Search for "PCI compliance tools for small business" and you will find PCI Pal, SecurityMetrics, and ControlScan listed side by side as though they were three versions of the same product. They are not. One of the three stopped existing as an independent company more than five years ago, and another solves a problem that most small merchants do not have. Sorting that out before you compare features will save you more money than any discount code.
ControlScan is now VikingCloud, which changes what you are buying
ControlScan sold its Managed Compliance Solutions division to Sysnet Global Solutions in December 2020. Sysnet went on to acquire SecureTrust and NuArx during 2021, then rebranded the combined group as VikingCloud on 13 April 2022. ControlScan's separate managed security services arm went a different way, to PDI Software. The name has a long tail: storage and property management platforms still label their compliance workflow "Control Scan by VikingCloud" in help documentation. But you cannot sign a contract with ControlScan the company in 2026.
What you can buy is SecureTrust PCI Manager for Small Business, VikingCloud's SMB offering. Its published feature set covers a guided self-assessment with unlimited attempts and an express renewal option, Approved Scanning Vendor (ASV) certified external vulnerability scanning, and an endpoint protection suite. VikingCloud states the service is trusted by "millions of small business locations around the globe."
What each tool actually does
SecurityMetrics: validation, scanning, and card discovery
SecurityMetrics is a Qualified Security Assessor and Approved Scanning Vendor selling directly to merchants. Its small business package is built around the annual validation cycle: complete a Self-Assessment Questionnaire, pass a quarterly external vulnerability scan, and report the result to your acquirer. It adds PANscan, a card data discovery tool that searches a machine for unencrypted primary account numbers you did not know you were storing. That last capability is genuinely useful, because unexpected card data on a back-office PC is a common reason merchants fail an assessment they expected to pass.
VikingCloud: compliance delivered through your processor
VikingCloud's SMB business is largely a channel play. Rather than selling to merchants one at a time, it powers the compliance portals that acquirers and payment processors put in front of their merchant base. If your monthly statement carries a compliance or "PCI program" line item, there is a reasonable chance VikingCloud is behind the portal you log into. The guided self-assessment and express renewal features exist because that audience renews every year and rarely enjoys it.
PCI Pal: descoping phone payments, not validating compliance
PCI Pal belongs in a different category, and this is where most comparison articles go wrong. It is not a validation service. PCI Pal's DTMF masking technology intercepts the tones a customer types on their telephone keypad and replaces them with a monotone comfort beep, sending the payment data straight to the payment service provider rather than into the contact centre. Agents never see or hear card details. Because no payment digits are audible, call recording systems cannot capture them, which removes the need for pause-and-resume recording — a control that fails quietly and often. PCI Pal lists PCI DSS, ISO 27001, ISO 22301, ISO 9001, ISO 14001, and Cyber Essentials among its certifications.
The practical effect is scope reduction. If your agents currently read card numbers aloud or type them into a CRM, your entire contact centre sits inside the cardholder data environment. Masking pulls it out. What masking does not do is complete your SAQ or run your ASV scan.
Pricing: only one of the three publishes a number
This is where the market is deliberately opaque, so here is what is actually documented. SecurityMetrics publishes $399 per year for its PCI for Small Businesses plan, noting that discounts are available depending on your merchant processor. That price includes an external vulnerability scan for one IP address, the online SAQ, a compliance reporting portal, reporting to your processor, a compliance certificate, PANscan for one machine, one seat of security awareness training, and a service warranty offering up to $100,000 reimbursement in the event of a breach.
VikingCloud does not publish SMB pricing on its site; small businesses are routed to purchase a subscription through SecureTrust, and most merchants encounter the cost bundled into processor fees rather than as a standalone purchase. PCI Pal, an AIM-listed company trading as PCIP, quotes on a per-deployment basis and does not publish a rate card. Treat any specific figure you see attributed to either without a source as unreliable.
One warning worth more than the price difference: check your merchant statement before buying anything. Merchants routinely pay a bundled compliance program through their acquirer and then purchase a second service directly, validating twice and paying twice.
PCI DSS v4.0.1 changed the calculation for e-commerce sellers
PCI DSS v4.0.1 became the live standard on 31 March 2025, when the future-dated requirements stopped being best practice and became mandatory. Requirements 6.4.3 (authorising and integrity-checking payment page scripts) and 11.6.1 (tamper detection on payment pages) apply in full to merchants validating under SAQ A-EP and SAQ D. The PCI Security Standards Council removed both from SAQ A itself, replacing them with an eligibility criterion: the merchant must confirm their site is not susceptible to script-based attacks affecting e-commerce systems.
That matters here because none of these three products is primarily a script-monitoring tool. If you take payments on your own web pages, confirm what your provider covers before assuming an annual SAQ subscription closes the gap.
Verdict: which one belongs in your budget
- Choose SecurityMetrics if you are a card-present or small e-commerce merchant buying compliance directly and you want a published price. The $399 figure, the card discovery tool, and the stated breach warranty make it the most transparent option of the three.
- Use VikingCloud if your acquirer already enrolled you. You are likely paying for it. Log in, use the express renewal, and do not buy a competing service on top.
- Add PCI Pal if agents handle card numbers over the phone. It is a complement, not a substitute. Masking shrinks your scope dramatically, but you still need an SAQ and an ASV scan behind it.
- Do not shop for ControlScan. Any 2026 article presenting it as a live standalone vendor has not checked since 2020.
The honest summary is that only two of these three compete with each other. SecurityMetrics and VikingCloud sell overlapping validation services to the same merchants through different channels. PCI Pal sells scope reduction to businesses taking payments by voice, and the strongest setup for a contact-centre-heavy small business is one of the first two paired with the third.