7 Best Penetration Testing Companies in Singapore (2026)
Compare 7 penetration testing and vulnerability assessment providers in Singapore, from web and app testing to red teaming, with tips on scoping a pentest.
- Edited by
- Amir Wahab
- Published
- Reading time
- 6 min read
AI image by LocalRankA penetration test is a controlled attack on your own systems, carried out so that weaknesses are found and fixed before a real intruder uses them. In Singapore, firms that sell this work are expected to be licensed by the Cyber Security Agency, and many also hold CREST accreditation, so the first job is separating testing specialists from general IT vendors. This list brings together seven providers whose own websites describe penetration testing, vulnerability assessment or red teaming. Credentials below are reported as each firm states them, not independently audited. Use the entries to shortlist two or three, then ask each for a sample report, a named tester and a written scope before you commit.
1. Vantage Point Security
Vantage Point Security describes itself as a CREST approved penetration testing provider and lists these test types: mobile apps for iOS and Android, web applications, APIs across REST, GraphQL, gRPC and SOAP, thick clients, external and internal networks, wireless, Active Directory and IoT hardware. It also lists cloud security assessments covering the major providers. The firm says it has more than fifty CREST-registered consultants as of 2026 and points visitors to a CREST marketplace listing so the claim can be checked independently. Findings, it says, are CVSS-scored and delivered through its own reporting platform. That makes it worth a look for teams with an unusual mix of targets, such as a mobile app, a connected device and a cloud back end.
2. Wizlynx Group
Wizlynx Group presents itself as a Swiss cybersecurity provider with a Singapore presence, and its Singapore pages list vulnerability assessment, penetration testing, red teaming and social engineering as separate services. It also lists assessments for IoT devices, industrial control systems and cloud environments, plus secure code review. The firm says it has held CREST accreditation since 2017 and notes that, in Singapore, this credential is recognised by the Cyber Security Agency and its Cybersecurity Services Regulation Office as an indicator of competence. That mix of ordinary application testing and more specialised operational technology work may suit manufacturers, utilities or logistics operators who need a tester comfortable outside standard office networks. Confirm the Singapore licence status directly before signing.
3. STAR Labs SG
STAR Labs calls itself a Singapore-based offensive security firm whose roots lie in vulnerability research. Its site lists penetration testing across web, mobile, network, cloud and infrastructure, and says the work is licensed in Singapore. It also lists red teaming, source code audits and training, and publishes a stream of CVE advisories and research write-ups, including entries dated in 2026. It says it has placed in the Pwn2Own contest, most recently in Berlin in May 2026. For buyers, the draw is depth: the firm says its testers also hunt zero-day bugs in widely used software, which can matter if you ship a product or run unusual technology rather than a standard website. Check the licence on the official register.
4. Swarmnetics
Swarmnetics describes a core team based in Singapore whose testers are CREST certified and also hold the OSCP qualification, and its homepage states that the firm is CREST accredited. Its published service set is tidy and easy to scope: vulnerability assessment using scanners, penetration testing, configuration review of servers and network devices, source code analysis, and adversarial emulation that combines phishing, red-team and purple-team exercises. The site advises quarterly vulnerability scans and at least one penetration test a year for networks, web and mobile applications, plus a retest after major changes, which is a useful rule of thumb for planning a yearly security budget. It suits small and mid-sized organisations that want a clear menu and a regular testing rhythm rather than a one-off engagement.
5. Perennial Consultancy
Perennial Consultancy markets licensed vulnerability assessment and penetration testing for Singapore organisations and says it is CREST certified. Its penetration testing page is unusually practical: it explains how to choose between network, application (web, API and mobile) and Wi-Fi testing, and between black box and grey box approaches, based on what you run and why you need the test. The firm says its manual testing targets business logic flaws, broken access control and privilege escalation, and it mentions alignment with MAS technology risk guidelines, government IM8 requirements, OWASP Top 10 and CVSS scoring. It also publishes tiered website testing packages with indicative pricing and a five-stage method running from scoping to retest, so check the current figures. A good fit for first-time buyers.
6. softScheck APAC
softScheck APAC describes itself as a research-driven security consultancy that has been CREST accredited in Singapore since 2017, and says its consultants hold CREST Practitioner Security Analyst and Registered Penetration Tester qualifications. Its penetration testing page lists mobile application, network, thick client, web application and wireless testing, along with white box testing, IoT security testing and web application threat modelling. The firm says it combines manual and automated techniques and uses non-destructive methods on networks, and that its methodology draws on OWASP, PTES and OSSTMM. The CREST member directory also carries a listing for the firm, which gives buyers a way to cross-check the claim. It is a sensible choice if you want a testing-focused consultancy and a clear catalogue of test types.
7. NCS
NCS is a large Singapore technology services company, and a case study on its site describes a penetration testing engagement for a client that needed to check security controls ahead of rolling out information systems and applications. The write-up says the team combined tools and manual techniques, followed recognised methodologies such as PTES, and ranked the vulnerabilities and fixes by risk level. It reflects a delivery style aimed at public sector and regulated environments, where testing sits inside a wider programme of systems integration and managed security. Larger buyers may like having testing, remediation and operations under one contract. NCS publishes this work as an anonymised case rather than a price list or a CREST claim, so ask which credentials apply.
How to choose
- Check the licence first. In Singapore, penetration testing is a licensed service, so ask each provider for its licence reference and look it up on the regulator's published register rather than relying on a logo. CREST accreditation is a useful quality signal, but it is not the same thing as a licence.
- Define the target before you request quotes. A marketing website, a mobile banking app, an internal network with Active Directory and a connected device each need different skills and different days of effort. Write down URLs, user roles, environments and out-of-scope systems so every quote covers the same work and can be compared fairly.
- Understand the test style. Black box testing starts with no information and shows what an outsider sees. Grey box gives the tester a login or two and usually finds more business logic flaws in the same time. Ask which style fits your goal, and whether the report will distinguish verified exploits from scanner output.
- Ask for a sample report and named testers. A good report ranks findings by severity, shows reproduction steps and gives practical fixes. Confirm who will actually do the work, what qualifications they hold, and whether the quote includes a retest after you have patched, since many teams need at least one round of verification.
- Match the provider to your compliance driver. Financial firms often reference MAS technology risk guidelines, government vendors face agency rules, and card handlers face PCI DSS. Tell the provider which framework you answer to, and ask how its report will be accepted by your auditor, regulator or enterprise client.
. No changes recorded since.
Founder and Editor
Amir Wahab is the founder and editor of LocalRank, an independent Singapore rankings and local guides publication.
Read next
6 Best Zoho Partners in Singapore (2026)
Six Zoho partners serving Singapore SMEs for CRM, Books and Creator set-up, customisation, migration and support, with what each lists and how to choose.
By Amir Wahab5 min read
6 Best Salesforce Consultants in Singapore (2026)
Compare 6 Salesforce consultants and implementation partners in Singapore, from SME specialists to enterprise integrators, with what each says it offers.
By Amir Wahab5 min read
7 Best RFID Solution Providers in Singapore (2026)
Compare 7 RFID solution providers in Singapore for inventory tagging, asset tracking and access, with what each says it supplies and how to choose one.
By Amir Wahab6 min read
6 Best Odoo Implementation Partners in Singapore (2026)
Compare six Odoo implementation partners in Singapore for SMEs, with notes on modules, InvoiceNow support, grants and how to choose the right ERP team.
By Amir Wahab5 min read