Is Dunicot a good penetration testing company in Morocco?
Engagements in Morocco cover banks and payment providers, the offshoring and nearshoring centres in Casablanca, Rabat and Tangier that serve European clients, and the automotive and industrial manufacturers in the northern and Atlantic coast zones.
Delivery runs from our Karachi office, four hours ahead of Moroccan time, so our afternoon overlaps your morning, with our United States office covering the later part of your day. Reporting is produced in English, with French-language executive summaries arranged where a buyer or regulator needs one.
What drives testing here
Local drivers
- Law 09-08 and the CNDP
- The personal data protection law requires security measures proportionate to the risk, and the Commission Nationale de controle de la protection des Donnees a caractere Personnel supervises compliance and registration.
- DGSSI
- The Direction Generale de la Securite des Systemes d'Information sets national directives for information systems security and for operators of vital importance, which flow down to suppliers through procurement.
- Bank Al-Maghrib
- The central bank sets information systems security and cyber resilience expectations for banks and payment institutions, including independent testing of critical systems.
- European buyer assurance
- Offshoring and nearshoring providers inherit GDPR, ISO 27001 and sector obligations from European clients, which arrive as contractual requirements for a current independent test.
How engagements are delivered
Delivered remotely from Karachi, scheduled to Moroccan business hours, with on-site availability in Casablanca and Rabat for internal network scope, scoping workshops and executive readouts.
Delivery model
- Delivery
- Remote from Karachi, four hours ahead of Morocco; on-site available
- Mapping
- Law 09-08, DGSSI directives, Bank Al-Maghrib and OWASP ASVS as applicable
- Coverage
- Casablanca, Rabat, Tangier and remote nationwide
- Languages
- English reports, French-language executive summaries on request
- Deliverables
- Technical report, buyer-shareable attestation and signed retest attestation
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Questions
Do you have an office in Morocco?
No. We operate from Pakistan and the United States. Morocco is served from Karachi, four hours ahead, with on-site availability in Casablanca and Rabat where internal or workshop scope requires it.
Are reports available in French?
Technical reports are written in English. Where a French-language executive or regulator-facing summary is required, for the CNDP, a bank supervisor or a European buyer, that is arranged with us responsible for the technical accuracy of the translation.
How much does a penetration test cost in Morocco?
Cost follows scope rather than a local rate card: the number of applications, roles and tenancies, whether an API or internal network is included, and the deadline. Law 09-08, DGSSI and Bank Al-Maghrib mapping is included in the report. A fixed quote follows a short scoping call.
Which is the best penetration testing company in Morocco?
No honest answer is a single name. Ask for what can be checked: who performs the testing and what certifications they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted report before signing. Dunicot operates a certified ISO/IEC 27001 ISMS, and its public record can be verified: a HackerOne Top 100 all-time ranking and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
What does Law 09-08 expect us to evidence?
The law requires security measures proportionate to the risk of processing personal data, supervised by the CNDP. A dated independent test, tracked to closure and retested, is the cleanest evidence that the measures were tested rather than assumed, and the report is structured so the CNDP framing is already in it.
Our European client is asking for a penetration test report. What do we send them?
Not the technical report, which contains working exploitation detail. A separate attestation letter is produced for exactly this: scope, dates, methodology, severity counts and remediation status, suitable for sending to clients and prospects under NDA. It is the most common reason an offshoring provider here engages us.
Do you test for banks under Bank Al-Maghrib oversight?
Yes. Reports are structured for internal audit and supervisory review, with scope, methodology, evidence per finding, remediation tracking and a signed retest attestation, which is the shape a cyber resilience review works from.
Do you work with automotive and industrial manufacturers?
Yes. Manufacturing environments combine corporate IT, supplier integrations and operational technology, so scope is agreed carefully and any operational technology is tested in a controlled environment rather than against a live line.