PCI PTS Compliance Testing Companies: 6 companies compared

PCA Cyber Security is an offensive security and threat intelligence firm registered in Budapest as PCA Cyber Security Zrt., with a further office in Munich. It works across two connected practices. The payment-device practice tests payment terminals, PIN pads, unattended and self-service terminals, ATMs, and fuel-pump and EV-charging payment systems, testing beyond PCI PTS certification to find vulnerabilities in approved devices; PCA became a PCI SSC Associate Participating Organisation in 2026. The automotive and embedded practice, formerly PCAutomotive, covers vehicle and ECU penetration testing, threat analysis and risk assessment, product security operations monitoring, and research from its CyberLab and CyberGarage facilities. It also offers software composition analysis and SBOM validation, reverse-engineering device firmware rather than relying on vendor documentation, delivering an extended bill of materials with CVE mapping. The vendor is a repeat Pwn2Own Automotive contestant and holds TISAX Assessment Level 3.

Brightsight, part of SGS, is one of the largest security evaluation laboratories for payment and chip technology. It is a PCI Recognized Laboratory for the PTS, SPoC, CPoC, MPoC and SDK programs and an accredited EMVCo and Common Criteria lab, having completed hundreds of PCI PTS device approvals for terminal and HSM makers worldwide. Headquartered in Delft, Netherlands.

UL Solutions is a global testing, inspection and certification firm with a major payment-device security practice. It is a PCI Recognized Laboratory for PTS POI and HSM evaluation and an EMVCo type-approval lab, and states it has supported approval of over a thousand payment terminals since the PTS program began. Headquartered in Northbrook, Illinois.