Find every card number before your assessor does. Then fix it.
The agent finds card data where it shouldn’t be, writes the fixes, asks the owner before it deletes anything, proves the result with a rescan and fills in the assessment paperwork. People approve and sign.
Watch it work
Northwind Outfitters
A fictional online store: checkout service, production logs, support and analytics exports, shipping manifests and a point-of-sale backup.
Demonstration. This shows how the PCI Scope Agent works in your environment, run on a fictional company’s code, logs and exports. Card numbers in the sample are synthetic and are masked the moment they are found. The fixes, backups and rescan really run, on a copy of the sample; the owners and their replies are fictional.
What it’s worth
Card data found by an assessor is a finding, a remediation project and often a monthly penalty from your acquirer. Found first, most of it can simply be deleted, and every system it leaves is one less to secure and test. On the fictional retailer above: $864K of revenue at risk until it is removed, and about $197K saved and avoided.
- $864K
- Revenue at risk now: card data in checkout logs and in-store terminal backups, if either had to go offline 12 hours to contain a leak
- $150K
- Penalties avoided: stored card data found six months before the assessment, at an assumed $25K a month
- $36K
- Assessment cost avoided each year: four systems removed from scope instead of secured and tested
- $11K
- Engineer hours saved: 73.5 hours of searching seven systems by hand, replaced by checking the agent’s verdicts
Compared
Card-data scanners have existed for years, and compliance platforms already collect evidence. Here is what each approach does, honestly, and where an agent adds something new. In every column, a person signs the assessment.
| What it does | By hand | Card-data scanners | Compliance platforms | PCI Scope Agent |
|---|---|---|---|---|
| Finds card numbers, track data and security codes in files, logs and exports | Partlyslow, samples only | Yes | Nochecks settings, not content | Yes |
| Tells real card data from test cards and look-alikes | Yesslowly | Partlyrules and allow-lists | No | Yesreads the context, gives a reason |
| Names the system, owner and PCI DSS requirement for each finding | Yes | Partlyfile path | No | Yes |
| Puts a dollar figure on each finding | No | No | No | Yesrevenue at risk, penalties |
| Masks, quarantines or deletes the data it finds | Yes | Yeson command | No | Yesafter the owner’s yes and a backup |
| Fixes the source so it stops happening | Yesengineers | No | Partlyremediation guidance | Yesdrafts the pull request |
| Proves the fix with a rescan | Partly | Yes | Partlyre-checks settings | Yesafter every fix |
| Collects evidence by requirement | Yesslowly | Partlyscan reports | Yessettings and policies | Yesfindings, fixes, approvals |
| Drafts the self-assessment sections and the assessor’s evidence pack | Yesslowly | No | Partlytemplates and policies | Yesa draft for review |
| Keeps watching after the assessment | No | Yesscheduled scans | Yes | Yes |
| Physical checks, staff interviews, penetration tests | Yespeople | No | No | Noleft to people |
| Signs the assessment | Yesa person | Yesa person | Yesa person | Yesa person |
● Yes◐ Partly— No
People’s hours, from start to signed assessment
81% fewer hours than by hand, and 78% fewer than with a scanner and people: 178 hours, about $27K.
See the hours by activity, and how each is reached
| Activity | By hand | A scanner and people | Agent and people |
|---|---|---|---|
| Find card dataBy hand: 7 systems at 8 h each. Scanner: 16 h to set up and tune, 8 h to schedule and run. Agent: connect it, check the masking, plant test cards to measure it. | 56 h | 24 h | 6 h |
| Sort real from test and look-alikesBy hand: 4 h a system. Scanner: pattern matches bring many false alarms, about 6 h a system to clear. Agent: 1.5 h a system to check its verdicts and reasons. | 28 h | 42 h | 10.5 h |
| Decide scope and map to requirementsAgent: it proposes the scope with each requirement; a person approves it. | 16 h | 16 h | 4 h |
| Write and test the fixes6 fixes at 6 h each by hand, versus 0.5 h each to review the agent’s pull request or approval request. | 36 h | 36 h | 3 h |
| Prove the fixesBy hand: search again, 2 h a system. Scanner: rescan and read it. Agent: rescans itself; a person reads the result. | 14 h | 4 h | 0.5 h |
| Gather the evidenceAgent: the evidence builds up as it works; a person reviews the pack. | 24 h | 20 h | 4 h |
| Write the assessment paperworkSelf-assessment sections and the assessor’s evidence pack, in the order PCI DSS lists the requirements. Agent: it drafts; a person finishes what it cannot see and reviews the rest. | 40 h | 40 h | 8 h |
| Review and signThe same in every column: a person reads it and signs. | 6 h | 6 h | 6 h |
| Total | 220 h | 188 h | 42 h |
Estimates for the fictional Northwind Outfitters (7 systems, 6 fixes) at an assumed $150 an hour, on the same assumptions as the business case above. Categories, not products: individual tools vary. Verify against your own environment.
