Is Dunicot a good penetration testing company in Los Angeles?
LA engagements span an unusually wide sector mix. Entertainment and media platforms hold large personal-data estates and valuable pre-release content. The aerospace and defence supply chain around El Segundo and the South Bay carries federal contract obligations. Healthcare systems operate under HIPAA, and the San Pedro and Long Beach port and logistics operators run industrial and partner-integrated systems that reach well beyond the corporate network.
Because the sectors differ so much, the buying trigger does too. A defence supplier is testing for a CMMC assessment and the NIST 800-171 controls behind it. A studio is protecting unreleased content and the personal data of talent and staff. A hospital is satisfying the HIPAA Security Rule. The one constant is California privacy law sitting underneath all of them.
What drives testing here
Local drivers
- DFARS and CMMC
- Defence suppliers handling controlled unclassified information must meet DFARS 252.204-7012 and, increasingly, a CMMC assessment, both built on the NIST SP 800-171 control set.
- CCPA and CPRA
- California privacy law requires reasonable security for the personal information held across media, healthcare and consumer platforms, with the California Privacy Protection Agency enforcing.
- HIPAA
- LA hospital systems and healthcare technology companies fall under the Security Rule, which requires risk analysis and periodic technical evaluation of systems holding electronic protected health information.
- Ports and industrial systems
- Port, freight and logistics operators integrate corporate IT with industrial and partner systems, which widens the attack surface far past the perimeter and raises availability as a first-order concern.
How engagements are delivered
Delivered by our US team on Pacific business hours, with on-site attendance across the LA basin for internal network, industrial-adjacent and controlled-environment scope.
Delivery model
- Coverage
- Greater Los Angeles, remote and on-site
- Hours
- Pacific Time, with Karachi extending cover overnight
- Frameworks
- NIST 800-171, CMMC readiness, HIPAA, CCPA and CPRA
- OT scope
- Industrial and port systems tested in lab or controlled environments, never live
- Invoicing
- USD
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Service 04Cloud penetration testing
AWS, Azure and GCP tested for the paths that get used: identity escalation, exposed storage and metadata reachable from your own application.
Questions
We are a defence supplier preparing for CMMC. Can you help?
Yes, on the technical side. CMMC and DFARS 252.204-7012 both rest on the NIST SP 800-171 controls, and penetration testing provides the evidence that the technical controls hold under attack rather than only on paper. We do not perform the CMMC assessment itself, which an accredited assessor conducts, and we do not claim to.
How do you handle controlled unclassified information during a test?
Handling terms are agreed in writing before testing starts. We prefer seeded accounts and synthetic records over real CUI wherever the test allows, and the report states exactly what was handled and where, which the 800-171 control set expects you to be able to show.
Can you test for a studio protecting unreleased content?
Yes. The concern is usually two-sided: the personal data of talent and staff under California law, and the systems holding pre-release content. Testing covers access control, tenancy and the integrations with post-production and distribution partners, which is where content tends to leak.
How does California privacy law affect our testing?
The CCPA as amended by the CPRA requires reasonable security for personal information and the California Privacy Protection Agency enforces it. Independent testing is one of the clearer ways to show that protection was assessed against an attacker, and the report is written so it can be filed against that obligation.
How much does a penetration test cost in Los Angeles?
Cost follows scope rather than a rate card: the number of applications, roles and hosts, whether internal network or industrial-adjacent systems are included, and the assessment or audit deadline behind it. A fixed quote follows a short scoping call.
Which is the best penetration testing company in Los Angeles?
No honest answer is a single name across sectors this different. Ask what you can verify: who performs your test and what they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether a redacted sample report is available first. Our record is public: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Do you test port and logistics systems?
Yes, with availability as the first constraint. Corporate IT is tested normally; industrial, terminal and partner-integrated systems are tested in a lab or controlled environment only, never live, and the report separates what was proven from what was assessed by inspection.
Can you attend on site across the LA basin?
Yes, for internal network testing, controlled-environment work and workshops. Application, API and cloud engagements are delivered remotely, which starts faster and is equally thorough.