If you're shortlisting penetration testing providers in Singapore, you have a problem most people don't envy. The range is wide. Global consultancies that charge enterprise rates. Local boutiques that know the regulatory landscape. Product companies with a services arm bolted on.
This list covers ten firms with a confirmed Singapore presence and real penetration testing capabilities. I've kept the descriptions honest because I'd want the same if I were the buyer.
One disclosure upfront: Bravix Infosecurity is my company. It's on this list because it belongs here, but I've applied the same criteria to every entry. Take the ranking as a starting point, not a verdict.
1. Bravix Infosecurity
Certifications: CREST CRT, OSCP | Focus: Offensive assessments, AI security, OT/ICS security, VAPT
Bravix is a CREST-certified consultancy based in Singapore, built around manual penetration testing and AI/LLM security. Every finding is hand-verified. No scanner dumps dressed up as a report. The team comes from red teaming and bug bounty backgrounds, which means you get people who think like attackers, not auditors running checklists.
Two things separate Bravix from the rest of this list. First, AI security. If you're deploying LLMs, AI agents, or copilots and need someone to actually attack them, this is the niche Bravix occupies. Second, OT/ICS security -- operational technology and industrial control systems. Most firms treat OT as an afterthought. Bravix has people who understand both IT and plant-floor environments, which matters if you're in manufacturing, energy, or critical infrastructure. They also cover traditional VAPT, red teaming, GRC, and vCISO work for clients in fintech, healthcare, SaaS, and manufacturing.
On compliance: Bravix structures every penetration testing engagement to align with ISO 27001, PCI DSS, and MAS TRM requirements simultaneously. That means a single assessment covers the technical findings you need along with the evidence and reporting format your auditors expect. If you're a MAS-regulated financial institution, a PCI DSS-bound payment processor, or an ISO 27001-certified organisation preparing for surveillance audit, the testing maps directly to your compliance obligations without a separate gap assessment.
Best for: Organisations that want consultant-driven testing, not automated scans. Especially strong for AI security and OT/ICS environments.
2. Sekuro (formerly Privasec)
Certifications: ISO 27001 | Focus: Penetration testing, red teaming, security advisory, GRC
Sekuro (rebranded from Privasec) is a pentest-focused security consultancy with a Singapore office at International Plaza, Anson Road. They operate across Australia, Singapore, Malaysia, Philippines, and the UK. Unlike the Big Four firms on this list, Sekuro leads with offensive security -- penetration testing and red teaming are core services, not add-ons to a consulting engagement.
They're a practical mid-market option. If you want a firm that specialises in hands-on testing without the enterprise price tag of the global consultancies, Sekuro sits in that gap. Strong presence in the Australian market with growing APAC operations.
Best for: Mid-market organisations that want a pentest specialist rather than a generalist consulting firm, at a more accessible price point.
3. Insyghts Security
Certifications: CSA Cyber Essential/Trust aligned, ISO 27001 | Focus: Penetration testing, CISO-as-a-Service, 24/7 threat monitoring, security engineering
Insyghts Security is a Singapore-based consultancy covering penetration testing alongside a broader security management practice. Their pentest capabilities span web applications, network infrastructure, and cloud environments, complemented by vulnerability assessment services. They're a practical option for organisations that want testing bundled with ongoing security leadership.
Beyond offensive testing, Insyghts runs a 24/7 security operations centre for threat detection and response, supported by SIEM, XDR, and threat intelligence platforms. Their CISO-as-a-Service helps organisations achieve CSA Cyber Essential, Cyber Trust, and ISO 27001 certification. Their security engineering team handles cloud architecture across AWS, Azure, and hybrid environments.
Best for: Organisations that want penetration testing paired with vCISO leadership and continuous monitoring under one roof.
4. Infracom
Certifications: CREST Pathway+, ISO 27001, CSRO licensed | Focus: VAPT, GRC advisory (MAS TRM, PDPA, Essential Eight), SQEP placement, cloud security
Infracom has been operating in Singapore since 2008 — nearly two decades. They hold CREST Pathway+ recognition, ISO 27001 certification, and CSRO licensing. Their consultants are CISSP-ISSAP and CISM certified, with teams covering GRC advisory, penetration testing, and security engineering.
