Cyber security in Düsseldorf
Penetration testing and IT security for Düsseldorf companies, led from our Frankfurt office: find and fix the weaknesses in your apps, cloud and processes, with a free retest after your fixes.
- Custom quote after a brief
- Free retest after fixes
Company-wide:★★★★★ 4.9+ on Clutch·250+ brands·10 offices
UnFoldMart provides cyber security services to Düsseldorf companies from its office in Frankfurt, at Taunustor 1, 60310 Frankfurt am Main. We run authorised penetration tests of web apps, APIs, mobile apps, networks and cloud setups, offer SOC 2 and PCI DSS readiness support and help with customer security questionnaires, including evidence for NIS2. Every test starts with a signed scope, and the retest after your fixes is free. Meet us in person at our Frankfurt office or at any of our 10 offices, or by video. Pricing is a custom quote after a short brief.
Last updated:
Key facts
| Service | Penetration testing of web apps, APIs, mobile apps, networks, cloud and containers; vulnerability assessments; SOC 2 and PCI DSS readiness support; help with security questionnaires |
|---|---|
| Company | UnFoldMart |
| Serving office | Frankfurt: Taunustor 1, 60310 Frankfurt am Main, Germany |
| Meetings | Meet us in person at our Frankfurt office or at any of our 10 offices, or by video. |
| Languages | First call in English; project calls by video in English |
| Time zone | Central European Time (CET/CEST); project teams are led from our international offices |
| Typical timeline | Scope and sign-off about 1 week · testing 1–4 weeks · report within 1 week · free retest when your fixes are ready (ranges, not guarantees) |
| Pricing | Custom quote after a short brief: fixed-scope test or assessment, or programme support. No price list. |
| Booking | Free 30-minute video call ↗ |
| Company-wide | 10 offices in 10 markets · 250+ brands · 500+ projects · 4.9+ on Clutch · 8 working languages |
IT security for Düsseldorf companies
Düsseldorf, the capital of North Rhine-Westphalia, is an international business and financial centre and one of Germany's top telecommunications locations, known for fashion and trade fairs. Telecoms, retail and professional services firms here are asked for security evidence by customers and partners.
Düsseldorf at a glance
- IndustriesTelecoms, finance, fashion and retail, trade fairs
- RulesNIS2 (German law since December 2025), GDPR
- Data protection authorityLDI NRW
- Serving UnFoldMart officeFrankfurt · in person or by video
- Time zoneCET in winter, CEST in summer
Telecoms and IT
Networks, portals, APIs and cloud.
Finance and professional services
Web apps, client portals and audit evidence.
Fashion, retail and e-commerce
Shops, payments and customer accounts.
What our pentest team checks for Düsseldorf companies
Penetration testing of web apps, APIs, mobile apps, networks, cloud setups and containers.
Web apps
OWASP Top 10, ASVS, logic flaws.
APIs
Access control, data exposure, limits.
Mobile apps
OWASP Mobile Application Security.
Networks
External and internal.
Cloud setup
Access, exposure, encryption, logging.
Containers and Kubernetes
Images, cluster settings, permissions.
Our rules
Authorised testing only
Signed scope and window first.
Careful with your data
Only what scope needs.
Aligned, never certifying
We don't certify or audit companies.
Automated scan, penetration test or audit?
Three different things that are often confused. We run penetration tests and help you prepare for audits; we are not an auditor.
| Automated scan | Penetration test | Audit or certification | |
|---|---|---|---|
| What it is | A tool checks for known weaknesses | Security testers try to break in, manually and with tools | An independent auditor checks your controls against a standard |
| What it finds | Known issues and missing patches | Real, exploitable weaknesses, including logic and access flaws | Gaps in policies, processes and evidence |
| What you get | An automated list, often with false positives | A report with proof, CVSS severity and fixes, plus a free retest | An audit report or certificate |
| Who does it | Your team or any provider | Testers you authorise in writing, such as UnFoldMart | Accredited auditors only (not UnFoldMart) |
| Best for | Frequent checks between tests | Before launches, big contracts and audits, and at least once a year | Proving compliance, e.g. SOC 2, PCI DSS, ISO/IEC 27001 |
From finding to fixed
Every finding comes with steps to reproduce and a fix. The retest is free.
- Finding reportedWith steps and a fix.
- You fix itOr we fix it with you.
- Free retestWe check each fix.
- Retest letterProof of what's closed.
- Gap review
- Controls and evidence
- Security questionnaires
How a penetration test works
From the first call to the retest letter, with critical issues flagged at once.
- 1ScopeSigned, in writing
- 2TestingCritical issues flagged at once
- 3ReportWalkthrough call
- 4Free retestRetest letter
Timeline
| Phase | Typical duration | You get |
|---|---|---|
| Call | 30 minutes | Clear goals and next steps |
| Scope and sign-off | About a week | Signed scope, window and rules |
| Testing | 1 to 4 weeks | Critical issues flagged at once |
| Report and walkthrough | Within a week | Report with CVSS severity and fixes, explained on a call |
| Fix and free retest | When your fixes are ready | Retest letter to share |
Typical ranges, not a guarantee. Testing time depends on scope.
How to choose a pentest provider for Düsseldorf
Six checks before you sign, whoever you hire.
Written authorisation and scope
Testing should start only after the system owner signs the scope, window and rules.
UnFoldMart: Signed scope and window before any test.
Manual testing, not just a scan
Ask how much of the work is manual and which methods they follow.
UnFoldMart: Manual testing aligned to OWASP ASVS and OWASP MAS.
