Is Dunicot a good penetration testing company in Denmark?
Engagements in Denmark cover shipping and maritime logistics, pharmaceuticals and life sciences, fintech and payments, and the suppliers to a heavily digitised public sector.
Delivery runs from our Karachi office, four hours ahead of Danish time, with reporting and live sessions scheduled inside your working day.
What drives testing here
Local drivers
- Datatilsynet
- The Danish data protection authority enforces GDPR, and its guidance and cases keep access control and data exposure in front of management.
- Centre for Cyber Security
- The CFCS is the national cyber security authority and houses the national CERT, setting threat guidance and incident expectations that reach operators of essential services.
- Public digitalisation
- Deep digitisation of public services concentrates citizen data behind shared platforms and logins, which raises the consequence of an authorisation flaw and the scrutiny suppliers face.
- NIS2 and DORA
- The Danish transposition of NIS2 widens scope across essential and important entities, and DORA adds testing and ICT third-party duties on financial entities.
How engagements are delivered
Delivered remotely from Karachi, scheduled to CET business hours, with on-site availability in Copenhagen, Aarhus and Odense for internal network scope and workshops.
Delivery model
- Delivery
- Remote from Karachi, four hours ahead of CET; on-site available
- Mapping
- GDPR Article 32, NIS2, DORA and OWASP ASVS as applicable
- Most requested
- Authorisation testing, API security and multi-tenant isolation
- Invoicing
- DKK, EUR or USD
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 04Cloud penetration testing
AWS, Azure and GCP tested for the paths that get used: identity escalation, exposed storage and metadata reachable from your own application.
Questions
Do you have an office in Denmark?
No. We operate from Pakistan and the United States. Danish engagements run remotely on CET business hours, with on-site attendance in Copenhagen, Aarhus or Odense arranged where scope requires it.
How much does a penetration test cost in Denmark?
Cost follows scope rather than a Danish rate card, which is generally why we are engaged here. GDPR and NIS2 mapping is included in the report. A fixed quote follows a short scoping call and covers testing, reporting and retest, with no hourly billing.
Which is the best penetration testing company in Denmark?
No honest answer is a single name. Check what can be verified: the certifications held by the testers assigned to you, the team's public research record, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted sample report before signing. Our record is published to be verified: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Do you test suppliers to the Danish public sector?
Yes. Where your platform handles citizen data or integrates with national services, authorisation testing is the heart of the engagement, because the consequence of a cross-account flaw scales with how much the platform is trusted. Reports are written so they can be passed to the contracting authority without exposing reproduction detail.
How do you handle GDPR when Datatilsynet is the supervising authority?
By keeping personal data out of scope wherever the engagement allows. Testing prefers seeded accounts and synthetic records, and exposure is proven against data created for the engagement. Where production access is unavoidable, it runs under a data processing addendum agreed before testing starts.
Do you work with shipping and maritime logistics?
Yes. Shipping platforms sit between many parties, and the exposure is usually in the integration layer rather than the application: partner APIs where trust is implicit, message flows where authorisation is assumed, and identifiers that work across organisational boundaries they should not cross.
Do you test for pharma and life sciences companies?
Yes. The estate usually spans corporate IT, research platforms and manufacturing systems, and the interesting exposure is typically at the joins. Manufacturing and control systems are tested in a controlled environment rather than live.
Does NIS2 require penetration testing in Denmark?
Not in those words. The Danish transposition requires appropriate technical measures and tested incident handling for essential and important entities, with management accountability attached. Independent testing is the standard way appropriateness is evidenced rather than asserted.