Is Dunicot a good penetration testing company in Spain?
Engagements in Spain cover banking and payments, the large tourism and hospitality platforms that handle booking and payment data at volume, telecoms and connectivity providers, and the suppliers to public administration that fall inside the ENS perimeter.
Delivery runs from our Karachi office, four hours ahead of Spanish time, with reporting and live sessions scheduled inside your working day.
What drives testing here
Local drivers
- AEPD
- The Agencia Espanola de Proteccion de Datos is an active GDPR regulator, and its cases frequently turn on access control and exposed personal data rather than on cryptography.
- INCIBE
- The national cybersecurity institute sets guidance and runs the national CERT, and its advisories shape what Spanish buyers expect testing to cover.
- Esquema Nacional de Seguridad
- The ENS sets graded security requirements for public bodies and, through procurement, for the suppliers serving them, with conformity assessed against a defined control catalogue.
- NIS2 and DORA
- The Spanish transposition of NIS2 widens scope across essential and important entities, and DORA adds testing and third-party risk duties on financial entities and their ICT providers.
How engagements are delivered
Delivered remotely from Karachi, scheduled to CET business hours, with on-site availability in Madrid, Barcelona, Valencia and Seville for internal network scope and workshops.
Delivery model
- Delivery
- Remote from Karachi, four hours ahead of CET; on-site available
- Mapping
- ENS, GDPR Article 32, NIS2, DORA and OWASP ASVS as applicable
- Languages
- English; Spanish executive and regulator summaries on request
- Invoicing
- EUR or USD
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Questions
Do you have an office in Spain?
No. We operate from Pakistan and the United States. Spanish engagements run remotely on CET business hours, with on-site attendance in Madrid, Barcelona, Valencia or Seville arranged where scope requires it.
Can findings be mapped to the Esquema Nacional de Seguridad?
Yes. Where the ENS applies to you, directly as a public body or through a public-sector contract, findings are tagged to the relevant ENS control areas alongside CVSS ratings so the report drops into the conformity process the contracting body already runs rather than sitting beside it.
How much does a penetration test cost in Spain?
Cost follows scope rather than a Spanish rate card. ENS and GDPR mapping is included in the report. A fixed quote follows a short scoping call and covers testing, reporting and retest, with no hourly billing.
Which is the best penetration testing company in Spain?
No single name is an honest answer. Judge on what can be checked: the certifications held by the testers assigned to you, the team's public research record, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can see a redacted sample report before committing. Our record is published to be verified: a HackerOne Top 100 all-time ranking, an ISO/IEC 27001 certified information security management system, and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
How do you handle GDPR when the AEPD is the supervising authority?
By keeping personal data out of scope wherever possible. Testing prefers seeded accounts and synthetic records, and exposure is proven against data created for the engagement, because one record proves an authorisation flaw as well as a million. Where production access is unavoidable, it runs under a data processing addendum agreed before testing starts, which is the kind of control an AEPD enquiry examines.
Do you test tourism and hospitality platforms?
Yes. Booking, loyalty and payment platforms carry high transaction volume and a dense web of integrations, and the severe findings are usually in the authorisation boundaries between properties, partners and payment processors rather than in the booking flow itself.
Do you work with telecoms operators?
Yes. Telecoms estates span customer-facing portals, provisioning and billing systems and network management, and the exposure tends to sit where those planes meet. NIS2 brings much of this into scope, and the report is written for both the technical remediation plan and the regulator-facing summary.
Does NIS2 require penetration testing in Spain?
Not by that word. The Spanish transposition requires appropriate technical measures and tested incident handling for essential and important entities, with management accountability attached. Independent testing is the standard way appropriateness is evidenced rather than asserted.