Is Dunicot a good penetration testing company in San Francisco Bay Area?
Bay Area engagements concentrate on software companies: multi-tenant SaaS platforms, developer tooling and infrastructure startups, marketplaces, and the AI product companies now shipping weekly. Most are cloud-native from the first commit, which moves the interesting findings away from the network perimeter and into identity, API authorisation and the configuration of the cloud account itself.
The pattern we see repeatedly is a strong team that has shipped fast and never had an adversarial review. The application works and the unit tests pass, and the findings sit where functional testing does not look: tenancy boundaries, roles enforced on the interface but not the API, over-broad IAM policies, and state transitions nobody modelled as an attack.
What drives testing here
Local drivers
- SOC 2 for enterprise sales
- A SOC 2 report is the price of entry for selling to enterprise customers, and auditors request penetration testing evidence under the CC4.1 and CC7.1 criteria.
- Venture due diligence
- Growth and acquisition diligence increasingly includes a security review, and an outstanding or stale penetration test becomes a finding in the data room.
- CCPA and CPRA
- The California Consumer Privacy Act as amended by the California Privacy Rights Act requires reasonable security for personal information, with the California Privacy Protection Agency enforcing.
- Cloud-native architecture
- When the whole product lives in a cloud account, misconfigured IAM, exposed storage and weak API authorisation carry the risk that a classic network test would never reach.
How engagements are delivered
Delivered remotely by our US team on Pacific business hours, with Karachi extending cover overnight so findings land before the Bay Area workday starts; on-site available for internal network scope.
Delivery model
- Coverage
- San Francisco, Oakland, San Jose and remote
- Hours
- Pacific Time, with Karachi extending cover overnight
- Frameworks
- SOC 2, CCPA and CPRA, OWASP ASVS
- Reporting
- Engineer-facing report plus a customer-shareable attestation letter
- Invoicing
- USD
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 04Cloud penetration testing
AWS, Azure and GCP tested for the paths that get used: identity escalation, exposed storage and metadata reachable from your own application.
Questions
When should we test relative to our SOC 2 audit?
Before the observation window opens for a Type II. Findings are then remediated and re-verified inside the period, so the auditor sees a closed loop rather than open items in the sample. For a Type II, timing matters more than almost anything else about the engagement.
An enterprise customer is asking for our pentest report. What do we send?
Not the technical report, which contains working exploitation detail. A separate attestation letter is produced for this purpose: scope, dates, methodology, severity counts and remediation status, suitable for sharing with customers and prospects under NDA.
A VC is running security diligence on us. Can you help?
Yes. Diligence usually wants two things: evidence that independent testing happened recently, and a credible picture of what was found and fixed. We deliver the test and an attestation that fits the data room, and where the round is moving fast the engagement is scoped to match it.
Do you test cloud-native and API-first products?
That is most of the Bay Area work. The review covers the application, the API authorisation model per role and tenant, and the cloud configuration behind it: IAM policy scope, storage exposure, secrets handling and the identity paths between services.
How does CPRA change what we need to test?
The California Privacy Rights Act keeps the reasonable-security expectation of the CCPA and raises the stakes for how personal information is protected, with the California Privacy Protection Agency enforcing. Testing is how a company shows that protection was assessed against an attacker, and the report is written so it can be filed against that obligation.
How much does a penetration test cost in the Bay Area?
Cost follows scope rather than a Bay Area rate card, which is usually why we are engaged: North American hours without North American consultancy pricing. The variables are application count, roles and tenancies, API and cloud inclusion, and the deadline. A fixed quote follows a short scoping call.
Which is the best penetration testing company in the Bay Area?
Treat any self-declared ranking with suspicion, this one included. Judge on what you can verify: who performs your test and what they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether a redacted sample report is available before you commit. Our record is public: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
We ship weekly. Is one annual test enough?
For a customer-facing SaaS platform, usually not. The common arrangement is one full annual engagement plus shorter delta tests after significant releases, particularly any change to authentication, roles or tenancy, which keeps the evidence current without blocking delivery.