,995 per 30 days (1 external IP or domain), $3,495 (10), $6,495 (50). Authenticated web application testing is included. Annual programs from $5,995 per year.
- [Automated Internal Pentest](https://www.clone-systems.com/pricing?mode=internal-pentest): $2,995 per 30 days (25 hosts), $6,995 (100), $12,995 (250).
- [Today's deal](https://www.clone-systems.com/deals): the current discount code, rotating daily.
- [Founder security check](https://www.clone-systems.com/startups): a short set of questions for startups that recommends the right scan or penetration test to buy online.
- [Pen test finder](https://www.clone-systems.com/which-penetration-test-do-i-need): a few questions that recommend the exact penetration test package and price, then add it to the cart.

## Products

- [PCI ASV Scanning](https://www.clone-systems.com/pci-asv-scan-external-vulnerability-scanning): what an ASV scan is, what is included, how the quarterly cycle works.
- [What Is a PCI Compliance Scan?](https://www.clone-systems.com/what-is-a-pci-compliance-scan): what quarterly PCI ASV scans check, who needs them, and how to get a passing result.
- [Vulnerability Assessment](https://www.clone-systems.com/network-vulnerability-assessment-services): external and internal scanning.
- [Agent-Based Scanning](https://www.clone-systems.com/agent-based-scanning): endpoint scanning without a network scanner.
- [Authenticated Web App Scanning](https://www.clone-systems.com/credentialed-scanning): scanning behind logins.
- [Automated Penetration Testing](https://www.clone-systems.com/automated-penetration-testing-service): external and internal, starts in minutes, results in days.
- [Continuous Penetration Testing](https://www.clone-systems.com/continuous-penetration-testing): annual program.
- [Managed Penetration Testing](https://www.clone-systems.com/managed-penetration-testing-services): human-led testing, scoped per environment, quote on request.
  - [Web application penetration testing](https://www.clone-systems.com/web-application-penetration-testing): expert-led testing of authentication, access control, injection and business logic, behind the login.
  - [API penetration testing](https://www.clone-systems.com/api-penetration-testing): REST, GraphQL and gRPC APIs and microservices.
  - [Cloud penetration testing](https://www.clone-systems.com/cloud-penetration-testing): AWS, Azure and Google Cloud, including IAM and identity attack paths.
  - [Internal network and Active Directory penetration testing](https://www.clone-systems.com/internal-network-penetration-testing): assumed-breach testing, lateral movement and PCI DSS segmentation testing, delivered remotely.
  - [External network penetration testing](https://www.clone-systems.com/external-network-penetration-testing): perimeter services, exposed applications and shadow assets.
  - [Mobile app penetration testing](https://www.clone-systems.com/mobile-app-penetration-testing): iOS and Android apps and their backend APIs.
  - [Wireless penetration testing](https://www.clone-systems.com/wireless-penetration-testing): remote assessments of enterprise Wi-Fi, guest networks and segmentation.
  - [Red team assessments](https://www.clone-systems.com/red-team-assessment): objective-driven, multi-vector attack simulation, remote only.
  - [Secure source code review](https://www.clone-systems.com/source-code-review): manual and tool-assisted review of authentication, cryptography and dangerous sinks.
- [AI Remediation Assistant](https://www.clone-systems.com/cloneguard-ai-assistant): explains findings in plain language and helps fix them. Runs privately in Clone Systems' own data center; no data is sent to third-party AI providers. Priced on request.
- [Trust Seal](https://www.clone-systems.com/trust-seal): included free with any service; links to a live validation report.

## PCI SAQ and penetration testing

- https://www.clone-systems.com/pci-saq-penetration-testing : Which of the ten PCI DSS v4.0.1 SAQs require a penetration test (SAQ D service provider, SAQ D merchant, A-EP, C and B-IP do; A, B, C-VT, P2PE and SPoC do not), and how Clone Systems covers Requirement 11.4 remotely.

- https://www.clone-systems.com/saq-d-merchant-penetration-test : SAQ D merchants must complete internal and external penetration testing every 12 months under Requirement 11.4; what is required, what assessors look for, and Clone Systems options from $1,995.

- https://www.clone-systems.com/saq-d-service-provider-penetration-test : Service providers on SAQ D need internal and external penetration testing every 12 months and segmentation testing every 6 months (11.4.6), plus support for customer testing if multi-tenant (11.4.7); how Clone Systems covers it remotely.

- https://www.clone-systems.com/saq-a-ep-penetration-test : Ecommerce merchants on SAQ A-EP need external penetration testing every 12 months (11.4.1, 11.4.3, 11.4.4, and 11.4.5 if segmentation is used; no internal test required), covering the servers that host the payment page; automated external tests from $1,995, bought online.