A report your developers can use
Findings with proof, severity and fix steps.
UnFoldMart: CVSS severity, steps to reproduce and fixes, explained on a call.
A retest after fixes
Is a retest included, and do you get written confirmation?
UnFoldMart: Free retest and a retest letter.
Honest about compliance
A tester is not an auditor. Be wary of anyone promising a certificate.
UnFoldMart: Readiness support for SOC 2 and PCI DSS; we never certify.
Careful with your data
How test data, credentials and the report are handled.
UnFoldMart: Only the data the scope needs.
Black box, grey box or white box?
| Grey box | Black box | White box | |
|---|---|---|---|
| Access for testers | Test accounts and some documentation | No inside knowledge | Full access to code and design |
| Simulates | A user or partner with an account | An outside attacker | A deep review with insider knowledge |
| Coverage | Good balance; the usual choice | Lower; time goes into discovery | Highest |
| Best for | Most web apps and APIs | Checking what is exposed to the internet | Critical systems and code-level review |
What affects the cost
No price list. Your quote depends on these factors.
- Systems in scopeApps, APIs, networks.
- Testing depthBlack, grey or white box.
- Manual testingHow much of it.
- Compliance evidenceWhat you need to show.
- DeadlineYour audit or launch date.
- Regulatory evidenceNIS2 or GDPR documentation needs extra review time.
Ways to work with us
Fixed-scope test or assessment
Scope and price in writing.
Programme support
A readiness plan, step by step.
Retest included
Free, after your fixes.
How quoting works
- Short briefWhat to protect, and why.
- Free 30-minute callBy video, in English.
- Scope and quoteIn writing, tailored.
- You decideNo obligation.
German rules for IT security
This is general information, not legal advice. Your legal adviser has the final word.
NIS2 in Germany
Germany's NIS-2 implementation law has been in force since 6 December 2025. Affected companies must register with the BSI and report significant security incidents: an early warning within 24 hours, a notification within 72 hours and a final report within 30 days.
Official source: NIS-2 duties (bsi.bund.de) ↗GDPR: reporting data breaches
A personal data breach must be reported to the supervisory authority within 72 hours where feasible, unless it is unlikely to result in a risk to people. For companies based in Düsseldorf, that is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW).
Official source: LDI NRW (official site) ↗Unauthorised access is a crime
Under § 202a of the German Criminal Code (StGB), gaining unauthorised access to specially protected data by overcoming access protection is a criminal offence. That is why every test we run starts with written authorisation from the system owner.
Official source: § 202a StGB (gesetze-im-internet.de) ↗Public standards and rules we align our work to
Working with us from Düsseldorf
One dedicated team; projects are led by UnFoldMart from our international offices.
Served from Frankfurt
Taunustor 1, 60310 Frankfurt am Main, Germany
In person or by video
Meet us in person at our Frankfurt office or at any of our 10 offices, or by video.
Language
Calls and reports in English.
Time zone: Central European Time (CET/CEST)
Office-hours overlap: –
09:00–18:00 local time in both places. Same time zone as our Frankfurt and Zürich offices.
Company-wide figures across all our services, not security projects.
- Frankfurt · in person
- Zürich · in person
- London · in person
- Amsterdam · in person
- Paris · in person
- Madrid · in person
- Warsaw · in person
- Singapore · in person
- Vancouver · in person
- Gurugram · in person
Frequently asked questions
Cyber security in Düsseldorf: before you book a call.
Do you have an office in Düsseldorf?
No. We serve Düsseldorf from our Frankfurt office, at Taunustor 1, 60310 Frankfurt am Main. Meet us in person at our Frankfurt office or at any of our 10 offices, or by video.
How much does a penetration test cost in Düsseldorf?
We don't publish prices. Cost depends on the systems in scope, testing depth, how much manual testing is needed, the compliance evidence you need and your deadline. After a short brief or a free 30-minute call, you get a written scope and a tailored quote.
How long does a penetration test take?
Typically: scope and sign-off about a week, testing 1 to 4 weeks depending on scope, and the report within a week after testing, explained on a call. The free retest runs when your fixes are ready. These are ranges, not guarantees.
Black box, grey box or white box?
Black box: no inside knowledge, like an outsider. Grey box: test accounts and some documentation, the usual choice. White box: full access to code and design, for the deepest review.
Can you get us SOC 2, PCI DSS or ISO 27001 certified?
No. We are not an auditor or certification body. We offer readiness support: a gap review, help putting controls and evidence in place, and help answering customer security questionnaires.
Is a retest included?
Yes. After you fix the findings, we retest them for free and give you a retest letter that shows what is closed.
Do you need written permission before testing?
Yes, always. Testing starts only after the owner of the systems signs the scope, the testing window and the rules. If a system is hosted or run by someone else, their rules apply too.
Are we affected by NIS2?
It depends on your sector and size. Germany's NIS-2 implementation law has been in force since 6 December 2025, and the BSI explains who is affected and what they must do. We don't give legal advice, but we can test your systems and help you prepare the risk-management evidence NIS2 asks for.
Can we meet in person?
Yes. Meet us in person at our Frankfurt office or at any of our 10 offices, or by video. Düsseldorf is served from our Frankfurt office, and most scoping calls, report walkthroughs and check-ins run by video.
Who works on our project, and how do we communicate?
Projects are led by UnFoldMart from our international offices, with a small dedicated team. Calls and reports are in English, and critical issues are flagged at once.
Need a penetration test in Düsseldorf?
Tell us what to protect and by when. A clear scope and tailored quote follow.