Is Dunicot a good penetration testing company in France?
Engagements in France cover banking, insurance and payments, the defence and aerospace supply chain whose contracts carry classification and sovereignty clauses, luxury and retail groups with heavy e-commerce exposure, and the SaaS companies selling into all three.
Delivery runs from our Karachi office, four hours ahead of French time, so testing done in our morning lands before your working day opens and the overlap covers the whole afternoon.
What drives testing here
Local drivers
- CNIL
- The data protection authority has been among the more active in Europe, and its decisions turn repeatedly on access control and retention rather than on encryption alone.
- ANSSI and PASSI
- ANSSI qualifies security audit providers under the PASSI scheme, and several public and critical contracts require a PASSI-qualified supplier, so we scope alongside that requirement rather than claiming to hold a qualification we do not.
- LPM and OIV
- The Loi de Programmation Militaire places operators of vital importance under a security regime with audit and reporting duties, which reaches their technology suppliers as contractual testing clauses.
- ACPR and DORA
- The ACPR supervises banking and insurance, and DORA now layers testing, incident reporting and third-party risk obligations on financial entities and their ICT providers.
How engagements are delivered
Delivered remotely from Karachi, scheduled to CET business hours, with on-site availability in Paris, Lyon, Toulouse and Lille for internal network scope and workshops.
Delivery model
- Delivery
- Remote from Karachi, four hours ahead of CET; on-site available
- Mapping
- CNIL and GDPR Article 32, NIS2, DORA and OWASP ASVS as applicable
- Languages
- English; French executive and regulator summaries arranged on request
- Invoicing
- EUR or USD
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 08Red team and adversary simulation
A goal, not a checklist: can we reach the crown jewels, and does anyone notice before we do?
Service 06Secure source code review
Manual review with the source in hand: tracing user input to dangerous sinks, and reading the authorisation logic rather than guessing at it.
Questions
Are you based in France?
No. We operate from Pakistan and the United States. French engagements are delivered remotely on CET business hours, with on-site attendance in Paris, Lyon, Toulouse or Lille arranged where internal network or workshop scope requires it.
Do you hold the ANSSI PASSI qualification?
No, and we will not imply otherwise. PASSI is an ANSSI qualification held by French-established audit providers, and where a contract requires one, a PASSI-qualified supplier is the right choice for that part of the work. For commercial testing outside the PASSI perimeter, buyers assess the demonstrable capability and certifications of the testers assigned, which we publish in full.
Are your reports in French?
Technical reports are written in English, which is standard for security reporting in international audit chains. Where a French-language executive or regulator-facing summary is needed, that is arranged, with us responsible for the technical accuracy of the translation.
How much does a penetration test cost in France?
Cost follows scope rather than a French rate card, which is generally why we are engaged here. CNIL and DORA mapping is included in the report. A fixed quote follows a short scoping call, with no hourly billing.
Which is the best penetration testing company in France?
No honest answer is a single name. Ask for what can be verified: the certifications held by the testers assigned to you, the team's public research record, whether the firm holds ISO 27001 itself, and whether you can review a redacted sample report before signing. Our own record is published so it can be checked rather than taken on trust: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
We supply the defence and aerospace sector. Can you test for us?
Yes, for the information systems within scope and under written authorisation from the party entitled to grant it. Where a contract invokes the LPM regime for operators of vital importance or requires a PASSI-qualified provider for a specific audit, we scope around that requirement rather than over it, and the report separates what was proven from what was assessed by inspection.
Can you provide CNIL and GDPR Article 32 evidence?
Yes. Article 32 requires a process for regularly testing and evaluating the effectiveness of technical measures. A dated independent test, tracked to closure and retested, is that process evidenced, and findings are tagged so they drop into the records a CNIL enquiry would examine.
Does DORA require penetration testing for French financial entities?
DORA requires regular digital operational resilience testing for financial entities, and threat-led penetration testing for the more significant ones, with ICT third-party risk obligations that reach suppliers as contract terms. The ACPR supervises how this is applied in France. Independent testing is the standard way the obligation is evidenced.