How it works
- Scan
Plain code first
Reads code, logs, ticket exports, file shares and database samples. Checks every long number against the card checksum and brand ranges, and catches track data and stored security codes.
- Mask
Before anything else sees it
Every card number is cut to its first six and last four digits on the spot. A guard refuses to pass on anything that still holds a full number.
- Judge
The agent reads the context
For each masked finding, the agent decides: real card data, test data, or a number that only looks like a card, with a reason a person can check.
- Fix
It writes the fix
Code and config changes arrive as pull requests with tests and a rollback. Masking and deletion scripts are drafted for each leak, tied to the requirement they close.
- Approve
Nothing risky without a yes
Before it masks or deletes data, the agent messages the owner: what changes, why, the backup it takes first and how to undo it. No yes, no change.
- Prove and document
Rescan, then the paperwork
The same scan runs again to show the card data is gone. Then it fills the assessment sections from what it found, fixed and proved, and leaves what it can’t see to a person.
Where it runs
- In your environment
- A container with read-only access. Card data never leaves your network.
- Masked end to end
- The agent only ever sees first six and last four digits.
- Every step logged
- The log of what it read and decided becomes scope evidence.
- A guard on every change
- Pull-request review for code; the owner’s yes and a verified, encrypted backup before any data is masked or deleted.
- People sign
- Your officer or QSA signs the assessment. The agent prepares it.
On your data
The demonstration above runs on a fictional company. On your systems, the agent runs inside your environment with read-only access. Early design partners get a free scan of one system.
The engagement
PCI DSS 4.0 Ready-in-90™Typically ready in 6 weeks
- 1 · Week 1
Connect
- Agents
- Installed in your environment with read-only access.
- Our people
- Deploy the agent, check the masking, and plant test cards to measure what it finds.
- Your people
- Grant access and name an owner for each system.
- 2 · Weeks 1–2
Scope
- Agents
- Scan code, logs, exports and backups; judge every hit.
- Our people
- Decide with you what is deleted and what is secured.
- Your people
- Approve the scope.
- 3 · Weeks 3–5
Fix
- Agents
- Rescan after every change; draft redaction and logging fixes.
- Our people
- Our program manager runs the fix list against its dates.
- Your people
- Engineers delete, truncate and fix.
- 4 · Week 6
Prove and hand over
- Agents
- Assemble the evidence by requirement.
- Our people
- Rehearse the assessment, train your team to run the scan, and watch the agent monthly.
- Your people
- Run the quarterly scan; own the evidence.
What agents don’t speed up: Fixes that need re-architecture, such as moving card data behind tokenization, and your assessor’s calendar.
What you keep
- Scoping diagram
- Where card data goes, including AI tools.
- Gap register
- Requirement by requirement, each with an owner.
- Evidence pack
- Organized by requirement, ready to hand over.
- Validation path
- SAQ or ROC, stated plainly.
- Accuracy record
- Every verdict and every override, logged. Planted-answer scores on every run.
Monitoring built for an audit is switched off after the audit. Build it for fraud, and the evidence follows.National retail chain · Thousands of checkout lanes, monitored centrallyRead the case study
Questions
Is HashSecure a payment gateway or processor?
No. We don’t move or process payments. We help the merchants, gateways and processors who do find card data where it shouldn’t be and get ready for their PCI DSS assessment.
Does card data leave our environment?
No. The agent runs inside it, and even there the model only sees masked numbers.
What can it scan?
Git repositories, log exports, ticket and CRM exports, file shares and database samples, read-only.
Can it change production?
It is built to, with your permission. Today it drafts the fixes: pull requests your engineers merge, and masking or deletion your owners approve. Making approved changes itself, after a backup, is next. You choose how far it goes, one kind of fix at a time.
Aren’t the backups card data too?
Yes, and they are treated that way: encrypted, readable only by named people, in scope while they exist, and deleted automatically after 30 days.
Does it do the audit?
No. A QSA, or your officer for a self-assessment, signs it. The agent fills the paperwork and gathers the evidence, and marks what a person must check, such as terminal inspections.
How does it handle false alarms?
The checksum and brand checks remove most look-alikes; the agent judges the rest from context; a person confirms.
How does this relate to PCI Ready-in-90?
It does the searching in the first thirty days of the program, and keeps scope honest afterwards.