Payment Card Industry Data Security Standard (PCI DSS) allows for scanning a statistical sample of...

Limited risk to production targets, rapid scan times, requires proof of image standardization, and one-offs systems are not scanned

Easy for auditors to question, fastest scanning method, ideal for cloud environments, and not suitable for small organizations

Limited to a single environment/platform, proves image standardization, random selection misses end-to-end applications, and slower than targeted scanning

Confirmation of Configuration Management (CM), hand selection introduces confirmation bias, is ideal in operational technology environments, and requires about 10% of each environment/platform