Payment terminals remain a critical point of interaction between consumers, merchants and the financial ecosystem. As attackers increasingly target the communication and transaction paths around these devices, securing a payment terminal cannot stop at certification or a point-in-time penetration test.

New data from the European Association for Secure Transactions (EAST) highlights why.

According to EAST's H1 2026 European Payment Terminal Crime Report about data relay attacks continue to increase in europe, terminal-related fraud attacks in Europe increased by 42%, from 7,398 to 10,535. Even more significantly, reported data-relay attacks increased by 176%, reaching 7,024 incidents in the first half of 2026. Of these, 1,540 were terminal-to-terminal attacks and 5,484 involved card-to-terminal relaying. 

These figures do not indicate a compromise of any particular PCI PTS-certified device or manufacturer. They do, however, demonstrate that the terminal and card interaction layer remains an active part of the payment threat landscape.

PCI PTS certification is important. But it is only the beginning of product security lifecycle.

PCI PTS provides an important security baseline for payment terminals and related devices. Penetration testing helps identify weaknesses in the device, its software, interfaces and security controls before a product reaches the market.

But a penetration test is inherently a point-in-time assessment.

Once a device is deployed, its threat environment continues to change. New vulnerabilities are disclosed continuously, attack techniques evolve, components receive updates, dependencies change and researchers uncover new ways of interacting with payment hardware and software.

A device that passed a rigorous security assessment at one point in its lifecycle may therefore face a different risk profile months or years later.

This is where continuous vulnerability monitoring and threat intelligence about platform/continuous monitoring become an important complement to penetration testing.

From testing the device to monitoring its evolving risk

Effective payment terminal security requires both deep technical assessment and ongoing visibility.

A PTS device penetration test can help answer questions such as:

• Can an attacker exploit weaknesses in the device's software or firmware?
• Are interfaces and communication mechanisms adequately protected?
• Can security controls be bypassed?
• Are there attack paths that could affect sensitive payment functionality?
• Do identified weaknesses create realistic exploitation opportunities?

Continuous monitoring addresses a different question:

What has changed since the device was last tested?

New vulnerabilities may affect operating systems, third-party components, libraries, firmware or other elements incorporated into the product. New threat intelligence may reveal exploitation techniques that were not known when the original assessment during certification took place. Changes to the product or its supporting infrastructure can also introduce new risk.

For payment terminal manufacturers, payment solution providers and organisations operating large terminal fleets, maintaining this visibility can be just as important as establishing the initial security baseline.

PTS penetration testing: finding weaknesses before attackers do

At PCA Cyber Security, our payment terminal penetration testing about services/penetration testing/payment device penetration testing combines hands-on security assessment with expertise in embedded and payment-device security.

Our security researchers assess PTS devices and embedded payment solutions from an attacker's perspective, looking beyond a certification checklist of requirements to identify technically meaningful weaknesses and realistic attack paths.

Depending on the product and assessment scope, testing can cover areas such as:

• Firmware and software security
• Attack surfaces and exposed interfaces
• Authentication and access controls
• Communication mechanisms
• Debug and development interfaces
• Secure boot and update mechanisms
• Cryptographic implementation and key-management related controls
• Local and remote attack scenarios
• Vulnerability discovery and exploitation

The objective is not simply to identify vulnerabilities, but to understand whether/how they could be exploited and what they could mean for the security of the payment device.

Why continuous monitoring matters after the penetration test

The end of a penetration test should not mean the end of security monitoring.

This is particularly relevant for payment terminals because their security lifecycle can extend for many years. A product may remain deployed long after its original assessment, while the vulnerabilities and attack techniques relevant to it continue to evolve.

This creates a lifecycle challenge:

Test → certify → deploy → monitor → reassess → remediate

Continuous monitoring helps bridge the gap between these stages.

 

PCA CERVUS: continuous visibility for embedded payment products

This is one of the areas where PCA CERVUS Platform about platform complements PCA Cyber Security's penetration testing and threat intelligence services.

PCA CERVUS is a device-centric vulnerability monitoring & threat intelligence platform designed for embedded and connected products. It provides continuous visibility into vulnerabilities and security risks affecting products throughout their lifecycle.

For payment terminals and other embedded financial solutions, PCA CERVUS can help product security teams:

• Monitor vulnerabilities relevant to the components and software used in their products
• Validate and maintain SBOM information
• Identify risks emerging in the software supply chain
• Correlate vulnerability information with product and component context
• Support continuous security monitoring requirements
• Prioritise vulnerabilities for further investigation and remediation
• Maintain visibility beyond the point-in-time penetration test

This creates a more complete security picture: penetration testing establishes what can be attacked; continuous monitoring helps identify what may become attackable next.

A changing threat landscape requires a lifecycle approach

The latest EAST figures are a reminder that payment terminal security remains an evolving challenge. The sharp increase in reported data-relay attacks does not mean that a particular PTS device is vulnerable, nor does it diminish the value of PCI PTS certification.

Rather, it reinforces a broader point: security cannot be treated as a one-time event.

For manufacturers and operators of payment terminals, robust security requires a combination of rigorous penetration testing, appropriate certification, vulnerability intelligence, supply-chain visibility and continuous monitoring.

PCI PTS can establish an important security baseline. Penetration testing can challenge that baseline from an attacker's perspective. And continuous monitoring can help security teams understand how the risk landscape changes after the assessment is complete.

Because a secure payment terminal is not simply one that passed a test. It is one whose security remains understood and actively managed throughout its lifecycle.

Want to understand how your payment terminal security can be assessed and monitored beyond certification?
Get in touch to discuss PTS device penetration testing and PCA CERVUS.