PCI DSS Requirement 11.3 addresses penetration testing, which is different than the external and internal vulnerability assessments required by PCI DSS Requirement 11.2. A vulnerability assessment simply identifies and reports noted vulnerabilities, whereas a penetration test attempts to exploit the vulnerabilities to determine whether unauthorized access or other malicious activity is possible. Penetration testing should include network and application layer testing as well as controls and processes around the networks and applications, and should occur from both external and from inside the network.

This is exactly what AVDS does. It specifically attempts to exploit vulnerabilities using carefully crafted inputs that reveal their actual presence without making any changes to or injecting any payload into the target application or device. AVDS tests network and application layers as well as the controls and processes used by networks and applications. It tests from outside the network and from within the network.

Typical Vulnerability Assessment solutions do not satisfy penetration testing requirements. They almost universally check for the current version number as reported by each host, and deduce vulnerabilities based on version. As noted in the introduction above this does NOT determine whether unauthorized access of other malicious activity is actually possible.