Is Dunicot a good penetration testing company in Ghana?
Engagements in Ghana cover banks and specialised deposit-taking institutions, mobile money and electronic money issuers, the fintech and lending products built on top of them, and the aggregators connecting all three.
Delivery runs from our Karachi office, five hours ahead of Ghanaian time, so our afternoon covers your morning, with our United States office picking up the rest of your working day for same-day answers.
What drives testing here
Local drivers
- Cybersecurity Act 2020 and the Cyber Security Authority
- The Act established the Cyber Security Authority, which licenses cyber security service providers and sets directives for critical information infrastructure owners, including testing and incident reporting.
- Data Protection Act 2012
- The Act requires appropriate technical and organisational measures to secure personal data, supervised and enforced by the Data Protection Commission.
- Bank of Ghana
- The central bank sets cyber and information security directives for banks, specialised deposit-taking institutions and payment service providers, including independent testing and incident reporting.
- Mobile money concentration
- With so much value moving through wallets and agents, the transaction state machine and authorisation boundaries carry direct financial exposure and are the usual starting point.
How engagements are delivered
Delivered remotely from Karachi, scheduled to Ghanaian business hours across both offices, with on-site availability in Accra for internal network scope, scoping workshops and executive readouts.
Delivery model
- Delivery
- Remote, covered across both offices for GMT business hours; on-site available
- Mapping
- Cybersecurity Act 2020, Data Protection Act 2012, Bank of Ghana directives
- Coverage
- Accra, Kumasi, Tema and remote nationwide
- Most requested
- Mobile money transaction logic and backing API authorisation
- Deliverables
- Technical report, regulator-facing summary and signed retest attestation
Most requested here
Mobile application penetration testing
iOS and Android tested as a binary, as a running process and as a client of your backend because all three fail differently.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 01Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Questions
Do you have an office in Ghana?
No. We operate from Pakistan and the United States. Ghana is served across both, with our United States office covering part of your working day and Karachi covering the rest, and on-site availability in Accra where internal or workshop scope requires it.
Do you need a licence from the Cyber Security Authority to test in Ghana?
The Cybersecurity Act 2020 established a licensing and accreditation regime for cyber security service providers operating in Ghana. Where your engagement requires a locally licensed provider, we will say so plainly and structure delivery accordingly rather than claim a status we do not hold; otherwise engagements run under a signed engagement letter defining scope and authorisation.
How much does a penetration test cost in Ghana?
Cost follows scope rather than a local rate card: the number of applications, roles and tenancies, whether a mobile application, API or internal network is included, and the deadline. Cybersecurity Act, Data Protection Act and Bank of Ghana mapping is included in the report. A fixed quote follows a short scoping call.
Which is the best penetration testing company in Ghana?
No honest answer is a single name. Ask for what can be checked: who performs the testing and what certifications they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted report before signing. Dunicot operates a certified ISO/IEC 27001 ISMS, and its public record can be verified: a HackerOne Top 100 all-time ranking and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Do you test mobile money platforms?
Yes, and they are usually the highest-value scope here. Testing targets the transaction state machine rather than the endpoints: what happens when a cash-in is reversed mid-flight, when a limit check and a settlement race each other, and whether an identifier from one wallet or agent works against another. The mobile application and its backing API are tested together.
What does the Data Protection Act 2012 require us to evidence?
The Act requires appropriate technical and organisational measures to secure personal data, supervised by the Data Protection Commission. A dated independent test, tracked to closure and retested, is the cleanest evidence of the technical measures, so the report is structured to carry that framing already.
Do you test for banks and payment providers under Bank of Ghana oversight?
Yes. The Bank of Ghana expects independent testing and incident reporting from the institutions it supervises. Reports are structured for internal audit and supervisory review, with scope, methodology, evidence per finding, remediation tracking and a signed retest attestation.