They're one of the few Singapore firms that spans the full IT stack — infrastructure, cloud, cybersecurity, and managed services — alongside specialist consulting practices in VAPT, GRC, and SQEP placement for government and regulated sectors. In 2026 they expanded into Australia under the Singapore-Australia Cybersecurity MOU (CSP 2.0), bringing Essential Eight and IRAP capabilities to the APAC market.
Best for: Government and regulated industries that need SQEP-led assurance, GRC advisory, and VAPT from a single Singapore-based provider.
5. ITSEC Asia
Certifications: CREST accredited, ISO 27001, ISO 9001, ISO 14001 | Focus: Penetration testing, OT/SCADA security, managed SOC, vulnerability assessment
ITSEC has been in the game for 16 years with offices in Indonesia, Singapore, Australia, UAE, and Mauritius. They hold CREST accreditation alongside three ISO certifications, which puts them in a small group of firms that have invested heavily in formal assurance. 400+ professional personnel and 7,000+ projects delivered.
They're particularly strong in OT/SCADA security -- one client testimonial specifically calls out improved OT security without interrupting production processes. If you're running industrial environments and need pentest coverage that understands plant-floor constraints, ITSEC has the experience.
Best for: OT/SCADA environments and organisations that want a CREST-accredited provider with deep APAC operational experience.
6. Accenture (Singapore Cybersecurity)
Certifications: ISO 27001, SOC 2, FedRAMP | Focus: Cyber resilience, managed security, AI-enabled security, zero trust transformation
Accenture's Singapore cybersecurity practice sits within their global security division. They're strong on the strategy and transformation side: security operations centre build-outs, zero trust architecture, identity management, and increasingly Gen AI security. Their annual State of Cybersecurity Resilience report is worth reading if you're benchmarking your program.
For hands-on penetration testing, they're competent but not specialised. You're paying for the Accenture machine -- project management, methodology, global threat intelligence -- rather than individual tester flair. That suits some organisations fine, particularly those that need a vendor their procurement team already trusts.
Best for: Large organisations that need security transformation programs (SOC, zero trust, identity) alongside assessment work, and want a single vendor for all of it.
accenture.com/sg-en/services/cybersecurity
7. Deloitte (Southeast Asia Cyber Risk)
Certifications: ISO 27001, SOC 2 | Focus: Cyber risk advisory, GRC, penetration testing, privacy (PDPA)
Deloitte's Southeast Asia cyber risk practice is headquartered in Singapore and is the most regulatory-savvy option on this list. If you're dealing with MAS TRM, PDPA compliance, or a major audit and need someone who speaks both security and governance fluently, Deloitte has the people and the methodologies.
On the technical testing side, they offer penetration testing and vulnerability management, but it's wrapped in a consulting framework. You'll get structured deliverables, clear remediation roadmaps, and executives who can present to a board. You won't necessarily get the most aggressive tester. Different tool for a different job.
Best for: Regulated industries (banking, insurance, healthcare) that need audit-ready security testing with strong governance and compliance reporting.
8. PwC (Singapore Cybersecurity)
Certifications: ISO 27001, SOC 2 | Focus: Cyber strategy, threat and vulnerability management, data privacy, identity and access management
PwC's Singapore cybersecurity practice sits within their broader consulting arm. They focus on cyber strategy and transformation, security operations, cloud security, and data privacy. Their threat and vulnerability management service covers penetration testing, though it's positioned as part of a wider risk program rather than a standalone engagement.
If you're already using PwC for audit or advisory work, extending to penetration testing is the path of least resistance. Strong on governance, compliance, and board-level reporting. Less specialised on hands-on offensive work than the boutiques higher up this list.
Best for: Existing PwC clients who want to consolidate vendors and value governance integration.
9. EY (Singapore Cybersecurity)
Certifications: ISO 27001, SOC 2 | Focus: Cyber resilience, technology risk, identity management, cyber incident resilience and response
EY's Singapore cybersecurity practice focuses on resilience, risk management, and digital transformation security. Their Cyber Incident Resilience and Response solution is a notable offering -- it bridges the gap between proactive testing and incident preparedness, which is useful if you want both from the same vendor.
