Is Dunicot a good penetration testing company in Doha?
Doha engagements centre on the financial sector supervised by Qatar Central Bank, the government and semi-government bodies under national cybersecurity rules, and the energy, transport and infrastructure operators that anchor the economy. A growing technology and fintech sector sits alongside, often serving those same institutions.
The compliance picture has two main pillars. Qatar Central Bank sets security and resilience expectations for the banks and payment firms it supervises. The National Cyber Security Agency, through the National Information Assurance standard, sets a control baseline for government and critical-sector entities, and the Qatar Personal Data Privacy Protection Law adds a general data-protection obligation. Independent testing is the evidence each of these expects.
What drives testing here
Local drivers
- Qatar Central Bank
- The central bank sets security and resilience expectations for the banks and payment institutions it supervises, with independent testing and findings tracked to closure the standard way those expectations are evidenced.
- NCSA and the NIA standard
- The National Cyber Security Agency's National Information Assurance standard sets a mandatory control baseline for government and critical-sector entities, with assessment against it expected.
- Qatar PDPPL
- The Personal Data Privacy Protection Law sets security obligations for organisations processing personal data in Qatar, which independent testing helps evidence.
- Infrastructure and energy
- Energy, transport and infrastructure operators run operational technology where availability and segmentation are the first concerns, which shapes where and how testing is allowed to run.
How engagements are delivered
Delivered remotely from our Karachi office, two hours ahead of Arabia Standard Time, with on-site attendance in Doha available for internal network and controlled-environment scope.
Delivery model
- Coverage
- Doha, remote and on-site
- Hours
- Arabia Standard Time, delivered from Karachi two hours ahead
- Frameworks
- Qatar Central Bank expectations, NCSA NIA standard, Qatar PDPPL
- OT scope
- Operational technology tested in lab or controlled environments, never live
- Invoicing
- USD or QAR by arrangement
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Questions
Do Qatar Central Bank rules require penetration testing for banks?
The central bank sets security and resilience expectations for the institutions it supervises, and independent testing with findings tracked to closure is the standard way those expectations are evidenced. Reports are structured for internal audit and regulator review, with defined scope, documented methodology, CVSS-rated findings, remediation status and a retest attestation.
What is the NIA standard and does it apply to us?
The National Cyber Security Agency's National Information Assurance standard sets a control baseline for government and critical-sector entities in Qatar and expects assessment against it. If you are a government body or operate in a designated critical sector it is likely to apply, and independent testing shows which of its controls hold under attack, reported so findings map to the areas it covers.
Does the Qatar PDPPL affect our testing?
The Personal Data Privacy Protection Law requires appropriate measures to protect personal data processed in Qatar. Independent testing is a standard way to show those measures were assessed against an attacker, and the report is written so it can be filed against that obligation alongside the central bank or NIA requirement that applies.
How much does a penetration test cost in Doha?
Cost follows scope rather than a rate card: application and system count, API and internal network inclusion, the regulatory framework in play, and the deadline. A fixed quote follows a short scoping call, with invoicing available in USD or QAR by arrangement.
Which is the best penetration testing company in Doha?
No single name is an honest answer, this one included. Ask for what you can verify: who performs your test and what they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether a redacted sample report is available first. Our record is public: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
How do you test energy and infrastructure operators?
With availability first. Corporate IT is tested normally; operational and control systems are tested in a lab or controlled environment only, never live, and the report separates what was proven from what was assessed by inspection and documents the segmentation between the two estates.
Can you attend on site in Doha?
Yes, for internal network testing and controlled-environment work. Application, API and cloud scope is delivered remotely from our Karachi office, two hours ahead of Arabia Standard Time, which starts faster and keeps the working day aligned.