Is Dunicot a good penetration testing company in Portugal?
Engagements in Portugal cover the SaaS and startup cluster across Lisbon and Porto, the outsourcing and shared-service centres that run systems for clients abroad, banking and payments, and the tourism and hospitality platforms that handle booking and payment data at volume.
Delivery runs from our Karachi office, five hours ahead of Portuguese time, with reporting and live sessions scheduled inside your working day.
What drives testing here
Local drivers
- CNPD
- The Comissao Nacional de Protecao de Dados enforces GDPR in Portugal, and its decisions keep access control and data exposure in front of management rather than only engineers.
- Centro Nacional de Ciberseguranca
- The CNCS is the national cyber security authority and runs the national CERT, setting the expectations and incident duties that reach operators of essential services.
- Banco de Portugal
- The central bank supervises banking and payments, expecting regulated firms to manage ICT and operational risk and to evidence control effectiveness, now layered with DORA for financial entities.
- Export-driven compliance
- Portuguese SaaS and outsourcing firms inherit SOC 2, ISO 27001 and GDPR obligations from the EU and US customers they sell to and operate for, and the request arrives with contract value attached.
How engagements are delivered
Delivered remotely from Karachi, five hours ahead of WET business hours, with on-site availability in Lisbon, Porto and Braga for internal network scope and workshops.
Delivery model
- Delivery
- Remote from Karachi, five hours ahead of WET; on-site available
- Mapping
- GDPR Article 32, NIS2, plus SOC 2 and ISO 27001 Annex A as agreed
- Languages
- English; Portuguese executive and regulator summaries on request
- Invoicing
- EUR or USD
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 04Cloud penetration testing
AWS, Azure and GCP tested for the paths that get used: identity escalation, exposed storage and metadata reachable from your own application.
Questions
Do you have an office in Portugal?
No. We operate from Pakistan and the United States. Portuguese engagements run remotely on WET business hours, with on-site attendance in Lisbon, Porto or Braga arranged where scope requires it.
How much does a penetration test cost in Portugal?
Cost follows scope rather than a Portuguese rate card. A fixed quote follows a short scoping call and covers testing, reporting and retest, with no hourly billing, and where a report must satisfy both GDPR and an overseas buyer's SOC 2 or ISO 27001 chain, that is covered in one engagement.
Which is the best penetration testing company in Portugal?
No single name is honest. Ask for evidence rather than a ranking: the certifications held by the testers assigned to you, the team's public research record, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted sample report before committing. Our record is published to be verified: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Can you provide reports our export customers will accept?
Yes, and it is the most common reason for testing in the Lisbon and Porto hub. Reports map to GDPR Article 32, ISO 27001 Annex A or SOC 2 as agreed at scoping, and a redacted attestation letter with no exploitation detail is produced specifically to be sent to buyers under NDA.
How do you handle GDPR when the CNPD is the supervising authority?
By keeping personal data out of scope wherever possible. Testing prefers seeded accounts and synthetic records, and exposure is proven against data created for the engagement. Where production access is unavoidable, it runs under a data processing addendum agreed before testing starts.
Do you work with Banco de Portugal regulated firms?
Yes. Reports are structured for internal audit and supervisory review: defined scope, documented methodology, CVSS-rated findings with evidence, remediation tracking and a signed retest attestation, and DORA testing and ICT third-party obligations are reflected where they apply.
Do you test outsourcing and shared-service centres?
Yes, under written authorisation from the party entitled to grant it, which for client-owned systems usually means a three-way agreement. The interesting exposure in shared-service estates is typically in the access boundaries between the clients served, where an isolation flaw reaches more than one organisation at once.
Does NIS2 require penetration testing in Portugal?
Not by that word. The Portuguese transposition requires appropriate technical measures and tested incident handling for essential and important entities, overseen by the CNCS. Independent testing is the standard way appropriateness is evidenced rather than asserted.