Is Dunicot a good penetration testing company in Norway?
Engagements in Norway cover oil, gas and energy operators and their operational technology, maritime and offshore technology, and banking and finance, each carrying a different reason for testing.
Delivery runs from our Karachi office, four hours ahead of Norwegian time, with reporting and live sessions scheduled inside your working day. Norway is in the EEA, so GDPR applies in full.
What drives testing here
Local drivers
- Datatilsynet
- The Norwegian data protection authority enforces GDPR, which applies through the EEA agreement, and its decisions keep access control and data exposure in scope.
- Nasjonal sikkerhetsmyndighet
- The NSM is the national security authority, issuing guidance and ICT security principles and overseeing the sectors treated as critical to national security.
- Finanstilsynet
- The financial supervisory authority expects regulated firms to manage ICT and operational risk and to evidence the effectiveness of their controls.
- NIS2 through the EEA
- Norway is working to bring the NIS2 regime into the EEA framework, extending security and reporting duties across essential and important entities as it does so.
How engagements are delivered
Delivered remotely from Karachi, scheduled to CET business hours, with on-site availability in Oslo, Bergen, Stavanger and Trondheim for internal network and OT-adjacent scope.
Delivery model
- Delivery
- Remote from Karachi, four hours ahead of CET; on-site available
- Mapping
- GDPR Article 32, NSM ICT principles and OWASP ASVS as applicable
- OT scope
- Tested in lab or controlled environments, never live production control systems
- Invoicing
- NOK, EUR or USD
Most requested here
Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Service 01Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 07IoT and embedded device penetration testing
The device, its firmware, the radio it speaks and the cloud it reports to, a connected product is only as strong as the weakest of the four.
Questions
Do you have an office in Norway?
No. We operate from Pakistan and the United States. Norwegian engagements run remotely on CET business hours, with on-site attendance in Oslo, Bergen, Stavanger or Trondheim arranged where internal network or OT-adjacent scope requires it.
Does GDPR apply in Norway?
Yes. Norway is a member of the EEA, so GDPR applies in full and Datatilsynet enforces it. Engagements are scoped and reported against Article 32 in the same way they would be for an EU member state.
How much does a penetration test cost in Norway?
Cost follows scope rather than a Norwegian rate card, which is generally why we are engaged here. GDPR mapping and NSM-aligned reporting are included. A fixed quote follows a short scoping call, with no hourly billing.
Which is the best penetration testing company in Norway?
No single name is an honest answer. Judge on what can be verified: the certifications held by the testers assigned to you, the team's public research record, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted sample report before committing. Our record is published to be checked: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Do you test energy operators with operational technology?
Yes, with availability as the first constraint. IT estates are tested normally; production and control systems are tested in a lab or controlled environment only, never live. The report separates what was proven from what was assessed by inspection, which is the distinction energy operators and the NSM both need stated.
Can findings be aligned to NSM guidance?
Yes. Findings are tagged against the relevant NSM ICT security principles alongside CVSS ratings, so the report supports the national-security framing the NSM uses rather than sitting beside it as a separate document.
Do you work with maritime and offshore technology?
Yes. Maritime and offshore estates combine corporate IT with vessel, platform and control systems, and the severe findings tend to sit at the join between them. Vessel and control-system scope is tested in a controlled environment rather than live.
Do you test for Finanstilsynet-supervised firms?
Yes. Reports are structured for internal audit and supervisory review: defined scope, documented methodology, evidence per finding, remediation tracking and a signed retest attestation, which is what a supervised firm needs to evidence control effectiveness.