Top Penetration Testing Companies in Singapore 2026

• Penetration testing (pentest) is critical in Singapore, from MAS regulated banks to SMEs, to detect and fix vulnerabilities like OWASP Top 10 flaws, SSRF, and insecure APIs before attackers exploit them.
• The profiled providers include CSRO licensed firms such as Bitdefender (which acquired Horangi), Wizlynx, P1 Security, and Swarmnetics.
• We compare their public offerings, Singapore relevance, accreditations, and buying considerations, so CISOs and SMEs can choose the right partner.
• For MAS-regulated financial institutions (MAS TRM) and organisations handling card data (PCI DSS), regular penetration testing is an explicit expectation; the PDPA sets no fixed testing interval, but pentesting is one way to show reasonable security arrangements.
• Illustrative scenarios (e.g., SSRF exploitation and mobile account takeover) show why continuous testing and expert-led pentests matter in 2026.

Penetration testing or pentesting is a hands on, ethical hacking process that simulates cyberattacks against your systems to uncover exploitable flaws before real criminals do.

Comparing providers beyond Singapore? Our worldwide list of penetration testing companies covers firms that deliver testing across regions. For other regional shortlists, see penetration testing companies in Indonesia and Hong Kong pentest providers.

Disclosure: DeepStrike, the publisher of this guide, is a penetration testing provider and is included in this list. Weigh our entry the way you would any vendor's description of its own service, and compare scope, sample reports and references for every provider before you buy. DeepStrike is listed first as the publisher; the order is not a score or ranking.

In 2026’s threat landscape, marked by AI powered attacks and rampant credential theft, routine pentests are essential. For example, the Verizon 2025 DBIR found that vulnerability exploitation was the initial access vector in 20% of breaches, and the 2026 DBIR puts it at 31%, now the top vector. Unpatched bugs from misconfigurations to SSRF to weak APIs are prime targets. Singapore’s regulators recognize this.

For a broader comparison of cybersecurity providers beyond penetration testing, see Top Cybersecurity Companies in Singapore.

MAS’s Technology Risk Management framework expects regular VAPT for banks and finance firms, and the CSA has launched CREST certification locally to raise pentest quality. In this guide to top penetration testing companies in Singapore, we profile consulting firms and explain when a PTaaS delivery model fits.

We detail each vendor’s services, focus industries, CREST/CSRO/OSCP credentials, and buying considerations. We also examine compliance drivers (MAS TRM, PDPA, PCI DSS), common test scopes (web, mobile, API/GraphQL), and illustrative attack examples (e.g. SSRF exploits or mobile app account takeovers). Our goal: help CISOs and startup founders find the right, affordable VAPT services for their needs.

How We Selected These Singapore Providers

Method: We started from Singapore's CSRO register of licensed penetration testing providers (list dated 30 October 2026) and from providers that publish a Singapore office or market Singapore VAPT services. Each entry was checked against the provider's own service, contact, and certification pages, and was reviewed again in November 2026. Criteria were licensing status, published test scope, stated CREST accreditation, Singapore presence, and reporting and retest detail. CyberNX and Cxrus Solutions are not on the CSRO register; their entries say so. This is desk research; we did not run test engagements with these providers.

Top Penetration Testing Companies in Singapore 2026

1. DeepStrike: Application testing and remediation collaboration

Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.

Singapore relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for Singapore clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.

Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.

Official sources: Pricing , Contact Us

Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.

2. Bitdefender (formerly Horangi): Consultant-led testing from a security vendor

Public offering: Bitdefender's offensive services include consultant-led penetration testing of internal and external networks, web and mobile applications, APIs, thick clients, and wireless networks, plus bespoke testing of specialised devices such as IoT systems, ATMs, and 5G infrastructure. Its published process runs from planning and reconnaissance through exploitation, reporting, optional retesting, and an updated report; reports include CVSS-ranked findings, reproduction steps, and remediation guidance. Red teaming, phishing simulation, cloud security assessment, and AI penetration testing are listed as related services.

