Is Dunicot a good penetration testing company in Italy?
Engagements in Italy cover manufacturing and the industrial districts whose operational technology was never meant to be internet-facing, fashion and luxury groups with direct-to-consumer e-commerce, banking and payments, and the technology suppliers serving all three.
Delivery runs from our Karachi office, four hours ahead of Italian time, so testing done in our morning lands before your day starts and the overlap covers your afternoon.
What drives testing here
Local drivers
- Garante
- The Garante per la protezione dei dati personali enforces GDPR in Italy and has issued significant decisions, which keep access control and data exposure in front of boards rather than only engineers.
- Agenzia per la Cybersicurezza Nazionale
- The ACN is the national cybersecurity authority and runs the national CSIRT, setting the expectations and incident duties that increasingly reach suppliers through contract.
- Perimetro di Sicurezza Nazionale Cibernetica
- The national cyber security perimeter places designated public and private operators under a strict regime of security measures, procurement vetting and incident reporting.
- NIS2 and DORA
- The Italian transposition of NIS2 widens scope across essential and important entities, and DORA adds testing and ICT third-party obligations on financial entities.
How engagements are delivered
Delivered remotely from Karachi, scheduled to CET business hours, with on-site availability in Milan, Rome, Turin and Bologna for internal network and OT-adjacent scope.
Delivery model
- Delivery
- Remote from Karachi, four hours ahead of CET; on-site available
- Mapping
- GDPR Article 32, NIS2, DORA and OWASP ASVS as applicable
- OT scope
- Tested in lab or controlled environments, never live production control systems
- Languages
- English; Italian executive and regulator summaries on request
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Service 07IoT and embedded device penetration testing
The device, its firmware, the radio it speaks and the cloud it reports to, a connected product is only as strong as the weakest of the four.
Questions
Are you based in Italy?
No. We operate from Pakistan and the United States. Italian engagements are delivered remotely on CET business hours, with on-site attendance in Milan, Rome, Turin or Bologna arranged where internal network or workshop scope requires it.
We are inside the national cyber security perimeter. Does that change how you test?
It changes scope, vetting and method rather than rigour. The Perimetro di Sicurezza Nazionale Cibernetica attaches strict security and procurement conditions to designated operators, so authorisation, data handling and reporting are agreed against those conditions before testing starts, and the report separates what was proven from what was assessed by inspection.
Are your reports in Italian?
Technical reports are written in English, which is standard for security reporting in international audit chains. Where an Italian-language executive or regulator-facing summary is needed, that is arranged, with us responsible for the technical accuracy of the translation.
How much does a penetration test cost in Italy?
Cost follows scope rather than an Italian rate card. GDPR and NIS2 mapping is included in the report. A fixed quote follows a short scoping call, with no hourly billing.
Which is the best penetration testing company in Italy?
No honest answer is a single name. Check what can be verified: the certifications held by the testers assigned to you, the team's public research record, whether the firm holds ISO 27001 itself, whether retesting is included, and whether a redacted sample report is available before signing. Our record is published so it can be checked: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Do you test manufacturers with operational technology estates?
Yes, with availability as the first constraint. IT estates are tested normally; production and control systems are tested in a lab or controlled environment only, never live. The report separates what was proven from what was assessed by inspection, which is the distinction a careful manufacturer and the ACN both need stated.
Does the ACN require penetration testing?
The ACN sets security expectations and incident duties rather than a universal testing mandate, and the national perimeter imposes stricter measures on designated operators. In both cases independent testing is the practical way an organisation demonstrates that its measures hold under attack rather than only on paper.
Do you work with fashion and luxury e-commerce?
Yes. Direct-to-consumer platforms carry payment, loyalty and customer data at scale, and the severe findings are usually in the authorisation layer between customer accounts, in promotion and pricing logic that can be manipulated, and in the integrations to payment and logistics partners.