PCI used to fit neatly into a budget. You’d build your cardholder data environment, lock it down, gather evidence, and once a year prove to an assessor that everything worked. Costs were predictable because the work was concentrated: audit cycle, remediation sprint, then relative quiet until next year. That model broke somewhere around 2018. Now your payment flow touches cloud accounts, shared services, SaaS vendors, front-end code, and operational teams deploying changes on their own schedules.