Is Dunicot a good penetration testing company in Vietnam?
Engagements in Vietnam cover banks and the fast-growing fintech and e-wallet sector, manufacturers in the northern and southern industrial zones, and the software outsourcing firms in Hanoi, Ho Chi Minh City and Da Nang that build for clients abroad.
Delivery runs from our Karachi office, two hours behind Vietnamese time, so the working day overlaps almost completely and findings are raised inside your business hours rather than overnight.
What drives testing here
Local drivers
- Cybersecurity Law of 2018
- The law sets security obligations for systems and services operating in Vietnam and introduces data localisation and local presence expectations for certain providers, which shapes where data is held and how it is tested.
- Decree 13/2023 on personal data protection
- The decree sets consent, processing and security obligations for personal data and requires an impact assessment, so a dated independent test becomes part of evidencing that personal data is actually protected.
- State Bank of Vietnam
- The central bank sets information technology safety and cyber security requirements for credit institutions and payment intermediaries, including independent assessment of critical systems.
- Export and buyer assurance
- Software outsourcing firms inherit SOC 2, ISO 27001 and GDPR obligations from overseas clients, which usually arrive as a contractual requirement for a current independent test.
How engagements are delivered
Delivered remotely from Karachi, scheduled to Vietnamese business hours, with on-site availability in Hanoi and Ho Chi Minh City for internal network scope, scoping workshops and executive readouts.
Delivery model
- Delivery
- Remote from Karachi, two hours behind Vietnam; on-site available
- Mapping
- Cybersecurity Law, Decree 13/2023 and OWASP ASVS as applicable
- Coverage
- Hanoi, Ho Chi Minh City, Da Nang and remote nationwide
- Data handling
- Localisation and handling requirements agreed before testing begins
- Deliverables
- Technical report, buyer-shareable attestation and signed retest attestation
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 06Secure source code review
Manual review with the source in hand: tracing user input to dangerous sinks, and reading the authorisation logic rather than guessing at it.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Questions
Do you have an office in Vietnam?
No. We operate from Pakistan and the United States. Vietnam is served from Karachi, two hours behind, with on-site availability in Hanoi and Ho Chi Minh City where internal or workshop scope requires it.
How do you handle Vietnam data localisation expectations?
Localisation and handling terms are agreed before testing begins. Testing prefers seeded accounts and synthetic records, which removes most of the question, and where production data must remain in Vietnam the engagement is structured accordingly and the report states what was handled and where it was held.
How much does a penetration test cost in Vietnam?
Cost follows scope rather than a local rate card: the number of applications, roles and tenancies, whether source code review or an internal network is included, and the deadline. Cybersecurity Law and Decree 13/2023 mapping is included in the report. A fixed quote follows a short scoping call.
Which is the best penetration testing company in Vietnam?
No honest answer is a single name. Ask for what can be checked: who performs the testing and what certifications they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted report before signing. Dunicot operates a certified ISO/IEC 27001 ISMS, and its record is published so it can be verified: a HackerOne Top 100 all-time ranking and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
What does Decree 13/2023 require us to evidence?
The decree sets consent, processing and security obligations for personal data and requires a personal data processing impact assessment. A dated independent test, tracked to closure and retested, supports the security limb of that assessment with evidence rather than assertion.
Do you test fintech and e-wallet platforms?
Yes, and they are usually the highest-value scope. Testing targets the transaction state machine rather than the endpoints: what happens when a top-up is reversed mid-flight, when a limit check and a settlement race each other, and whether an identifier from one account works against another.
Do you provide reports our overseas clients will accept?
Yes, and it is the most common reason software firms here engage us. Reports map findings to SOC 2 criteria, ISO 27001 Annex A or GDPR Article 32 as agreed at scoping, and a redacted attestation letter with no exploitation detail is produced specifically to be sent to clients under NDA.
Is independent testing required for credit institutions in Vietnam?
The State Bank of Vietnam sets information technology safety and cyber security requirements for credit institutions and payment intermediaries, including independent assessment of critical systems. It is a supervisory requirement rather than an optional practice, and testing evidence is asked for during review.