Discussion on:

PCI DSS compliance - what does it look like for a small business?

...they seem to change the scanning regime and something fails. Our SSL VPN appliance failed the last scan because it allowed weak (i.e. 128 bits) ciphers on an obscure port number (not 443). The manufacturers aren't interested because they say the device doesn't do anything on that port. We're having to ask our ASV to pass the scan because the failure is purely hypothetical. Watch this space...