Singapore relevance: Bitdefender completed its acquisition of Horangi in August 2023, and Singapore's CSRO register (list dated 30 October 2026) shows Bitdefender APAC Pte. Ltd. holding a penetration testing service licence (CS/PTS/C-2022-0184RR). Confirm which Bitdefender team and location will deliver the test, and define data-handling terms in the agreement.

Certifications: Bitdefender describes itself as a CREST-accredited provider and states that its consultants hold OSCP as a baseline, with many holding further OffSec, GIAC, or CREST certifications.

Official sources: https://www.bitdefender.com/en-us/business/products/offensive-services/penetration-testing

Buyer fit: Organisations that want penetration testing from a large security vendor, including specialised device testing alongside standard network and application scopes.

What sets it apart in Singapore: It pairs a CSRO-licensed Singapore entity with a large security vendor's resources, and it publishes bespoke testing of ATMs and 5G infrastructure, which is relevant to Singapore banks and telecom operators.

3. wizlynx group: Swiss CREST-accredited testing with a Singapore office

Public offering: wizlynx group tests web applications and APIs, internal and perimeter infrastructure including AWS and Azure, mobile apps, thick clients, wireless networks, Active Directory and Entra ID, insider threat scenarios, and AI systems such as LLMs and chatbots. Its methodology builds on the OWASP Testing Guide, OSSTMM, and PTES, combining automated tools with manual testing. Deliverables include a C-level summary, risk-prioritised findings with evidence, a findings presentation, and an online portal for tracking assessments and retests.

Singapore relevance: wizlynx is headquartered in Binningen, Switzerland, and lists Wizlynx Pte Ltd at 10 Anson Road, #14-04 International Plaza, Singapore 079903; the CSRO register (list dated 30 October 2026) shows Wizlynx Pte. Ltd. with a penetration testing service licence (CS/PTS/C-2022-0183RR). Confirm which office's testers will perform the work and where test data is stored.

Certifications: wizlynx states that it has held CREST accreditation as a penetration testing provider since 2017 and uses CREST-certified testers.

Official sources: https://www.wizlynxgroup.com/cyber-security/penetration-testing-services; https://www.wizlynxgroup.com/about

Buyer fit: Regulated mid-sized and large organisations that want a CREST-accredited, locally licensed provider with an international delivery network.

What sets it apart in Singapore: It combines a CSRO licence and a published Singapore office address with CREST accreditation it states it has held since 2017, and its customer portal lets teams track retests across several countries.

4. CyberNX: India-based VAPT provider

Public offering: CyberNX describes human-led, automation-enabled penetration testing of web applications, mobile apps, cloud, wireless, APIs, internal and external networks, and IoT, plus social engineering. It states that testing follows OWASP, PTES, and NIST, with custom test plans, a detailed report with remediation guidance, and retesting to confirm fixes. Related services include red teaming, secure code review, cloud security assessment, phishing simulation, and breach and attack simulation.

Singapore relevance: CyberNX's website publishes an Indian phone number and no Singapore address, and CyberNX does not appear on the CSRO register of licensed penetration testing providers (list dated 30 October 2026). Singapore buyers should confirm licensing status before engaging, and define tester locations and cross-border data handling in the agreement.

Certifications: CyberNX states that it is CERT-In empanelled and ISO 27001:2022 certified, and that its testers hold certifications such as OSCP, CEH, and CISSP.

Official sources: https://www.cybernx.com/penetration-testing-services/; https://www.cybernx.com/contact-us/

Buyer fit: Organisations, particularly those with operations in India, that want broad VAPT coverage from a provider aligned to Indian regulatory frameworks.

What sets it apart in Singapore: It is a cross-border option for groups with Indian operations, but it is one of two profiled firms not on the CSRO register, so do not engage it for a Singapore entity until licensing is confirmed.

5. P1 Security: Telecom network security specialist

Public offering: P1 Security, a French company (P1 Security S.A.S.), focuses on telecom and mobile network security. Its published offerings include audit, vulnerability assessment, and red team services, 5G core security assessments, risk assessment, and attack surface management for operators. Its homepage does not describe general IT penetration testing.

Singapore relevance: P1 Security does not publish a Singapore office on its homepage, but the CSRO register (list dated 30 October 2026) lists P1 Security with a penetration testing service licence (CS/PTS/C-202502-004). It displays GSMA membership; define tester locations, remote access arrangements, and data-handling terms in the agreement.