Like the other Big Four firms, EY delivers penetration testing as part of a broader consulting engagement. The strength is in structured methodology, risk framing, and executive communication. For technical depth at the exploit level, the boutiques on this list will give you more per dollar.
Best for: Organisations that want cyber resilience and incident response planning alongside vulnerability assessment, from a Big Four framework.
10. KPMG (Singapore Cybersecurity)
Certifications: ISO 27001, SOC 2 | Focus: Technology risk consulting, cyber defence, cloud security, data privacy
KPMG's Singapore cyber security practice operates under their risk consulting division. They cover cyber strategy, security operations, cloud security, and data privacy. Their SG website has a dedicated cyber insights section, and they're active in the local regulatory conversation around MAS TRM and PDPA.
Similar profile to PwC and EY: strong on governance and risk, competent on technical testing but not as a core specialisation. If you're an existing KPMG client, they're a practical choice for consolidating your security assessments with your broader audit and advisory relationship.
Best for: Existing KPMG clients in regulated industries who want cybersecurity testing integrated with their audit and risk advisory program.
How to choose a penetration testing provider in Singapore
Before you sign anything, ask these questions:
- Who's actually doing the testing? Some firms sell the engagement then hand it to a junior consultant. Ask for the lead tester's certifications and experience. CREST CRT or OSCP is the minimum. If they can't tell you who's on the team, that's a red flag.
- Manual testing or scanner output? A real pentest involves manual exploitation, business logic testing, and chaining vulnerabilities together. A vulnerability scan run by a human is not a pentest. Ask how much of the engagement is manual.
- Do you understand Singapore's regulatory landscape? MAS TRM, PDPA, CSA guidelines, and the Cybersecurity Act all have specific testing requirements. Your provider should know which framework you're testing against without you explaining it.
- What does the report look like? Ask for a sample report (redacted). You should see: an executive summary your board can read, technical findings with proof-of-concept steps, and remediation guidance your engineers can act on. If the sample is 200 pages of Nessus output, walk away.
- What happens after the report? Good providers offer remediation support, retesting, and are available for questions after delivery. Bad ones hand you a PDF and disappear.
How much does penetration testing cost in Singapore?
Rough ranges based on what we see in the market:
- Web application pentest -- SGD 8,000 to SGD 25,000 depending on size and complexity
- Network infrastructure pentest -- SGD 10,000 to SGD 30,000 for an internal/external combo
- Mobile application pentest -- SGD 8,000 to SGD 20,000 per platform (iOS, Android)
- Red team engagement -- SGD 30,000 to SGD 80,000+ for a multi-week, full-scope exercise
- AI/LLM security assessment -- SGD 15,000 to SGD 40,000 depending on model complexity and deployment architecture
Prices vary based on scope, provider tier, and how quickly you need it done. The cheapest option is rarely the best value. A SGD 5,000 pentest that misses a critical vulnerability costs you more than a SGD 20,000 pentest that finds it.
Common questions
How often should we do penetration testing?
MAS-regulated financial institutions must test at least annually per MAS TRM requirements. For everyone else: annually for external-facing assets, after major architectural changes, and before any compliance audit. Some organisations run continuous testing with quarterly engagements. If you're unsure, your specific regulatory framework will tell you the minimum.
What's the difference between VAPT and penetration testing?
VAPT combines vulnerability assessment (automated scanning) with penetration testing (manual exploitation). Penetration testing is the manual part. A proper engagement includes both: scanning finds weaknesses, manual testing confirms which ones real attackers could exploit. For more detail, read our VAPT guide.
Do we need CREST certification from our provider?
For MAS-regulated entities, CREST is effectively expected. For government tenders in Singapore, it's often required. For private sector work, it's not mandatory but it's the strongest signal of technical competence. CREST accreditation means the firm and its testers have been independently assessed. Anyone can hold an OSCP. Not anyone can pass CREST's organisational review.
Looking for a penetration testing provider in Singapore?
Bravix Infosecurity is a CREST-certified cybersecurity consultancy. Manual testing, AI security specialisation, and reports your engineers can actually use. See our assessment services or get in touch.