Why 9 Gyms Kept Failing PCI Scans Despite Clean Firewalls

A fitness brand with nine gym locations failed its quarterly PCI scans for two quarters in a row, and the findings changed from one scan to the next. The firewalls were clean. The unresolved exposure sat on equipment the business rented from its internet provider and had never treated as part of its own environment. This was more than an IT problem. It affected payment security and the company's ability to demonstrate PCI compliance across nine revenue-generating locations.

Two quarters without a passing PCI scan

For businesses whose PCI validation requires external vulnerability scans, PCI Security Standards Council guidance calls for evidence of passing scans by a PCI SSC Approved Scanning Vendor at least once every three months. A passing scan is not proof of complete PCI compliance, but it is required evidence for applicable environments. Repeated failures left this company with an unresolved payment-security exposure and no passing result to provide to its compliance stakeholders.

Our client had failed two consecutive quarters across its locations before contacting Actif. The findings also shifted between scans, which made the problem harder to pin down. Every review pointed back to the firewalls, and every review found them correctly configured.

The owner was caught between three parties. The scanning vendor wanted the findings fixed. The internet provider said its equipment was fine. The payment processor wanted a passing report.

Treat the scan report as the spec

We started from the scan report instead of the network diagram and asked one question: which public address was flagged, and what device actually answers on it?

The answer was the gateway the internet provider installs at each location. In this environment, the gateway sat in front of the customer's equipment, kept one of the customer's public addresses for itself, and ran its own management and network services. A simple pass-through configuration was not available. Because the provider controlled that equipment, its behavior could change without the client's knowledge, which also explained why the findings kept changing.

The client had not bought that device and did not manage it, so it never appeared on an asset list. Internal reviews overlooked it. The scanner did not.

Owning the edge

Asking the provider to adjust settings location by location would have been slow, hard to verify, and likely to regress. We changed the design instead.

• Restructured the network topology and configuration at each location so the public addresses being scanned end at equipment the client owns and Actif manages.
• Took ownership of the layer above the client's network, the edge that had been left to the provider, so the provider's device returns to simply carrying traffic.
• Kept the security posture strong on the business-grade network equipment Actif installed, with consistent hardening and monitoring across every site.
• Confirmed the scan scope matched what the client actually owns and controls, and documented the evidence for the scanning vendor and processor.
• Built the fix once and applied the same standard to all nine locations.

The results

• All nine locations passed their next scheduled compliance scan.
• One root cause, one standard, applied everywhere, instead of nine separate investigations.
• The quarterly cycle of re-auditing healthy firewalls ended.
• The owner now has clear documentation for the payment processor, the provider and future scans.

What business owners should take from this

Your network and the network in your building are not the same thing. The provider's equipment sits at the front door of your business, and a security scanner judges you by it. If you are not sure who manages that box, find out.

A failed scan does not always mean your IT is weak. Sometimes nobody has looked at the full path from the internet to the front desk.

Multiple locations multiply everything. The same setup is usually copied to every site, so one problem appears everywhere, and so does one fix.

The gaps sit between vendors. Compliance problems rarely live in the equipment you manage. They live at the boundaries, where each side assumes the other owns the problem. Map the whole path, including the parts you rent.

Frequently asked questions

What should I do if my PCI scan fails but my firewall is clean? Start with the exact public address named in the scan report and identify which device actually answers on it. Do not assume that device is your firewall. It may be an ISP gateway, modem, or another upstream appliance. Confirm the scan scope with your ASV or compliance-accepting organization, document who controls the device, and then remediate the infrastructure that is actually being tested.

Can my internet provider's modem cause a failed PCI scan? Yes. With static IP service, the provider's gateway often holds one of your public addresses and answers on it directly. Any services it exposes are flagged against your business, even when your firewall is clean.

Who is responsible for the provider's gateway during a PCI scan? The scan judges every public address in your scope, regardless of who owns the device answering. The most reliable approach is a design where scanned addresses end at equipment you control.

Why not put the gateway in bridge mode? A true pass-through mode is not always available with business static IP service, and the gateway may keep one public address for itself. In this engagement, changing the design was more dependable than relying on a provider setting.

Why would scan results change from quarter to quarter? When the device answering is managed by someone else, its behavior can change without your knowledge. Inconsistent findings are a common sign that the scanner is reaching equipment outside your control.

We have several locations. Do we fix each one separately? Usually not. Multi-location businesses tend to use the same provider setup everywhere, so one root cause and one standard fix can cover every site.

Can Actif certify that a business is PCI compliant? Actif diagnoses and remediates the network and infrastructure issues behind failed scans. Your Approved Scanning Vendor, acquirer, payment brand, or other compliance-accepting organization determines the applicable validation requirements and accepts the compliance evidence.