PCI PTS Compliance Testing Companies: 5 companies compared

PCA Cyber Security is a Munich-based penetration-testing and security-research firm with a dedicated payment-device practice. It performs real-world security testing of payment terminals, PIN pads, unattended and self-service terminals, and fuel-pump and EV-charging payment systems, testing beyond PCI PTS certification to find vulnerabilities even in approved devices. PCA became a PCI SSC Associate Participating Organisation in 2026 and also runs a strong automotive and embedded security practice. PCA also offers software composition analysis and SBOM validation, reverse-engineering device firmware rather than relying on vendor documentation or an existing SBOM. The vendor describes reconstructing a verified component inventory from the firmware binary, mapping dependencies against runtime behaviour, surfacing undocumented components and mapping findings to CVEs, delivered as an extended bill of materials (xBOM). The service targets payment and financial devices including PTS terminals, smart POS, mPOS and ATMs, alongside automotive ECUs, kiosks, fuel pumps and EV charging interfaces.

Brightsight, part of SGS, is one of the largest security evaluation laboratories for payment and chip technology. It is a PCI Recognized Laboratory for the PTS, SPoC, CPoC, MPoC and SDK programs and an accredited EMVCo and Common Criteria lab, having completed hundreds of PCI PTS device approvals for terminal and HSM makers worldwide. Headquartered in Delft, Netherlands.

UL Solutions is a global testing, inspection and certification firm with a major payment-device security practice. It is a PCI Recognized Laboratory for PTS POI and HSM evaluation and an EMVCo type-approval lab, and states it has supported approval of over a thousand payment terminals since the PTS program began. Headquartered in Northbrook, Illinois.