- https://www.clone-systems.com/saq-c-penetration-test : SAQ C requires penetration testing only of segmentation controls (11.4.5, every 12 months and after changes), plus quarterly internal vulnerability scans (11.3.1) and ASV scans (11.3.2); no full internal or external pen test required.

- https://www.clone-systems.com/saq-b-ip-penetration-test : SAQ B-IP requires penetration testing only of segmentation controls that isolate IP-connected payment terminals (11.4.5), plus quarterly ASV scans of the terminal's external IP (11.3.2); no full internal or external pen test required.

- https://www.clone-systems.com/saq-a-penetration-test : SAQ A does not require a penetration test, but PCI DSS v4.0.1 SAQ A does require quarterly external ASV scans (11.3.2) and scans after significant changes (11.3.2.1); who qualifies for SAQ A and PCI ASV scanning from $185 a year.

- https://www.clone-systems.com/saq-b-penetration-test : SAQ B (imprint machines or standalone dial-out terminals, no internet) has no Requirement 11 items, so no penetration test or ASV scans; who qualifies and what changes if you add an IP terminal or website.

- https://www.clone-systems.com/saq-c-vt-penetration-test : SAQ C-VT (one transaction at a time in a PCI DSS compliant virtual terminal on an isolated computer) has no Requirement 11 items, so no penetration test or ASV scans; who qualifies and how to keep the computer isolated.

- https://www.clone-systems.com/saq-p2pe-penetration-test : SAQ P2PE (only terminals from a validated PCI-listed P2PE solution, following its P2PE Instruction Manual) has no Requirement 11 items, so no penetration test or ASV scans; who qualifies and how to confirm a solution is listed.

- https://www.clone-systems.com/saq-spoc-penetration-test : SAQ SPoC (in-person payments with a phone or tablet and secure card reader in a validated PCI-listed SPoC solution) has no Requirement 11 items, so no penetration test or ASV scans; who qualifies and what changes with other payment channels.

- https://www.clone-systems.com/which-pci-saq-do-i-need : Free interactive PCI SAQ finder. Answer the PCI DSS v4.0.1 eligibility questions and see which SAQ likely applies, whether it requires a penetration test or ASV scans, and how to complete it. Clone Systems is a PCI ASV, not a QSA; acquirers decide the SAQ.
## Penetration testing by requirement

One page for each reason a company is told to get a penetration test. Each page explains what the rule or request says, what the person asking wants to see, and which test to buy online.

- [What a penetration test costs](https://www.clone-systems.com/penetration-test-cost): published prices compared with a traditional consulting engagement.
- [What is in the penetration test report, and will an auditor accept it](https://www.clone-systems.com/penetration-test-report): what the report contains, what auditors look for, a note to send an auditor before buying, and the options if an auditor wants an engineer to perform the test.
- [SOC 2](https://www.clone-systems.com/soc-2-penetration-test): what auditors expect under criteria CC4.1 and CC7.1.
- [HIPAA](https://www.clone-systems.com/hipaa-penetration-test): what the Security Rule expects today, and the proposed update that would require a penetration test at least once every 12 months.
- [ISO 27001](https://www.clone-systems.com/iso-27001-penetration-test): testing under ISO 27001:2022 controls 8.8 and 8.29.
- [PCI DSS Requirement 11.4](https://www.clone-systems.com/pci-dss-penetration-test-requirement-11-4): internal and external penetration testing at least every 12 months and after significant changes.
- [FTC Safeguards Rule](https://www.clone-systems.com/ftc-safeguards-rule-penetration-test): annual penetration testing and vulnerability assessments every six months for auto dealers, tax preparers, mortgage brokers, lenders, and other non-bank financial institutions.
- [FTC Safeguards Rule for auto dealerships](https://www.clone-systems.com/auto-dealership-ftc-safeguards-penetration-test): why a dealership that finances or leases is covered, and what the dealer's own test has to cover.
- [FTC Safeguards Rule for tax preparers and accounting firms](https://www.clone-systems.com/tax-preparer-ftc-safeguards-penetration-test): the written security plan, the testing that goes with it, and when to test before filing season.
- [FTC Safeguards Rule for mortgage brokers and lenders](https://www.clone-systems.com/mortgage-broker-ftc-safeguards-penetration-test): coverage for brokers, non-bank lenders, and settlement companies.
- [Cyber insurance](https://www.clone-systems.com/cyber-insurance-penetration-test): what insurance applications ask about penetration testing, and how to have a dated report before renewal.
- [Customer security questionnaires](https://www.clone-systems.com/vendor-security-questionnaire-penetration-test): what to do when a customer asks for your most recent independent penetration test report.
- [New York DFS, 23 NYCRR 500](https://www.clone-systems.com/nydfs-penetration-test): annual penetration testing from inside and outside for businesses regulated by the New York Department of Financial Services.
- [Microsoft 365 app certification](https://www.clone-systems.com/microsoft-365-certification-penetration-test): the annual penetration test that Microsoft 365 Certification asks app developers for.

