Your website passes every automated scan. The plugins are updated, the firewall is on, the padlock shows in the browser. Good. Now a different question: would it survive a skilled person who’s actually trying to get in?

That’s what a penetration test (pentest) answers. It’s also the thing a bank, a big client, or your insurer will eventually ask you for, usually in the middle of a deal you really want. Here’s what a pentest is, what it costs in Singapore in 2026, when you genuinely need one, and when you’re better off spending the money elsewhere first.

What a pentest actually is

A pentest is a controlled, authorised attack on your own system, run by a security professional who thinks like a criminal. They try to break in using the same methods real attackers use, then write up exactly what worked, how, and what to fix.

The key word is prove. A scanner tells you “this page might be vulnerable to SQL injection.” A pentester shows you they used it to pull your customer table out of the database. One is a rumour; the other is evidence you can’t argue with.

Scan vs pentest: the trap to avoid

This is where SMEs get burned. A vulnerability scan is automated: software checks your site against a list of known weaknesses, fast and cheap. Useful, but it only finds what’s on the list, and it can’t tell which findings matter.

A real pentest is mostly manual. A human chains small weaknesses together, tests your business logic (“can customer A see customer B’s invoice by changing a number in the URL?”), and checks things no scanner understands.

Some providers sell a repackaged scan and call it a pentest, at a pentest price. If the quote is suspiciously cheap, or the sample report reads like raw scanner output, ask what a human actually does.

The three flavours: black, grey, white box

Black box: the tester knows nothing, like an outsider. Realistic, but slow and expensive for what you learn.
Grey box: the tester gets login accounts (say, one per user role). They cover far more of your real functionality in the same time. For most SME web apps this is the best value.
White box: the tester also sees the source code. The deepest option, and the most costly.

Scope matters as much as the box colour: just the website, or also the API behind it, the mobile app, the cloud setup? Test what holds the valuable data.

What it costs in Singapore (2026)

Published local pricing is patchy and mostly comes from the vendors themselves, so treat these as ballpark figures and get two or three quotes:

A grey-box test of a typical business web application: roughly SGD 8,000 to 30,000, for about 5 to 15 tester-days.
Senior tester day rates: roughly SGD 1,200 to 2,000 a day. Cost is mostly days of skilled human time, which is why scope drives price.
Retest (checking your fixes actually worked): commonly priced as a fraction of the original test, so confirm it’s included or quoted upfront.
Automated scans: a few thousand dollars at most. Fine for what they are, but not a pentest.

And the line item people forget: the fixes. The report is the start of the bill, not the end. If findings keep two developers busy for weeks, that cost lands on you. Budget for it before you commission the test.

When you genuinely need one

A prospect or partner demands it. Enterprise and bank security questionnaires routinely ask for a recent, independent pentest report. (If that’s you, our SOC 2 post covers the wider audit picture, and a pentest is usually part of the evidence.)
You serve regulated customers. Financial-sector clients in Singapore work under technology-risk guidelines that expect testing of their vendors’ systems too.
You’re launching something that holds sensitive data: payments, health information, identity details, a client portal.
After a major rebuild or new feature set. New code is where new holes live.
Your insurer or auditor asks. It’s increasingly common.
You want a defensible answer under the PDPA. The Act requires “reasonable security arrangements” for the personal data you hold. A dated pentest report with a fix-and-retest trail is about the strongest evidence you can show that you took that seriously.

After the first test, treat it as annual, or whenever something big changes.

When to skip it (for now)

Honest advice: if you run a simple brochure site, or your basics are shaky, don’t buy a pentest yet.

Paying a specialist to tell you your plugins are out of date, you have no MFA, and your backups are untested is an expensive way to learn what a free checklist would have told you. Do the cheap things first: a proper firewall, plugin and update hygiene, MFA on every admin login, tested backups, and a data inventory so you know what you’re protecting. Then a pentest has something real to find, rather than the obvious.

Think of it as a driving test. You practise first; you don’t pay for the exam to learn where the pedals are.

How to choose a tester

Check licensing. Firms selling penetration testing services in Singapore fall under CSA’s cybersecurity service licensing regime. Ask for their licence and verify it on the official register.
Look for CREST accreditation, and check it yourself on CREST’s own registry rather than trusting a logo. MAS and CSA both reference it as a quality marker.
Ask for a sample report (redacted). You want clear, reproducible findings with severity ratings and fix guidance, not a pasted scanner dump.
Insist on manual testing, and ask what specifically the humans will do.
Keep it independent. The team that built the system shouldn’t be the only one grading it. A fresh pair of eyes finds what the builders are blind to.
Agree the rules upfront: scope, testing windows, a test environment that mirrors production, and who to call if something breaks.

What to do with the report

A report nobody acts on is the most expensive document in your filing cabinet. Fix critical and high findings first, get the retest done, and keep the final report. That fix-and-verify trail is the evidence your client, auditor or regulator actually wants.

The honest limit

A pentest is a snapshot. It tells you how you stood during those days, against those techniques. A clean report doesn’t mean you’re unbreakable; it means a skilled person didn’t find a way in this time. Security stays a habit (updates, access control, monitoring, regular retesting), not a certificate. Even the worst Singapore breach we’ve covered came down to one forgotten, untested asset, which is exactly why scope matters.

Where Oasis Web Asia comes in

We help you get ready for a pentest and get value out of it: hardening the basics first so you’re not paying to rediscover them, scoping the test around the systems that matter, working alongside an independent tester, and then fixing what turns up and getting it retested. It’s the same evidence-first web development Singapore SMEs use us for, pointed at the moment a client or auditor asks, “has anyone actually tried to break this?”

If a prospect just asked for your latest pentest report and you’re not sure what to hand over, that’s exactly the conversation we like to have.

Start a conversation → — get a free consultation with our Singapore-based team.