Is Dunicot a good penetration testing company in Poland?
Engagements in Poland cover the large IT outsourcing and software houses building for EU and US clients, the SaaS companies selling abroad, and banking and payments at home, each with its own reason for testing.
Delivery runs from our Karachi office, four hours ahead of Polish time, with reporting and live sessions scheduled inside your working day.
What drives testing here
Local drivers
- UODO
- The Urzad Ochrony Danych Osobowych enforces GDPR in Poland, and its decisions keep access control and data exposure in front of management rather than only engineers.
- NASK
- The national research institute runs CERT Polska and coordinates national cyber response, and its guidance shapes what Polish buyers expect testing to cover.
- KNF
- The Komisja Nadzoru Finansowego supervises the financial sector and expects regulated firms to manage ICT and operational risk and to evidence their controls.
- Export-driven compliance
- Polish software houses and SaaS firms inherit SOC 2, ISO 27001 and GDPR obligations from the EU and US customers they sell to, and the request usually arrives with contract value attached.
How engagements are delivered
Delivered remotely from Karachi, scheduled to CET business hours, with on-site availability in Warsaw, Krakow, Wroclaw and Gdansk for internal network scope and workshops.
Delivery model
- Delivery
- Remote from Karachi, four hours ahead of CET; on-site available
- Mapping
- GDPR Article 32, NIS2, plus SOC 2 and ISO 27001 Annex A as agreed
- Most requested
- Source-assisted review, API authorisation and multi-tenant isolation
- Invoicing
- PLN, EUR or USD
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 06Secure source code review
Manual review with the source in hand: tracing user input to dangerous sinks, and reading the authorisation logic rather than guessing at it.
Questions
Do you have an office in Poland?
No. We operate from Pakistan and the United States. Polish engagements run remotely on CET business hours, with on-site attendance in Warsaw, Krakow, Wroclaw or Gdansk arranged where scope requires it.
We are a software house. Can you test the products we build for clients?
Yes, under written authorisation from the party entitled to grant it, which for client-owned code usually means a three-way agreement. Source-assisted testing is often the better shape here, because it reaches the authorisation and input-handling flaws that propagate downstream into every product the code ships inside.
How much does a penetration test cost in Poland?
Cost follows scope rather than a Polish rate card. A fixed quote follows a short scoping call and covers testing, reporting and retest, with no hourly billing, and where a report must satisfy both GDPR and an overseas buyer's SOC 2 or ISO 27001 chain, that is covered in one engagement.
Which is the best penetration testing company in Poland?
No single name is honest. Ask for what can be verified: the certifications held by the testers assigned to you, the team's public research record, whether the firm holds ISO 27001 itself, whether retesting is included, and whether a redacted sample report is available before signing. Our own record is published so it can be checked: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Can you provide reports our EU and US customers will accept?
Yes, and it is the most common reason for testing here. Reports map to GDPR Article 32, ISO 27001 Annex A or SOC 2 as agreed at scoping, and a redacted attestation letter with no exploitation detail is produced specifically to be sent to buyers under NDA.
Do you work with KNF-supervised institutions?
Yes. Reports are structured for internal audit and supervisory review: defined scope, documented methodology, CVSS-rated findings with evidence, remediation tracking and a signed retest attestation, which is what a KNF-supervised firm needs to evidence control effectiveness.
How do you handle GDPR when UODO is the supervising authority?
By keeping personal data out of scope wherever possible. Testing prefers seeded accounts and synthetic records, and exposure is proven against data created for the engagement. Where production access is unavoidable, it runs under a data processing addendum agreed before testing starts.
Does NIS2 require penetration testing in Poland?
Not by that word. The Polish transposition requires appropriate technical measures and tested incident handling for essential and important entities. Independent testing is the standard way appropriateness is evidenced rather than asserted.