In this guide · 8 sections
- 01Vulnerability assessment vs penetration test at a glance
- 02What a vulnerability assessment covers
- 03What a penetration test adds
- 04Licensing: who can sell penetration testing in Singapore
- 05How often, and what tenders and clients usually ask for
- 06Which one does your business need?
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
A vulnerability assessment scans your systems for known weaknesses and lists them. A penetration test has a skilled tester try to break in and shows what an attacker could really do. Most SMEs need regular scans first, and a pentest for exposed systems with sensitive data or when a client asks.
Vulnerability assessment vs penetration test at a glance
The simplest way to remember it: a vulnerability assessment checks which doors and windows are unlocked. A penetration test sends someone to try them and see how far into the house they get.
Vulnerability assessment (VA)
Start here- Mostly automated scanning plus review
- Finds known flaws, weak settings and open ports
- Broad coverage, little proof of impact
- Hours to a few days
- Can run monthly or quarterly
Best for: Regular hygiene for any business with a website or servers.
Penetration test (PT)
- Skilled tester, manual and creative
- Exploits flaws and chains them together
- Narrower scope, shows real impact
- Days to weeks
- Usually yearly or after big changes
Best for: Internet-facing systems holding sensitive data, or when a client or regulator requires it.
"VAPT" simply means both: a scan to find issues, and a test to see which ones can really be exploited.
What a vulnerability assessment covers
MAS's Technology Risk Management Guidelines give a good minimum scope, even for businesses outside finance. Section 13.1.2 says a VA should at least include vulnerability discovery, weak security configurations, open network ports and application vulnerabilities, and for web systems, checks on common web vulnerabilities.
- External scan: your website, email server, VPN and anything else reachable from the internet.
- Internal scan: office PCs, servers and network devices, run from inside the network.
- Web application scan: automated checks for common web flaws such as those in the OWASP Top 10, whose current edition is 2025.
- Cloud configuration review: Microsoft 365, Google Workspace or AWS settings against best practice.
The output is a ranked list, usually by severity score, with fixes. Its weakness is false positives and no proof: it says a flaw might be there, not what an attacker could do with it.
What a penetration test adds
A pentest is a time-boxed attack by a skilled person, within an agreed scope and rules. MAS's guidelines (13.2) describe two common types: blackbox testing, with no prior knowledge beyond IP ranges and URLs, and greybox testing, where the tester logs in with normal customer rights.
A good pentest shows things scanners miss: business logic flaws (changing a price in a checkout request, viewing another customer's order by editing a number), chained weaknesses, and whether a stolen staff login leads to wider access.
Licensing: who can sell penetration testing in Singapore
Under the Cybersecurity Act, two services are licensable in Singapore: penetration testing and managed security operations centre (SOC) monitoring. The CSRO FAQ says all providers of these services to the Singapore market need a licence, including individuals, resellers and overseas providers. A company testing only its own related companies is exempt. Vulnerability scanning on its own is not one of the two licensable services.
CSRO also says that from 16 March 2026, licence applicants must hold a Cyber Trust mark (Promoter, Tier 3) or equivalent, with a grace period until 31 December 2026. You can check a provider on CSRO's list of licensed service providers. Our guide to the cybersecurity service provider licence covers the rules in more detail.
How often, and what tenders and clients usually ask for
There is no single legal frequency for SMEs. These are the reference points you are most likely to meet:
| Who asks | What they usually expect | Source |
|---|---|---|
| MAS-regulated firms | Regular VA; PT on internet-facing systems at least once a year or after major changes | MAS TRM Guidelines 13.1, 13.2.4 |
| Card payments (PCI DSS) | Depends on your SAQ type; some require quarterly external scans by an approved scanning vendor | See our PCI DSS guide |
| CSA Cyber Essentials | No pentest required; patching, secure settings and access control instead | Cyber Essentials checklist |
| Corporate clients and tenders | Often a recent pentest summary or VAPT report for the system you will host or build | Their vendor questionnaire |
Before you buy, ask the client exactly what they need: a full report or an executive summary, which systems, how recent, and whether they need a retest letter confirming high-severity issues were fixed.
Which one does your business need?
For most small businesses, the order is: fix the basics, scan regularly, and pentest only what is exposed and valuable.
Get the basics in place
MFA everywhere, patching, backups and admin hygiene. A pentest on an unpatched site mostly lists issues a free scan would have found.
Run an external vulnerability scan
Scan your website and anything else on the internet. Fix critical and high findings within a set time, then rescan.
Scan on a schedule
Quarterly is a reasonable rhythm for a small business, and after any major website or server change.
Pentest what matters
Commission a pentest for customer portals, online stores with custom code, apps holding personal data, or when a client, insurer or regulator asks.
Retest and keep the evidence
After fixes, ask for a retest of the serious findings. Keep the report, the fix log and the retest letter together.
If your website has already been compromised, neither test comes first. Follow our website hacked guide to clean up, then test.
Do it yourself or get help?
Free and low-cost scanners can give a small business a reasonable external picture, as long as someone reads the results and fixes them. A penetration test should always come from a CSA-licensed provider. Our guide to choosing a cybersecurity company lists what to check.
We do not sell penetration tests. Our Security Health Check (S$290) reviews your domain, website, email and Microsoft 365 or Google settings, so you fix the basics before paying for a pentest. Website Security Hardening (S$290) fixes the common website findings.
Frequently asked questions
A vulnerability assessment scans systems for known weaknesses and lists them by severity. A penetration test has a skilled tester actively try to exploit weaknesses, often chaining them, to show what an attacker could actually achieve. VA is broad and frequent; PT is deeper, narrower and usually done less often.
Yes. Under the Cybersecurity Act, providers of penetration testing services to the Singapore market need a cybersecurity service provider licence from CSRO, whether they are companies, individuals, resellers or overseas firms. Employees testing on behalf of a licensed employer do not need their own licence. You can check providers on CSRO's list.
There is no general legal requirement for SMEs. MAS expects financial institutions to pentest internet-facing systems at least once a year or after major changes, which is a sensible benchmark for any system holding sensitive customer data. Many small businesses only need regular vulnerability scans plus a pentest when a client or regulator asks.
CSA's Cyber Essentials mark does not require a penetration test. It focuses on measures such as asset inventory, patching, secure configuration, access control, backups and incident response. Regular vulnerability scanning helps you show that systems are patched and securely configured, but it is a tool, not a certification requirement on its own.
A useful report has an executive summary, the agreed scope and dates, each finding with its severity, evidence of how it was exploited and a clear fix, plus an overall risk rating. Ask for a retest after you fix serious findings, and a short letter confirming the retest results that you can share with clients.