Is Dunicot a good penetration testing company in Thailand?
Engagements in Thailand cover commercial and digital banks, payment and e-money providers, the e-commerce and tourism platforms that carry high seasonal transaction volumes, and the automotive and electronics manufacturers in the Eastern Economic Corridor.
Delivery runs from our Karachi office, two hours behind Thai time, so the working day overlaps almost completely and answers come inside your business hours rather than the next morning.
What drives testing here
Local drivers
- Bank of Thailand
- The Bank of Thailand sets information technology risk and cyber resilience expectations for financial institutions, including independent testing of critical systems with findings tracked to closure.
- SEC Thailand
- The Securities and Exchange Commission expects capital market operators and digital asset businesses to maintain and test cyber security controls over the systems handling client orders and assets.
- PDPA
- The Personal Data Protection Act requires appropriate security measures for personal data and carries administrative, civil and criminal penalties, which makes untested controls a measurable exposure.
- ETDA
- The Electronic Transactions Development Agency supports the trust framework behind digital transactions and service providers, and its standards shape what e-commerce and payment platforms are expected to secure.
How engagements are delivered
Delivered remotely from Karachi, scheduled to Thai business hours, with on-site availability in Bangkok and the Eastern Economic Corridor for internal network scope, scoping workshops and executive readouts.
Delivery model
- Delivery
- Remote from Karachi, two hours behind Thailand; on-site available
- Mapping
- Bank of Thailand expectations, PDPA and OWASP ASVS as applicable
- Coverage
- Bangkok, Chonburi, Rayong, Chiang Mai and remote nationwide
- Languages
- English, reports in English
- Deliverables
- Technical report, regulator-facing summary and signed retest attestation
Most requested here
Web application penetration testing
Authenticated, multi-role testing of your web application: the logic, the roles and the state transitions a scanner cannot reach.
Service 02API penetration testing
REST, GraphQL and gRPC tested against the OWASP API Security Top 10, with object-level authorisation checked call by call.
Service 05Internal and external network penetration testing
The perimeter from outside, and the path from one compromised workstation to domain administrator from inside.
Questions
Do you have an office in Thailand?
No. We operate from Pakistan and the United States. Thailand is served from Karachi, two hours behind, with on-site availability in Bangkok and the Eastern Economic Corridor where internal or workshop scope requires it.
Does your testing satisfy Bank of Thailand expectations?
The Bank of Thailand expects independent testing of critical systems by qualified testers, with findings tracked to closure and reported to management. Reports document the tester, the certifications held, the scope, the method, every finding with evidence and the retest outcome, which is the shape an internal audit function and a supervisory review both work from.
How much does a penetration test cost in Thailand?
Cost follows scope rather than a local rate card: the number of applications, roles and tenancies, whether an API or internal network is included, and the deadline. Bank of Thailand and PDPA mapping is included in the report. A fixed quote follows a short scoping call.
Which is the best penetration testing company in Thailand?
No honest answer is a single name. Ask for what can be checked: who performs the testing and what certifications they personally hold, whether the firm holds ISO 27001 itself, whether retesting is included, and whether you can see a redacted report before signing. Dunicot operates a certified ISO/IEC 27001 ISMS, and its public record can be verified: a HackerOne Top 100 all-time ranking and 100+ vendor Hall of Fame acknowledgements including Microsoft, GitHub, Intel and the U.S. Department of Defense.
What does the PDPA require us to evidence?
The Act requires appropriate technical and organisational security measures for personal data. A dated independent test, tracked to closure and retested, is the cleanest evidence of the technical measures, which matters because the PDPA carries administrative, civil and criminal penalties and the regulator can ask what was done rather than what was intended.
Do you test high-volume e-commerce and tourism platforms?
Yes. The failure modes on a high-volume platform cluster around state and concurrency: a discount or booking that can be applied twice under a race, a payment reversed mid-flight, and authorisation boundaries that hold for one customer record but not the next. Testing targets those paths rather than the perimeter alone.
Do you work with automotive and electronics manufacturers?
Yes. Manufacturing environments in the Eastern Economic Corridor combine corporate IT, supplier integrations and operational technology, so scope is agreed carefully and any operational technology is tested in a controlled environment rather than against a live line.
Is penetration testing required for financial institutions in Thailand?
The Bank of Thailand expects regulated institutions to run independent security testing and to track remediation, and the SEC sets parallel expectations for capital market and digital asset businesses. Both are supervisory expectations rather than optional practices, and testing evidence is asked for during review.