How to Choose a Penetration Testing Company in Bangladesh (2026 Checklist)

Searching for "top cybersecurity companies in Bangladesh" gives you lists — but most of those lists are written by directories or by companies ranking themselves first. A list can't tell you whether a provider will actually find the weaknesses in your systems.

This checklist is what we would want a client to ask us. Use it with any provider, including Byte Capsule.

1. Check what kind of test you are actually buying

Many offers labelled "VAPT" are an automated scan with a branded PDF. A scan is useful, but it is not a penetration test.

• Vulnerability assessment (VA): automated and manual discovery of known weaknesses.
• Penetration test (PT): a tester tries to exploit weaknesses, chain them together and prove real impact — for example, moving from a low-privilege account to customer data.

Bangladesh Bank's Cybersecurity Framework, Version 1.0 (2026) says vulnerability assessments should combine automated tools with manual techniques, and that penetration tests should simulate actual attacks. Ask every provider: how much of this engagement is manual testing, and by whom?

2. Ask for a sanitised sample report

A sample report tells you more than any sales deck. A good report has:

• an executive summary a non-technical manager can act on;
• each finding with severity (for example CVSS), affected asset, steps to reproduce, evidence (screenshots, requests and responses) and business impact;
• specific remediation guidance, not "update to the latest version";
• a clear scope and methodology section, and what was not tested.

If a provider can't show a sanitised sample, treat that as a warning sign.

3. Methodology and coverage

Look for a named, repeatable methodology:

• Web and API: OWASP Web Security Testing Guide, OWASP Top 10 and OWASP API Security Top 10.
• Mobile: OWASP MASVS / MASTG for Android and iOS.
• Network and infrastructure: internal and external testing, Active Directory, cloud configuration.
• AI and LLM features: prompt injection, data leakage and tool misuse (OWASP Top 10 for LLM Applications) — increasingly important for chatbots and AI assistants.

Ask whether business logic flaws (payment manipulation, IDOR, broken access control) are tested manually. These are the issues scanners usually miss and attackers usually find.

4. The people who will test you

Certifications are not everything, but they show baseline skill. Common ones include OSCP, CEH, CRTP/CRTO-style red team certifications, and ISO 27001 Lead Auditor for compliance work. Bangladesh Bank's framework itself lists standard certifications such as CISSP, CISA and OSCP for information security staff.

Ask:

• Who exactly will perform the test, and what are their certifications and experience?
• Will any part be subcontracted?
• Do they have experience with your sector (banking, MFS, e-commerce, government)?

5. Credentials of the company — and check them

• ISO/IEC 27001: if a provider claims certification, ask for the certificate number and certification body, and check that it is the 2022 edition. All ISO 27001:2013 certificates expired at the end of the transition period on 31 October 2025.
• Accreditation: confirm the certification body is accredited (for example under IAF).
• References: ask for one or two clients you can speak to, with their permission.

6. Legal and data-handling basics

Before testing starts, you should have in writing:

• a scope document and rules of engagement (targets, dates, test accounts, what is out of bounds);
• written authorisation from your organisation — testing without it is unauthorised access under Bangladesh's cyber security law;
• an NDA, and clear rules for how your data and the final report are stored, shared and deleted;
• an agreed communication path for critical findings found mid-test (you should not wait two weeks for a report if your database is exposed).

7. Retesting and support after the report

A report is only valuable if the findings get fixed. Ask:

• Is one free retest included to verify fixes?
• Will testers join a call with your developers to explain findings?
• Can they provide a letter of attestation or a retest report for your regulator, auditor or client?

8. Frequency: one test a year is the minimum, not the goal

Bangladesh Bank's 2026 framework calls for internal and external VA and penetration testing at least annually and after significant changes to infrastructure or applications. For fast-moving products, consider:

• a test before every major release;
• continuous testing through a bug bounty or vulnerability disclosure programme (VDP) between formal tests.

Quick checklist

Question	Good answer
Manual or automated?	Mostly manual, scanners used for coverage
Sample report?	Sanitised sample shared before signing
Methodology?	OWASP WSTG / MASTG / API Top 10, documented
Who tests?	Named, certified testers; no hidden subcontracting
ISO 27001?	2022 edition, certificate number you can verify
Legal paperwork?	Scope, rules of engagement, authorisation, NDA
Retest?	At least one retest included
Critical findings?	Reported immediately, not only in the final report

How Byte Capsule works

Byte Capsule IT is an ISO 27001 certified cybersecurity company in Dhaka. Our penetration testing service covers web, API, mobile, network and AI/LLM applications with manual testing, a full report and a retest. We also run ZeroDay Test, Bangladesh's first structured bug bounty and VDP platform, for continuous testing between engagements.

Book a free consultation — we'll scope your test and share a sanitised sample report first.

Sources: Bangladesh Bank, Cybersecurity Framework Version 1.0 (2026), sections 2.12, 4.1.8 and 5.1.2; ISO/IAF transition guidance for ISO/IEC 27001:2022.