Official sources: https://www.p1sec.com/product/audit-vulnerability-assessment-red-team; https://www.p1sec.com/contact

Buyer fit: Telecom operators and agencies that need security assessment of mobile network infrastructure such as 5G core equipment.

What sets it apart in Singapore: It is the only telecom-network specialist on this list and holds a CSRO licence, which matters for Singapore mobile network operators; it is not a general IT penetration testing choice.

6. Swarmnetics: Singapore-based VAPT and adversarial emulation

Public offering: Swarmnetics lists network, wireless, IoT, web application, mobile application, thick client, API, LLM application, and cloud penetration tests under its vulnerability assessment and penetration testing (VAPT) services. Its adversarial emulation services include red team, purple team, and phishing simulation exercises.

Singapore relevance: Swarmnetics states that its core team is based in Singapore and operates as Swarmnetics Pte. Ltd., which the CSRO register (list dated 30 October 2026) shows with a penetration testing service licence (CS/PTS/C-2022-0090RR). Its website does not publish a street address; confirm tester locations and data handling in the agreement.

Certifications: Swarmnetics states that it is CREST accredited and that its testers are OSCP certified.

Official sources: https://swarmnetics.com/

Buyer fit: Singapore organisations that want a locally based, licensed team for application, infrastructure, LLM application, or red team testing.

What sets it apart in Singapore: It is the profiled provider most clearly built around a Singapore-based core team, offering licensed VAPT plus red team, purple team, and phishing simulation exercises from one local team.

7. Cxrus Solutions: Cloud and application engineering partner

Public offering: Cxrus Solutions describes itself as a cloud, application, and infrastructure engineering firm, with services spanning cloud-native applications, automation, serverless architecture, API management, data resilience, and DevOps through partners such as Chainguard, GitLab, Veeam, and AWS. Its website does not list penetration testing as a standalone service.

Singapore relevance: Cxrus lists entities in Singapore (Cxrus Solutions Pte Ltd), Malaysia, and Indonesia, but does not appear on the CSRO register of licensed penetration testing providers (list dated 30 October 2026). Confirm who would perform, and hold the licence for, any penetration test before engaging.

Official sources: https://www.cxrus.com/services; https://www.cxrus.com/contact

Buyer fit: Organisations already working with Cxrus on cloud or DevOps projects that want security built into that work, with formal penetration testing sourced from a licensed provider.

What sets it apart in Singapore: It is an engineering partner rather than a penetration testing firm; it stays on the list for buyers already using it, but a CSRO-licensed provider must perform any penetration test for a Singapore entity.

8. FIRMUS: CREST-accredited testing from Malaysia with a Singapore office

Public offering: FIRMUS, founded in 2008, lists network, web application, mobile application, and wireless penetration testing, intelligence-led penetration testing, red teaming, Active Directory assessment, source code review, and breach and attack simulation. It also provides managed detection and response, digital forensics and incident response, OT security, and compliance advisory, and describes a hybrid approach of automated scanning and manual exploit testing with remediation recommendations.

Singapore relevance: FIRMUS is headquartered at Hampshire Place, Kuala Lumpur, and lists FIRMUS PTE LTD at 20 McCallum Street, #19-01 Tokio Marine Centre, Singapore 069046; the CSRO register (list dated 30 October 2026) shows Firmus Pte. Ltd. with a penetration testing service licence (CS/PTS/C-2022-0110RR). Confirm whether testers will be Singapore- or Malaysia-based and how test data is handled.

Certifications: FIRMUS describes itself as a CREST-accredited penetration testing company with a CREST-certified team.

Official sources: https://firmussec.com/our-services/assessment/network-penetration-testing/; https://firmussec.com/contact/

Buyer fit: Regional enterprises in Singapore and Malaysia that want penetration testing alongside MDR, incident response, or OT security from one provider.

What sets it apart in Singapore: It covers Singapore and Malaysia from one provider with a CSRO licence and a Singapore office, and lists intelligence-led testing and OT security, which suits regional groups operating in both countries.

