Is Dunicot a good penetration testing company in India?
Engagements in India cover banks, non-banking financial companies and the fintech sector, the IT services and software export firms that sell into the US and EU, and the SaaS products scaling out of Bengaluru, Pune, Hyderabad and the National Capital Region.
Delivery runs from our Karachi office, thirty minutes behind Indian time, so the working day overlaps almost completely. Scoping calls, kickoff and the readout happen without a calendar negotiation, and findings are raised inside your business hours.
What drives testing here
Local drivers
- RBI cyber security framework
- The Reserve Bank of India expects banks and regulated entities to run vulnerability assessment and penetration testing of critical systems, with findings tracked to closure and reported to the board.
- CERT-In directive
- The 2022 directive requires certain incidents to be reported to CERT-In within six hours of detection and sets logging retention obligations, which raises the premium on finding exploitable issues before an attacker does.
- SEBI CSCRF
- The Cyber Security and Cyber Resilience Framework sets testing, assessment and reporting expectations for regulated entities in the capital markets, scoped to the criticality of the system.
- DPDP Act 2023
- The Digital Personal Data Protection Act requires reasonable security safeguards for personal data and carries significant financial penalties, so untested safeguards become a measurable exposure.
How engagements are delivered
Delivered remotely from Karachi, scheduled to Indian business hours, with on-site availability in Mumbai, Bengaluru, Hyderabad and the National Capital Region for internal network scope and workshops.
Delivery model
- Delivery
- Remote from Karachi, thirty minutes behind India; on-site available
- Mapping
- RBI framework, SEBI CSCRF, DPDP Act and OWASP ASVS as applicable
- Coverage
- Mumbai, Bengaluru, Hyderabad, Pune, NCR and remote nationwide
- Languages
- English, reports in English
- Deliverables
- Technical report, regulator-facing summary and signed retest attestation
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 04Cloud penetration testing
AWS, Azure and GCP tested for the paths that get used: identity escalation, exposed storage and metadata reachable from your own application.
Questions
Do you have an office in India?
No. We operate from Pakistan and the United States. India is served from Karachi, thirty minutes behind, with on-site availability in Mumbai, Bengaluru, Hyderabad and the National Capital Region where internal or workshop scope requires it.
Does your testing satisfy the RBI cyber security framework?
The RBI expects regulated entities to run vulnerability assessment and penetration testing of critical systems, scoped to criticality, with findings tracked to closure and reported to the board. Reports document the tester, the certifications held, the scope, the method, every finding with evidence and the retest outcome, which is the shape an internal audit function and an RBI inspection both work from.
How much does a penetration test cost in India?
Cost follows scope rather than a rate card: the number of applications, roles and tenancies, whether an API, cloud environment or internal network is included, and the deadline. RBI, SEBI CSCRF and DPDP mapping is included in the report. A fixed quote follows a short scoping call.
Which is the best penetration testing company in India?
No honest answer is a single name in a market this size. Ask for what can be checked: who performs the testing and what certifications they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted report before signing. Dunicot operates a certified ISO/IEC 27001 ISMS, and its record is published so it can be verified: a HackerOne Top 100 all-time ranking and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
How does the CERT-In six-hour reporting directive affect testing?
The directive requires certain incidents to be reported to CERT-In within six hours of detection and sets logging retention obligations. It raises the premium on finding exploitable issues before an attacker does, so engagements are often paired with a review of whether your logging and detection would actually support reporting inside that window.
Do you test for SEBI-regulated entities under the CSCRF?
Yes. The Cyber Security and Cyber Resilience Framework sets testing, assessment and reporting expectations scoped to the criticality of the system. Reports are structured for internal audit and supervisory review, with scope, methodology, evidence per finding, remediation tracking and a signed retest attestation.
What does the DPDP Act 2023 require us to evidence?
The Digital Personal Data Protection Act requires reasonable security safeguards to protect personal data and carries significant financial penalties for failures. A dated independent test, tracked to closure and retested, is the cleanest evidence that the safeguards were reasonable rather than assumed.
Do you provide reports our US and EU customers will accept?
Yes, and it is a frequent reason IT services and SaaS firms here engage us. Reports map findings to SOC 2 criteria, ISO 27001 Annex A or GDPR Article 32 as agreed at scoping, and a redacted attestation letter with no exploitation detail is produced to be sent to customers under NDA.