DevSecOps
We move security into the build, so problems get caught before they ship. Scanning, secrets handling, and policy checks wired into your pipeline — without slowing your developers down.
CI/CDSASTSCAIaC
Technical Security Engineering · Europe · Since 2019
We find the gaps — and help you close them.
We're a team of security engineers who would rather fix a problem than write a report about it. Pen testing, red teaming, DevSecOps, and vulnerability work — done hands-on, around how your environment actually runs.
Where we workFull stack
DevSecOpsPipeline
Vulnerability ManagementAnalysis
Web App & APIFuzzing
NetworkAssessment
Pen Test & Red TeamOffensive
0+Years in cybersecurity
0+Security assessments
0+Organisations secured
0hResponse time
0%Client confidentiality
Areas of expertise
Skilled engineers, focused on solutions
Six technical disciplines, one team. We test, break, and harden real systems — and we stay until every finding is closed.
Vulnerability Management & Analysis
Scanners hand you thousands of findings. We tell you which ones actually matter in your environment, what can wait, and what to fix today — so your team works a short list, not a 400-page export.
TenableQualysTriagePrioritisation
Web Application & API Fuzzing
We throw malformed and unexpected input at your apps and APIs to surface the edge cases normal testing misses: broken auth, injection, and logic flaws that only show up under pressure.
OWASPFuzzingAPI SecurityAuth
Network Assessment
We map what is really on your network — not what the diagram claims — and find the misconfigurations, soft spots, and forgotten boxes an attacker would use to get a foothold.
ReconSegmentationActive DirectoryMisconfig
Penetration Testing
Hands-on, goal-driven testing against your systems. We go after real objectives the way an attacker would, then hand you the proof, the impact, and a clear path to closing each finding.
InternalExternalWebExploitation
Red Team Assessments
A full-scope test of how your people, tooling, and defences hold up against a determined adversary. Quiet and realistic, built to answer one question: would you catch us?
Adversary SimEvasionLateral MovementDetection
Our approach
Every engagement ends with a clear, actionable remediation roadmap. We retest after you fix, because a closed ticket should mean the problem is actually gone.
We ship fixes, not just reports
RemediationRetestingKnowledge Transfer
Our methodology
How we secure your business
A proven four-phase engagement model — structured, transparent, and designed to deliver measurable outcomes.
01
Discovery & Assessment
We audit your posture, map your infrastructure, and identify gaps against ISO 27001, NIST, and SOC 2. You get a prioritised risk register.
02
Threat Modelling
Vulnerability scanning, attack-surface mapping, and threat modelling tailored to how real adversaries would target your organisation.
03
Implementation
We deploy controls, SIEM configurations, Zero Trust policies, and DevSecOps pipelines — working alongside your team, not around it.
04
Continuous Protection
Ongoing monitoring, quarterly compliance reporting, and incident response planning. Your posture improves continuously, not just at audit time.
About SECFORIT
A small team that does the work
We started in Arad in 2019 with a simple idea: hire engineers who do the work themselves, and keep the team small enough that you always know who is on your account. No layers of account managers, no handing your project to whoever happens to be free.
Everyone here tests, scripts, and breaks things for a living. When we hand you a finding, it comes with proof and a fix we have actually tried — not a line copied out of a scanner. That is the whole point of working with people instead of a tool.
We do the work
The engineer who scopes your test is the one who runs it. No handoffs.
Solutions, not reports
Every finding comes with a fix we have tested — not just a severity score.
We stay till it holds
We retest after you remediate, so a closed ticket actually means closed.
Quiet and confidential
NDA on request. What we find stays between us.
Free initial assessment
Let's discuss your security posture
Every engagement starts with a no-obligation discovery call. We listen, assess, and propose a tailored plan — no generic checklists, no upselling. Response within 24 hours.