Customer Reviews and Compliance

Many Singapore companies vet pentest vendors by Clutch or Google reviews. Check that reviews are recent and specific, and weigh them alongside licensing, scope and sample reports.

In regulated sectors, some auditors and regulated buyers prefer CREST-accredited providers and logged test reports as evidence for PCI DSS or SOC 2 criteria; PCI DSS itself requires a qualified, organizationally independent tester rather than a specific accreditation. For example, PCI DSS v4.0.1 requirement 11.4 requires internal and external penetration testing at least once every 12 months and after significant changes, using an industry accepted methodology.

PDPA financial penalties for data breaches give organisations a reason to test proactively.

Pricing Insight: Penetration testing cost in Singapore varies by scope, and most providers, DeepStrike included, quote per engagement. A small external web app test costs far less than a full scope enterprise assessment covering networks, apps and social engineering, and subscription based PTaaS is billed annually. Always confirm what's included: internal vs external scope, number of IPs/apps, retest allowances, etc.

Common Vulnerabilities and Illustrative Scenarios

Leading pentesters test against known weaknesses. The OWASP Top 10:2025 highlights the most critical web flaws worldwide e.g. Broken Access Control, Injection, Authentication Failures. Singapore companies frequently encounter issues like security misconfiguration, now #2 in the 2025 list, insecure APIs including GraphQL, and SSRF vulnerabilities, which had their own A10 slot in 2021 and now fall under Broken Access Control. Mobile apps often suffer from improper deep link handling or token leaks.

For example, testers assessing a monitoring service could find a blind SSRF bug, using octal IP representation and open redirect chaining to bypass filters and hit a cloud metadata service, showing how simple misparsing can expose internal data. In another illustrative scenario, deep link URL flaws and open redirects in a mobile app could lead to full account takeover.

By exploiting path traversal and an open redirect, attackers could steal access tokens and hijack sessions. These examples demonstrate that pentests must combine automated scanning with creative human tests to chain minor issues into serious breaches. See also our account takeover statistics guide.

In summary, pentesting targets everything from email/VPN endpoints (external tests) to internal networks (internal tests). It often includes web apps (OWASP Top 10), mobile APIs (OAuth flows), GraphQL endpoints, wireless networks, and even social engineering. Continuous pentesting platforms can even integrate with DevOps to find freshly introduced bugs.

Singapore Regulatory and Procurement Context

Since 11 April 2022, Part 5 of the Cybersecurity Act 2018 has required providers of penetration testing services in Singapore to hold a licence from the Cybersecurity Services Regulation Office (CSRO), according to the Cyber Security Agency's announcement. Licences run for two years, so check the CSRO register for a current licence before contracting rather than relying on a provider's website. The Cyber Security Agency (CSA), which also runs SingCERT, oversees critical information infrastructure under the same Act.

Financial institutions work to the MAS Technology Risk Management Guidelines, issued on 18 January 2021; map test scope and frequency to your TRM programme and keep reports as audit evidence. Organisations that hold personal data must make reasonable security arrangements under the PDPA, enforced by the Personal Data Protection Commission.

Public-sector buyers procure through GeBIZ, the government's e-procurement portal. English is the working language of business and government, so reporting language is rarely a constraint, but data location is: when testers sit outside Singapore, state in the contract where evidence and credentials are stored and when they are deleted.

Why Pentesting Matters for Singapore Businesses

Given Singapore’s heavy regulation of technology risks, pentesting is expected for regulated financial institutions and card-data environments and is a strong practice for others. MAS TRM and other national standards expect comprehensive testing of systems that handle financial or personal data. PDPC enforcement decisions have directed organisations to conduct vulnerability assessments and penetration tests after incidents. Compliance driven pentesting ensures that controls are not just in place, but proven effective. Moreover, with cybercriminals favoring credential theft and vulnerability scans, proactive testing shifts defense from reactive to preventative.

Whether you’re an enterprise or SME, a custom pentest can reveal hidden risks before they become disasters. Ready to test your security? Contact DeepStrike to discuss penetration testing services for businesses or set up a free consultation on continuous pentesting solutions. DeepStrike tests the applications, APIs, cloud and infrastructure you define in scope, and its reports can support the evidence your MAS TRM or PDPA programme needs.

