PCI vulnerability scanning can be difficult in a number of ways, including accurately determining the scope of the assessment, identifying all networks and systems covered by PCI DSS, and managing vulnerabilities that are found during the scanning procedure.