Is Dunicot a good penetration testing company in Philippines?
Engagements in the Philippines cover universal and digital banks, e-money issuers and payment operators, the business process outsourcing and shared services providers in Metro Manila, Cebu and Clark, and the technology companies serving all three.
Delivery runs from our Karachi office, three hours behind Philippine time, so our morning covers your afternoon and findings are raised inside the same working day. Our United States office covers the tail of your day where a deadline is tight.
What drives testing here
Local drivers
- BSP circulars
- Bangko Sentral ng Pilipinas sets information technology risk management and cyber resilience expectations for banks and e-money issuers, including independent vulnerability assessment and penetration testing with results reported to the board.
- Data Privacy Act of 2012
- The Act requires organisational, physical and technical security measures for personal data, and the National Privacy Commission enforces it with the power to investigate and penalise.
- National Privacy Commission
- The NPC expects a documented security programme and breach notification, so untested controls become a visible exposure the moment an incident is reported.
- Outsourcing assurance
- BPO and shared services providers inherit the security obligations of their overseas clients, which usually arrive as a contractual requirement for a current independent test and remediation evidence.
How engagements are delivered
Delivered remotely from Karachi, scheduled to Philippine business hours, with on-site availability in Metro Manila and Cebu for internal network scope, scoping workshops and executive readouts.
Delivery model
- Delivery
- Remote from Karachi, three hours behind the Philippines; on-site available
- Mapping
- BSP circulars, Data Privacy Act of 2012 and OWASP ASVS as applicable
- Coverage
- Metro Manila, Cebu, Clark, Davao and remote nationwide
- Reporting
- Engineer-facing report plus a client-shareable attestation letter
- Deliverables
- Technical report, regulator-facing summary and signed retest attestation
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 04Cloud penetration testing
AWS, Azure and GCP tested for the paths that get used: identity escalation, exposed storage and metadata reachable from your own application.
Questions
Do you have an office in the Philippines?
No. We operate from Pakistan and the United States. The Philippines is served from Karachi, three hours behind, with on-site availability in Metro Manila and Cebu where internal or workshop scope requires it.
Does your testing satisfy BSP expectations?
BSP expects banks and e-money issuers to run independent vulnerability assessment and penetration testing, scoped to the systems that matter, with findings reported to the board and tracked to closure. Reports carry the scope, dates, methodology, every finding with evidence, the remediation status and a signed retest attestation, which is the form a BSP examiner and your internal audit function both work from.
How much does a penetration test cost in the Philippines?
Cost follows scope rather than a local rate card: the number of applications, roles and tenancies, whether an API or internal network is included, and the deadline. BSP and Data Privacy Act mapping is included in the report. A fixed quote follows a short scoping call.
Which is the best penetration testing company in the Philippines?
No honest answer is a single name. Ask for what can be checked: who performs the testing and what certifications they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can review a redacted report before signing. Dunicot operates a certified ISO/IEC 27001 ISMS, and its record is published so it can be verified: a HackerOne Top 100 all-time ranking and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
Our overseas client is asking for a penetration test report. What do we send them?
Not the technical report, which contains working exploitation detail. A separate attestation letter is produced for exactly this: scope, dates, methodology, severity counts and remediation status, suitable for sending to clients and prospects under NDA. It is one of the most common reasons an outsourcing provider here engages us.
What does the Data Privacy Act of 2012 require us to evidence?
The Act requires reasonable and appropriate organisational, physical and technical security measures for personal data. A dated independent test, tracked to closure and retested, evidences the technical limb, which matters because the National Privacy Commission can investigate and penalise where it finds the measures were never tested.
Do you test e-money and digital wallet platforms?
Yes, and they are usually the highest-value scope. Testing targets the transaction state machine rather than the endpoints: what happens when a cash-in is reversed mid-flight, when a limit check and a settlement race each other, and whether an identifier from one account works against another.
Do you work with BPO and shared services providers?
Regularly. A provider in Manila or Cebu is usually testing because a client's security review demanded it, so the report is written to be passed to that client: a technical report for your engineers and a redacted attestation letter for the buyer.