On‑demand webinar: The truth about PCI DSS scope - Why “we don’t touch card data” is still a risk

“We don’t touch card data, so we aren’t in scope.”
It remains one of the most persistent - and most dangerous - myths in PCI DSS compliance and payment security.

Today’s merchants rely heavily on third‑party payment providers, hosted payment pages, iFrames, tokenisation, and P2PE to simplify PCI requirements. But while these technologies dramatically reduce PCI scope, they do not remove it. And in many cases, they create new blind spots that attackers know how to exploit.

This on‑demand webinar breaks down what “out of scope” really means in 2026 - and why organisations that believe PCI is “handled” often face the greatest exposure.

Why watch this on-demand session?

Even when cardholder data never touches your systems, residual risk remains across:

• Web applications and e‑commerce integrations

• Third‑party scripts, pixels, and supply‑chain dependencies

• Misconfigured redirects and iFrame implementations

• Terminal handling, P2PE processes, and staff procedures

• Governance gaps, unverified service providers, and missing AOCs

• Incident response readiness for web‑skimming and terminal‑tampering attacks

Threat actors are well aware of these weak points. Recent high‑profile breaches show that attackers rarely target the payment provider - they target merchants, their websites, and their processes.

What this webinar covers

Hosted by Richard Ford, CTO at Integrity360, with expert guests Martin Petrov (CTO - PCI) and Alessandro Amalfitano (PCI Practice Manager), this session takes a practical, real‑world look at:

• Why “we’re not in scope” is almost never accurate

• How iFrames, hosted payment pages, and P2PE reduce-but do not eliminate-PCI DSS responsibilities

• Where PCI scope still applies in supposedly “de‑scoped” environments

• What PCI DSS assessors actually expect to see for SAQ A and P2PE merchants

• How attackers exploit overlooked dependencies, scripts, and assumptions

• Real examples of card‑skimming, web‑skimming (Magecart), and terminal swap attacks

• Practical steps to tighten governance, reduce risk, and avoid costly compliance failures

Whether you operate an e‑commerce platform, manage brick‑and‑mortar payment terminals, or rely on third‑party payment solutions, this session will help you clarify your true PCI obligations.

Who should watch?

• E‑commerce merchants

• Retailers using P2PE or payment terminals

• CISOs & security leaders

• Compliance managers & PCI owners

• Payments, risk & governance teams

If your organisation processes any payments - online or in‑store - this content is essential.

Watch on demand now!

Gain clarity on PCI DSS scope, understand where risk truly lives, and learn how to protect your customers, revenue, and reputation.