Penetration testing · Readiness · DevSecOps

Cyber security services

Find and fix the weaknesses in your apps, cloud and processes before someone else does.

Book a free 30-minute callSee how we work ↓
  • Free retest included
  • Custom quote after a brief

Company-wide: 4.9+ on Clutch250+ brands10 offices

Brands across our services · company-wide, not security projects

Haldiram's logoFarm Country Brewing logoFlâneur logoGrest logoBonvie logoBaadshah logoOccult Vidya logo

What we test

Penetration testing services, automated plus manual.

Web apps

OWASP Top 10, ASVS, logic flaws.

APIs

Access control, data exposure, limits.

Mobile apps

OWASP Mobile Application Security.

Networks

External and internal.

Cloud setup

Access, exposure, encryption, logging.

Containers and Kubernetes

Images, cluster settings, permissions.

Free retest includedWe check every fix again.

What's in the report

Every vulnerability assessment ends in a report your team can act on.

  1. Management summaryPlain language, for leaders.
  2. Reproduction stepsFor every finding.
  3. CVSS severityThe open standard by FIRST. CVSS ↗
  4. Recommended fixesOrdered by risk.
  5. Mapping to your frameworksISO/IEC 27001, SOC 2, PCI DSS, NIS2 and others.
  6. Retest letterWhat's closed, to share with customers and auditors.

Then a free retest

  1. Finding reportedWith steps and a fix.
  2. You fix itOr we fix it with you.
  3. Free retestWe check each fix.
  4. Retest letterProof of what's closed.

What else we do

DevSecOps, readiness support and help with fixing.

Security assessment

Apps, infrastructure, access, process.

Secure development

Code, dependency and secret scanning, SBOMs.

SOC 2 and PCI DSS readiness

Gaps, controls, evidence. We are not an auditor.

Security questionnaires

Accurate answers, with evidence.

EU compliance gap review

NIS2, DORA, Cyber Resilience Act, GDPR.

Incident readiness

Response plan, roles, tabletop exercise.

Fixing supportWith you or alongside your developers.

Who it's for

A cyber security company for teams without a security specialist.

SaaS companies

Customer questionnaires and test requests.

NIS2 and DORA entities

Risk-management duties.

Businesses handling card data

Preparing for PCI DSS.

Founders and CTOs

Before a launch, raise or big contract.

How we work

Five steps, in writing from the start.

  1. Call

    What to protect, and by when.

    Typical30 minutes

  2. Scope and sign-off

    Scope and window, in writing.

    TypicalAbout a week

  3. Testing

    Critical issues flagged at once.

    Typical1 to 4 weeks

  4. Report and walkthrough

    Findings explained on a call.

    TypicalWithin a week

  5. Fix and free retest

    Then the retest letter.

    TypicalWhen your fixes are ready

Typical minimumTypical maximumWeeks (one scale). Typical ranges, not guarantees. Your proposal sets the real timeline.

What you get

Clear steps, clear proof.

  1. Written scope, window and sign-off
  2. Critical issues flagged at once
  3. Walkthrough call in English
  4. Free retest after your fixes
  5. Retest letter to share

Engagement and pricing

No published prices. Projects are led by UnFoldMart from our international offices.

Fixed-scope test or assessment

Scope and price in writing.

Programme support

A readiness plan, step by step.

Retest included

Free, after your fixes.

How quoting works

  1. Short briefWhat to protect, and why.
  2. Free 30-minute callBy video, in English.
  3. Scope and quoteIn writing, tailored.
  4. You decideNo obligation.

What affects the quote

  • Systems in scopeApps, APIs, networks.
  • Testing depthBlack, grey or white box.
  • Manual testingHow much of it.
  • Compliance evidenceWhat you need to show.
  • DeadlineYour audit or launch date.

Our approach

Framework-led. Scanners for the obvious, people for logic flaws.

Frameworks
NIST CSF 2.0CIS Critical Security ControlsISO/IEC 27001MITRE ATT&CK

Security checks that don't slow releases

  1. Commit
    • Secret scanning
  2. Pull request
    • Code scanning
    • Dependency scanning
  3. Build
    • Container scanning
    • SBOM
  4. Deploy
    • No long-lived cloud keys
Slower scans run off the main path.New checks:Warn→Block

Quality and compliance

Rules of engagement, then the standards we align to.

Authorised testing only

Signed scope and window first.

Careful with your data

Only what scope needs.

Aligned, never certifying

We don't certify or audit companies.

Standards and rules we align to
OWASP ASVSWeb app securitySource ↗OWASP MASMobile app securitySource ↗CVSSSeverity scoringSource ↗NIST CSF 2.0Security frameworkSource ↗NIS2EU critical sectorsSource ↗DORAEU financial sectorSource ↗Cyber Resilience ActEU product securitySource ↗GDPRPersonal dataSource ↗
SOC 2 and PCI DSS: readiness supportWe help you prepare. We don't issue SOC 2 reports or carry out the formal PCI DSS assessment; we are not an auditor.

Whether a rule applies to you is a question for your legal counsel.

Cloud security and out-of-hours support: Cloud and DevOps ↗

Brands across our services

Company-wide, from web, brand and marketing clients. Not security projects.

Clutch4.9+Company-wide ratingSee our Clutch profile ↗
They're genuinely accommodating as we work through what feels right for the platform.
Head of Technology, Re-Twin Energy GmbHGermany · Web design and development
Clutch · Sep 2026
We were extremely satisfied with UnFoldMart's work, professionalism, and commitment throughout the project.
Director, Aytrus.CoSingapore · Branding, web dev, UI/UX
Clutch · May 2026
10offices in 10 markets
250+brands worked with
500+projects delivered
8working languages
  • Gurugram (HQ)
  • Frankfurt · in person
  • Amsterdam
  • Zürich · in person
  • London
  • Paris
  • Madrid
  • Warsaw
  • Singapore
  • Vancouver

Frequently asked questions

Before you book a call.

Black box: no inside knowledge, like an outsider. Grey box: test accounts and some documentation, the usual choice. White box: full access to code and design, for the deepest review.

A common rhythm is once a year and after major changes, such as a new product, a big release or new infrastructure. Your contracts or regulations may ask for more.

Agree the scope in writing, pick testing windows, create test accounts, tell your hosting provider and anyone who watches your alerts, and name one contact on your side.

No. We are not an auditor or certification body. We offer readiness support: a gap review, help putting controls and evidence in place, and help answering customer security questionnaires.

We don't publish prices. Cost depends on scope, depth and deadline. After a short brief or a free 30-minute call, we send a tailored quote.

We don't run a round-the-clock security monitoring service. For cloud systems we look after, night and weekend support is available through our Cloud & DevOps services. Tell us on the call what you need.

Related services

Cloud and DevOpsApp developmentAI agent developmentWebsite developmentUI/UX designWebflowSEOBrandingGrowth marketing
Free 30-minute call

Know where you stand before an auditor, customer or attacker tells you

Tell us what to protect and by when. A clear scope and tailored quote follow.

Or pick a time right here

Open the calendar in a new tab ↗