In this guide · 8 sections
- 01The CSRO licence: check it before anything else
- 02What drives penetration testing prices
- 03Published penetration testing prices in Singapore
- 04How to scope a pentest: web app, external network, Microsoft 365
- 05What a penetration test report should contain
- 06Do you actually need a penetration test?
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Published starting prices for a small, single-app test in Singapore begin at about S$2,000 to S$3,000, but most real scopes cost more, depending on the number of apps, IPs and days of manual testing. Only use a provider holding a CSRO penetration testing licence, and insist on a written scope and a retest.
The CSRO licence: check it before anything else
Under Part 5 of the Cybersecurity Act 2018, penetration testing is one of two licensable cybersecurity services; managed SOC monitoring is the other. CSA's Cybersecurity Services Regulation Office (CSRO) says in its FAQ that all providers of these services to the Singapore market need a licence, whether they are companies or individuals.
- Fee and validity: S$2,500 for a business and S$1,250 for an individual, valid for 5 years.
- New certification rule: from 16 March 2026, applicants must hold an active Cyber Trust mark Promoter (Tier 3) certificate or equivalent for the licensed service, with a grace period to 31 December 2026.
- Where to check: CSRO's list of licensed service providers.
Check the legal entity on your contract against the register. Some sellers resell testing performed by another firm; that firm should hold the licence too. Our guide to the cybersecurity service provider licence covers the rules in more detail. IT Sorted does not provide penetration testing, because it is a licensed service.
What drives penetration testing prices
Penetration testing is mostly skilled people's time. The quote is roughly the number of testing days multiplied by a day rate, plus reporting and retest. Anything that adds days adds cost.
| Price driver | Why it costs more | How to keep it down |
|---|---|---|
| Number of applications or URLs | Each app needs separate testing | Test the one that holds customer data first |
| Pages, endpoints and APIs | More functions to probe manually | Give testers an up-to-date API list |
| User roles | Testing customer, staff and admin views multiplies work | Agree which roles matter most |
| External IP addresses | Each exposed service is checked | Close services you do not need before testing |
| Black-box vs grey-box | Black-box testers spend days discovering what you could tell them | Provide accounts and documentation (grey-box) |
| Retest and urgency | Extra rounds and rush starts cost more | Book early; agree one retest in the quote |
Prices also vary with tester seniority, certifications such as CREST, and whether the report must follow a specific regulatory format.
Published penetration testing prices in Singapore
Few providers publish prices. Two examples of published starting prices, as of October 2026:
- VAPT starting price (SecureAX)'Depending on the test perimeter and scope', per its VAPT pageFrom S$2,000
- Web app VAPT, one application (Infinite Cybersecurity)OWASP Top 10 testing, executive and technical reportFrom S$3,000
- Web, API and network VAPT (Infinite Cybersecurity)Includes a free re-testFrom S$7,500
Realistic budget for a first SME testAsk for 2-3 quotes on the same written scope
Starting prices from SecureAX and Infinite Cybersecurity, October 2026, before GST. Listed as examples only, not a recommendation; verify each provider's CSRO licence.
Starting prices describe the smallest scope. A shop with a customer login, an admin panel and a payment flow will usually need more testing days than the entry package. Our cybersecurity cost guide shows where a pentest fits in an SME's wider security budget.
How to scope a pentest: web app, external network, Microsoft 365
Write the scope yourself before asking for quotes, so every provider prices the same job.
- Web application: the URL, what the app does, user roles, number of pages or API endpoints, and test accounts. The OWASP Top 10 is the usual baseline for web app testing.
- External network: the public IP addresses and domains you own, and which services should be reachable. Make sure you have permission to test anything hosted by a third party.
- Microsoft 365 or Google Workspace: many SMEs gain more from a configuration review of MFA, admin roles, sharing and mail security than from a classic pentest. Ask whether the provider offers a cloud tenant review.
- Out of scope: list systems that must not be touched, such as payment providers' pages or production databases.
- Timing and contacts: testing window, who to call if something breaks, and whether testing may run in business hours.
If you have never had a security review, start with the basics: MFA, updates, backups and admin accounts. A pentest on a system without those mostly tells you what a simple checklist would. Our Microsoft 365 security checklist is a good first pass.
What a penetration test report should contain
The report is what you pay for. You will show it to clients, auditors or insurers, and your developers will work from it.
Pentest report checklist
Agree in the quote that one retest of the fixed findings is included, and how long after the report you have to request it.
Do you actually need a penetration test?
You probably do if a client contract, tender, regulator or insurer asks for one, if you run a web app with customer logins or payments, or if you have made major changes to an exposed system. You probably do not, yet, if you have a brochure website on a managed platform and basic controls are not in place.
Start with a review of the basics, fix what it finds, then commission a licensed pentest for the systems that matter. Keep the reports; repeat testing after significant changes or as your contracts require.
Do it yourself or get help?
You can write the scope, collect quotes and check CSRO licences yourself. Penetration testing itself must be done by a licensed provider.
Before you pay for a pentest, our Security Health Check (S$290) reviews your Microsoft 365 or Google Workspace, website, domain and devices against the common basics, so the paid test focuses on real issues. Our Website Security Hardening (S$290) fixes common website findings such as outdated plugins, missing security headers and exposed admin pages, before or after a test.
Frequently asked questions
Published starting prices for a narrow, single-application scope begin around S$2,000 to S$3,000 as of October 2026, with broader web, API and network packages from about S$7,500. Most real scopes cost more, depending on the number of applications, endpoints, IP addresses, user roles and manual testing days. Compare quotes on the same written scope.
Yes. Under the Cybersecurity Act, penetration testing is a licensable service, and CSRO says all providers to the Singapore market need a licence, whether companies or individuals. Licences cost S$2,500 for businesses and S$1,250 for individuals and last 5 years. Check the provider on CSRO's register of licensed service providers.
A vulnerability scan uses automated tools to list known weaknesses. A penetration test adds skilled manual work to confirm which weaknesses can actually be exploited, chain them together and show the real impact. Scans are cheaper and useful regularly; a pentest gives deeper assurance for important systems.
It depends on the provider, so agree it in the quote. A retest checks that the findings you fixed are actually resolved and updates the report. Some providers include one retest, sometimes only for critical findings, while others charge separately. Confirm the time window for requesting it.
Not always. If you run a web application with logins or payments, or a client, tender or insurer asks for a pentest, you likely need one. If basic controls such as MFA, updates and backups are not yet in place, fix those first; a pentest would mainly confirm gaps a basic review would find.