SecurityMetrics Reviews & Provider Details

Name: SecurityMetrics
Rating: 4.8 (47 reviews)

SecurityMetrics secures peace of mind for organizations that handle sensitive data. From local shops to some of the world’s largest brands, SecurityMetrics helps businesses achieve data security with penetration testing, vulnerability scanning, gap analysis, security consulting, managed services and compliance mandates (PCI, CMMC, HIPAA, GDPR, HITRUST). SecurityMetrics is a CMMC Certified Registered Provider Organization (RPO), PCI certified Approved Scanning Vendor (ASV), Qualified Security Assessor (QSA), Certified Forensic Investigator (PFI), and Managed Security provider with over 25 years of data security experience. They have tested over 100 million systems for data security and compliance. They are privately held and headquartered in Orem, Utah, where they maintain a Security Operations Center (SOC) and 24/7 multilingual technical support.

Seller

SecurityMetrics

Discussions

SecurityMetrics Community

Services Offered

PCI Compliance, HIPAA Compliance, HITRUST Assessment, Penetration Testing, CMMC

Locations Serviced

Australia, United Kingdom, United States

Overview by

Landry French-Folsom

Top-Rated Alternatives

View All Alternatives

User Insights

Average based on 47 real user reviews.

G2 reviews are authentic and verified.

Here's how.

Verified User in Information Technology and Services

Small-Business (50 or fewer emp.)

6/29/2026

"I'm a SecurityMetrics customer and fan"

5/5

What do you like best about SecurityMetrics?

SecurityMetrics goes beyond focusing on ensuring compliance and provides insight and help with education on why various requirements are important. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

I had nothing I disliked about them and would not hesitate to use them or recommend them. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Brandon I.

Mid-Market (51-1000 emp.)

8/5/2025

"Worth It for the Peace of Mind Alone"

5/5

What do you like best about SecurityMetrics?

The human side of things. Yes, their bot does the work to detect anything malicious but their team will also investigate it and help you eliminate the issue. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

There is nothing that I have found to dislike. Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

We only use SecurityMetrics for their Shopping Cart Monitor, but it's been well worth it. If you suspect anything strange on your cart, I highly recommend giving them a shot. They identified our issue almost immediately and have consistently stayed on top of any malicious activity since. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

We've been using SecurityMetrics to monitor our shopping cart, and it's been a solid layer of protection. Their bot watches for any code changes in our stack and sends alerts right away when something looks off. What really stands out is their team — they don’t just notify me, they actively help track down where the changes came from and work with me to eliminate the issue at the source. They also follow up to make sure the threat is fully resolved. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Alan M.

Small-Business (50 or fewer emp.)

8/4/2025

"Efficient and Thorough"

5/5

What do you like best about SecurityMetrics?

Their thoroughness and authority on the subject matter of PCI compliance. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

I don't like their software tracking platform, per-se. I realize audits are complex and there are hundreds of documents to organize and track. I also realize every company is different. I just feel like an intuitive product-minded person has not led the development or adoption of the document tracking process and the non-intuitive nature takes a lot of energy to overcome. I'm certain there is a more intuitive path for Security Metrics that will help them win and retain clients going forward. No dis to the team or process otherwise. It's just a comment on tooling. Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

We shopped our bid for a PCI audit. Security Metrics wasn't the cheapest, but the scoping conversations with their team early on gave us confidence to move forward with them. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

We undergo annual PCI audits. Security Metrics is our auditor. This is an important part of our security framework and also sales materials as we're able to provide prospective clients our report on compliance. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Arturo A.

Enterprise (> 1000 emp.)

11/17/2025

"Expert Team and Outstanding Customer Service"

5/5

What do you like best about SecurityMetrics?

The team demonstrates a high level of expertise and consistently provides excellent customer service. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

I have nothing in particular to mention when it comes to dislikes. Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

I strongly recommend SecurityMetrics if you are looking to meet your PCI compliance requirements. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

SecurityMetrics conducted an on-site assessment and thorough evaluation of all credit card processing systems, networks, e-commerce platforms, as well as related policies and procedures. Their review involved identifying potential risks of fraud, working to reduce PCI scope, improving policies and procedures for credit card processing, and creating action plans to address any vulnerabilities found. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

John L.

Enterprise (> 1000 emp.)

7/23/2025

"PCI audit, Security Consulting, ASV, and support for SAQ A iFrame compliance"

5/5

What do you like best about SecurityMetrics?

They are very helpful with scope questions and are quick to jump on a call with a 3rd party service provider to help with collecting TPSP compliance documentation or reviewing TPSP compliance documentation. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

I honestly do not really have many dislikes. Their pricing is good. We have gone through multiple RFPs and they have won each time. If I had to have a dislike, they have multiple products, ASV, PanScan, Shopping Cart Monitor, and we use all of them. If I have a question, knowing the most efficient way to contact the specific department would be helpful. Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

Do your own research to see what company might work best for you, but I have recommended Security Metrics to others before. I have worked with TPSPs and they might be looking for a QSA or an approved ASV scanning provider and I have told them we use Security Metrics, and we have a great relationship with them, but please do your own research and choose any ASV or QSA for your needs. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

Security Metrics is our QSA company for annual PCI compliance audit. They also help with one-off PCI security questions, ASV scanning, and product support for SAQ A iFrame merchant compliance. We have a long-standing relationship. We have been working with Security Metrics for many years for annual compliance and through their guidance we have also reduced scope and increased our security posture. They are a trusted partner. They are very knowledgeable and offer good advice. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Clive B.

