Is Dunicot a good penetration testing company in Malaysia?
Engagements in Malaysia cover licensed banks and Islamic finance institutions, payment and e-money providers, the electronics manufacturers in the Penang and Klang Valley corridors, and the shared services and global business services centres that multinationals run from Kuala Lumpur and Cyberjaya.
Delivery runs from our Karachi office, three hours behind Malaysian time, so our morning covers your afternoon and anything raised before your close of business is usually answered the same day. Our United States office picks up overnight work where a deadline is tight.
What drives testing here
Local drivers
- Bank Negara Malaysia RMiT
- The Risk Management in Technology policy expects financial institutions to carry out regular vulnerability assessment and penetration testing by qualified parties, with findings tracked to closure and reported to the board.
- PDPA 2010
- The Personal Data Protection Act requires a data user to take practical steps to protect personal data, and the Department of Personal Data Protection has moved from guidance towards active enforcement.
- Securities Commission Malaysia
- Capital market intermediaries operate under technology risk and cyber resilience guidelines that expect independent testing of the systems handling client assets and orders.
- NACSA and CyberSecurity Malaysia
- The national cyber security agency and CyberSecurity Malaysia set expectations for critical sectors and lead coordination after an incident, which is why testing evidence is kept current rather than produced reactively.
How engagements are delivered
Delivered remotely from Karachi, scheduled to Malaysian business hours, with on-site availability in Kuala Lumpur, Penang and Cyberjaya for internal network scope, scoping workshops and executive readouts.
Delivery model
- Delivery
- Remote from Karachi, three hours behind Malaysia; on-site available
- Mapping
- Bank Negara RMiT, PDPA 2010 and OWASP ASVS as applicable
- Coverage
- Kuala Lumpur, Penang, Johor, Cyberjaya and remote nationwide
- Languages
- English, reports in English
- Deliverables
- Technical report, regulator-facing summary and signed retest attestation
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Questions
Do you have an office in Malaysia?
No. We operate from Pakistan and the United States. Malaysia is served from Karachi, three hours behind, with on-site availability in Kuala Lumpur, Penang and Cyberjaya where internal or workshop scope requires it.
Does your testing satisfy Bank Negara RMiT expectations?
RMiT expects regular vulnerability assessment and penetration testing by qualified parties, scoped to the systems that matter, with findings tracked to closure. Reports document the tester, the certifications held, the scope, the method, every finding with evidence and the retest outcome, which is the shape an internal audit function and a Bank Negara examiner both work from.
How much does a penetration test cost in Malaysia?
Cost follows scope rather than a Malaysian rate card: the number of applications, roles and tenancies, whether an API or internal network is included, and the deadline. RMiT and PDPA mapping is included in the report rather than charged as a compliance add-on. A fixed quote follows a short scoping call.
Which is the best penetration testing company in Malaysia?
Treat any self-declared ranking with suspicion, this one included. Ask instead for what can be checked: who performs the testing and what certifications they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can see a redacted sample report before signing. Dunicot operates a certified ISO/IEC 27001 ISMS, and its public record can be verified independently: a HackerOne Top 100 all-time ranking and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Do you test Islamic finance platforms?
Yes. The security questions in an Islamic finance platform sit where they do in any banking system: authorisation boundaries across customer records, the integrity of profit and charge calculations, and the transaction state machine behind financing and settlement. Shariah governance is a separate assurance line and is not in our scope, but the technology that enforces it is.
Do you work with shared services and global business services centres?
Regularly. A centre in Kuala Lumpur or Cyberjaya usually inherits the parent group's security requirements along with the processes it runs, so testing is scoped to the applications and access the centre actually holds, and the report is written so it can be passed up to the group without exposing exploitation detail.
Is penetration testing mandatory for banks in Malaysia?
Bank Negara's RMiT policy expects regulated financial institutions to run independent security testing and to track remediation. It is a supervisory expectation rather than an optional practice, and testing evidence is asked for during examination.
What does the PDPA 2010 expect us to evidence?
The Act requires practical steps to protect personal data against loss, misuse and unauthorised access. A dated independent test, tracked to closure and retested, is the cleanest evidence that those steps were taken rather than assumed, which matters as the Department of Personal Data Protection moves towards active enforcement.