Has anyone had network penetration testing done for PCI? It is requirement 11.3 and is manual versus the automatic vulnerability scans that are required on a quarterly basis. It requires both internal and external penetration testing, as well as web application penetration. I'm collecting quotes from various vendors and it is EXPENSIVE!!! If you have had this done and can share the vendor you used I would appreciate it.
Gotta love PCI compliance...