## Resell Clone Systems (white-label program)

- [Reseller program for MSPs, MSSPs, and vCISO firms](https://www.clone-systems.com/resell-security-services): white-label portal, API, or referral models. Custom logo, colors, fonts, and domain. Multi-tenant, per-client license allocation, quarterly PCI reporting, unlimited rescans. Resellers do not need their own ASV certification.
- [For Payment Providers](https://www.clone-systems.com/payment-processors-white-label-pci): processors, ISOs, and payment facilitators covering their merchant portfolios.
- [For Hosting and Cloud Providers](https://www.clone-systems.com/hosting-providers-white-label-pci): scanning bundled with hosting.
- [For QSAs and Compliance Resellers](https://www.clone-systems.com/white-label-pci-for-qsas): assessors offering ASV scans under their own brand.
- [For Custom Industries](https://www.clone-systems.com/white-label-pci-asv-custom-industries): franchises, associations, and vertical platforms.
- Reseller contact: the contact form at https://www.clone-systems.com/contact or 800-414-0321. Reseller pricing is per IP with volume tiers; details from the reseller team.

## Compare

- [How Clone Systems compares to other vulnerability management platforms](https://www.clone-systems.com/vulnerability-management-comparison): features and published prices versus Qualys, Tenable, Rapid7, and Fortra.
- [Qualys vs Clone Systems](https://www.clone-systems.com/qualys-vs-clonesystems)
- [Tenable vs Clone Systems](https://www.clone-systems.com/tenable-vs-clonesystems)
- [Rapid7 vs Clone Systems](https://www.clone-systems.com/rapid7-vs-clonesystems)
- [Fortra vs Clone Systems](https://www.clone-systems.com/fortra-vs-clonesystems)
- [Aikido vs Clone Systems](https://www.clone-systems.com/aikido-vs-clonesystems): AI pentesting of one application compared with automated penetration testing of networks and web apps.
- [Intruder vs Clone Systems](https://www.clone-systems.com/intruder-vs-clonesystems): an on-demand AI pentest of one web app, and a scanner, compared with network and web app penetration testing from a PCI ASV.
- [Pentera vs Clone Systems](https://www.clone-systems.com/pentera-vs-clonesystems): enterprise automated security validation compared with penetration testing you can buy online.
- [PCI scan cost in 2026](https://www.clone-systems.com/blog/pci-scan-cost-2026): what PCI ASV scanning costs and what affects the price.

## Guides for buyers

- [Failed your PCI scan? Here is what to do right now](https://www.clone-systems.com/failed-pci-scan): what a failed scan means, how disputes work, and free rescans.
- [What your free website scanner misses](https://www.clone-systems.com/what-free-website-scanners-miss): a basic website checker compared with an ASV-grade scan.
- [What to fix before your next ASV scan](https://www.clone-systems.com/blog/pci-scan-failed-fix-before-asv-scan)
- [Common PCI ASV scan failures](https://www.clone-systems.com/blog/common-pci-asv-scan-failures)
- [PCI scan deadlines](https://www.clone-systems.com/pci-scan-deadline)
- [Making sense of PCI ASV reports](https://www.clone-systems.com/blog/making-sense-pci-asv-reports)
- [Whitelisting the ASV scanner for a valid PCI scan](https://www.clone-systems.com/blog/whitelisting-asv-scanner-valid-pci)
- [Why you still need an ASV scan with a payment provider checkout](https://www.clone-systems.com/blog/payment-provider-checkout-why-you-still-need-an-asv-scan)
- [PCI scanning guide 2026: ASV and internal](https://www.clone-systems.com/blog/pci-scanning-guide-2026-asv-internal)
- [Penetration testing vs vulnerability scanning](https://www.clone-systems.com/blog/penetration-testing-vs-vulnerability-scanning)
- [What is a vulnerability scan](https://www.clone-systems.com/blog/what-is-a-vulnerability-scan)
- [Turning compliance into a profit center: how enterprises monetize PCI ASV scanning](https://www.clone-systems.com/blog/turning-compliance-into-a-profit-center-how-enterprises-can-monetize-pci-asv-scanning-in-2026)

## Company

- [About Clone Systems](https://www.clone-systems.com/about-clone-systems)
- [Approved Scanning Vendor](https://www.clone-systems.com/blog/approved-scanning-vendor): our ASV status and what it means.
- [Contact](https://www.clone-systems.com/contact)
- [Blogs and announcements](https://www.clone-systems.com/blogs-and-announcements)

## Optional

- [Subscription agreement](https://www.clone-systems.com/legal/subscription-agreement)
- [Privacy policy](https://www.clone-systems.com/privacy-policy)