FAQs

How much does penetration testing cost in Singapore?

Short answer: it depends on scope, and most providers quote per engagement after scoping. A single small web app costs far less than a multi asset program covering internal and external networks, apps and social engineering, and continuous PTaaS is billed as an annual subscription. What affects cost? Asset count, auth/roles, API/GraphQL depth, environment (cloud/on prem), and retesting.

Which penetration testing companies are CREST certified and CSRO licensed in Singapore?

Look for a CSA/CSRO licence (legally required to offer pentesting in SG; check the CSRO public register) and CREST accredited teams for assurance, then shortlist by your scope (web, mobile, API, cloud, red team).

What’s the difference between PTaaS and one off VAPT?

A one-off VAPT is a point-in-time test with a single report, suited to annual compliance and major releases. PTaaS runs testing continuously through a platform, with dashboards and on-demand retests, and suits teams that deploy often. A third-party provider offering either model in Singapore needs a CSRO penetration testing licence.

• One off pentest: point in time, great for annual compliance and major releases.
• PTaaS: continuous testing + dashboard + CI/CD retests best for agile teams with frequent deploys.

How often should Singapore orgs pentest?

MAS-regulated financial institutions and PCI DSS environments should test at least annually and after significant changes, which is a sensible baseline for most Singapore organisations. The PDPA sets no fixed interval, but PDPC decisions have directed organisations to run vulnerability assessments and penetration tests after incidents, so periodic testing helps show reasonable security.

• MAS regulated FIs: at least annually for internet facing systems and after significant changes; add adversarial/red team exercises. 
• PCI DSS: at least annually and after significant changes (external, internal, segmentation).
• PDPA: no fixed interval, but PDPC decisions show expectation of periodic reviews; firms have been directed to perform VA/PT after incidents.

What is the difference between a penetration test and a vulnerability scan?

A vulnerability scan is automated software that lists potential issues known CVEs, missing patches, etc., but it often misses complex flaws. A penetration test is manual, combining scanning with an expert hacker’s creativity. Pentests prove exploitability e.g., they can chain multiple low risk bugs like an OAuth misconfig and SSRF into a high impact breach.

Why choose a CREST certified pentest provider?

CREST accreditation in Singapore, CREST certified penetration testing means the company meets global standards for quality and ethics. Ask which CREST-certified testers will be assigned to your engagement. This gives assurance to regulators and auditors in MAS regulated sectors. CREST providers often use standards like NIST SP 800 115 in their methodology.

How often should Singapore organizations conduct pentests?

Key guidelines: MAS TRM expects internet-facing systems to be tested at least annually and after significant changes. PCI DSS mandates at least annual external/internal tests. For fast moving businesses, we recommend continuous pentesting or at least quarterly scans, plus pentests after any major change. Always align testing frequency with your compliance needs and threat model.

What does pentesting cost in Singapore?

Costs vary by scope. Basic web app tests sit at the low end, while full scale enterprise assessments cost considerably more, and PTaaS platforms offer annual subscription models for continuous testing. Always ask the vendor for a clear price range based on your specific assets.

Do SMEs really need pentesting?

Yes. Even small businesses hold sensitive customer data and face cyber risks. A breach can damage reputation and invite fines, PDPA, PCI penalties. SMEs can often start with targeted tests like a web app and employee phishing at modest cost. Many providers tailor packages for startups just to ensure they have the right certifications and report quality.

What is Pentest as a Service PTaaS?

PTaaS is a modern delivery model where testing is ongoing and managed via a platform. Instead of one off audits, PTaaS blends automated scanning with crowdsourced or dedicated testers, giving you continuous dashboards and retest support. Cobalt.io and HackerOne are examples of PTaaS or crowd testing providers. PTaaS can be more flexible and faster than traditional pen tests.

How do I test APIs and mobile apps?

Look for vendors offering specialized API penetration testing Singapore or mobile app pentest services. Experts will test API endpoints including GraphQL/REST for logic flaws, auth bypass, and injection, and mobile apps for insecure data storage or deep link flaws. Always verify the tester has done OAuth/API attacks before see OAuth security best practices and GraphQL API security and testing guides.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.