The two claims to be suspicious of
Any vendor telling you their scanner satisfies requirement 11.3.2 is wrong. External vulnerability scanning under PCI DSS must be performed by an Approved Scanning Vendor, and ASV status is a specific accreditation with its own scan process and reporting. SecAI is not an ASV, its scanning is not an ASV scan, and it says so in the report itself.
The second is the "PCI compliant" badge on a tool. Compliance is determined for your cardholder data environment as a whole, by your own assessment, and where applicable by a Qualified Security Assessor. SecAI is not a QSA. A tool can be part of how you meet a requirement; it cannot be the determination that you did.
Requirements a host agent genuinely covers
- Requirement 2, secure configuration: hardening findings on SSH configuration, root login, password authentication, permissions and firewall state, observed continuously rather than baselined once.
- Requirement 5, malware protection: webshell detection in web-served directories with AI screening, suspicious process detection including cryptominer patterns and processes running from deleted binaries, and rootkit and persistence indicators.
- Requirement 6.3.3, patching: installed packages matched against public vulnerability data, per machine and by severity, so you can show what was known and when.
- Requirement 7 and 8, access: SSH authentication events with source and method, sudoers and privileged account configuration, setuid binaries, local accounts and changes to them.
- Requirement 10.5.5, file integrity: monitored changes to sensitive paths including passwd, shadow, group, sshd_config and drop-ins, crontab and cron.d, hosts, nsswitch and pam.d.
- Requirement 10.6, time synchronisation: whether each host clock is synchronised, which NTP service provides it and from which sources. Note this is partial: SecAI observes synchronisation but does not verify that time settings are restricted to authorised staff, which is the other half of the requirement.
Requirements it does not cover, stated as such
Requirement 11.3.2 external scanning: needs an ASV. SecAI is not one and its findings do not substitute.
Requirement 11.4 penetration testing: a human-led exercise. Continuous vulnerability identification is a different activity and is not a substitute.
Requirement 3 stored account data: SecAI does not locate or classify cardholder data and does not verify encryption of data at rest.
Requirement 9 physical access, requirement 12 policy and programme governance, and the personnel and third-party obligations throughout: entirely organisational.
Log retention duration and immutability: SecAI retains security events in the platform but does not verify retention configuration or immutability on the host, so the retention half of requirement 10 is reported as manual.
Scope is the thing that decides the value
PCI DSS applies to your cardholder data environment, and a host agent covers exactly the Linux servers it runs on. If your CDE includes network devices, payment terminals, a hosted checkout, or Windows systems, SecAI covers none of that, and a report that implied otherwise would be actively harmful during an assessment.
The report states its scope explicitly on the first page, in servers rather than in claims: which machines were assessed, when, and by which framework version and mapping version. That framing is what lets an assessor treat it as evidence rather than as marketing.
What an assessment looks like
You run PCI DSS 4.0.1 against the servers in scope and get a control-by-control result: how many requirements are backed by verified evidence, how many are partial, how many failed a technical check on those specific machines, how many need manual verification, and how many sit outside what a host agent can observe.
Failed checks are listed first, before the full catalog, with what was observed. A failed technical check is a finding about your servers, not a determination that the requirement as a whole is unmet, and the report is careful to say which of those it is making.