The problem is that there is no transparency to the end user (customer). As stated previously PCI is a barebones set of recommendations that doesn't make any c

The problem is that there is no transparency to the end user (customer). As stated previously PCI is a barebones set of recommendations that doesn't make any commitments to a real world security model at all. Instead it is more of a revenue model than a tool that helps offset risk for businesses. All of the audit and products built around it are mostly as valuable as PCI itself. If PCI were to be revamped an actual assessment which graded real-world efficacy would be transparent to the customer prior to purchase. Real-world efficacy is the hard part, as it is not a static of any sort. TL;DR Businesses are bound by process and governance. Attackers are not. If you use PCI as a driver for security implementation you will fail. PCI 'compliance' continues to be a fallacy of warm and fuzzy security kittens.