Small-Business (50 or fewer emp.)

7/30/2025

"Reliable support for staying PCI compliant"

4.5/5

What do you like best about SecurityMetrics?

SecurityMetrics consistently makes PCI compliance easy to understand and navigate. Their team is professional, highly knowledgeable, and always quick to respond when we have questions or need assistance. The peace of mind they provide by staying on top of evolving compliance standards is invaluable to our business operations. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

There’s very little to criticise, but the extra cost to the forensic services and stress testing impacts your bottom line. Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

If PCI compliance is essential to your business, SecurityMetrics is the best choice. They are calm and help you through the endless PCI requirements. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

SecurityMetrics helps ensure our business remains PCI compliant with minimal confusion or disruption. Their expert guidance simplifies a complex and often intimidating process, which is essential in maintaining trust with our customers and our payment provider. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Verified User in Computer Software

Mid-Market (51-1000 emp.)

8/13/2025

"Thorough, Professional, and Human-Centered Penetration Testing"

5/5

What do you like best about SecurityMetrics?

Their team is professional, respectful, and collaborative. They honor the rules of engagement, communicate clearly, and approach the work as a true partnership rather than just running tools and sending raw output. The final report was clearly written by a human expert: well-organized, insightful, and free from the generic, bloated format that’s common with automated-only assessments. I also appreciated their responsiveness and flexibility when it came to retesting timelines. We also chose SecurityMetrics because it allowed us to have both our penetration testing and ASV vulnerability scanning handled under one roof. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

Our experience was very positive. No critical feedback to offer. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

SecurityMetrics provides our organization with a reliable, independent assessment of our security posture through thorough penetration testing. Their approach helps us identify vulnerabilities that automated scans might miss, while also validating that our defenses are working as intended. This not only strengthens our security but also supports compliance and builds confidence for our stakeholders. The benefit is a clear, actionable roadmap to remediation without unnecessary noise or irrelevant findings. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Verified User in Supermarkets

Mid-Market (51-1000 emp.)

Updated 8/6/2025

Originally submitted 8/1/2025

"PCI Audit"

4/5

What do you like best about SecurityMetrics?

We had a 12 month contract to complete the audit. It was apparent we would not make that timeframe so Security Metrics agreed to work with us an additional 6 months at no additional charge. The Security Metrics auditor that did our onsite audit has been very helpful and informative. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

This was the very first time that our company had to go through a PCI audit. Since this was our first audit, it would probably have been incumbent on Security Metrics to stress that we might need the services of a PCI consultant to assist us in satisfying the requirements of the audit. Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

Very professional and competent company. I had pulled various documents and forms from their website for years in a previous job, this is my first experience actually working with them. I do have some frustrations with the audit process in general, but Security Metrics does not control the process. I found Security Metrics to be very easy to work with. If you have never been through an audit before, Security Metrics provides templates that provide a starting point for you in gathering the required documents and putting required processes in place. If this is your first audit, you might consider hiring a PCI consultant that can work with you and Security Metrics in order to satisfactorily complete your audit. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

PCI Audit required by Visa/Mastercard Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Verified User in Consulting

Mid-Market (51-1000 emp.)

8/5/2025

"Preferred partner for penetration testing and PCI compliance"

4/5

What do you like best about SecurityMetrics?

I like the responsiveness of Security Metrics staff.

I like the tools they provide to us and our clients for penetration testing coordination and PCI compliance management.

I like the free 90-day retest for penetration testing, providing our firm and our clients ample time to remediate penetration test findings and obtain a clean report at no additional charge. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

Some of our clients have complained of being targeted with misleading marketing emails for other services after contracting Security Metrics for penetration testing. Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

If you are engaging Security Metrics for penetration testing, make sure to follow the test prep instructions including whitelisting of Security Metrics scanning IP addresses. This will ensure smooth and complete execution of your penetration test without unnecessary fire drills or limiting testing scope due to interference from your IDS/IPS. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

Our consulting firm partners with Security Metrics to provide our clients penetration testing services and PCI DSS related tools and services. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic

Verified User in Accounting

Mid-Market (51-1000 emp.)

8/11/2025

"SecurityMetrics is our all-in-one vendor for PCI compliance"

4.5/5

What do you like best about SecurityMetrics?

I like that they take care of all of our PCI needs. We don't have to work with multiple vendors to complete our annual tasks and audit. Review collected by and hosted on G2.com.

What do you dislike about SecurityMetrics?

It would be great if the evidence collection platform integrated with our GRC, Review collected by and hosted on G2.com.

Recommendations to others considering SecurityMetrics:

I recommend considering SecurityMetrics for your internal and external pen tests, vulnerability scan, and audits. Their vulnerability scans can be scheduled, and our customer service rep reaches out when it's time for our pen tests and audit. I don't have to worry about missing a date, or getting behind. Review collected by and hosted on G2.com.

What problems is SecurityMetrics solving and how is that benefiting you?

onPhase's AR product must maintain Level 1 PCI compliance. SecurityMetrics handles our PCI penetration tests, vulnerability scans, and our annual audit. Their platform for evidence collection is easy to use and helps streamline the process. We've had the same auditor for many years which just makes the audit process that much smoother since he already knows our business. Review collected by and hosted on G2.com.

Validated ReviewerSource: Organic