Licensed Penetration Testing Companies in Singapore
Since 11 April 2022, a business that provides penetration testing to customers in Singapore needs a licence from the Cybersecurity Services Regulation Office (CSRO), part of the Cyber Security Agency of Singapore (CSA). This applies to overseas providers too.
This page explains how that licence works and how to check whether a provider holds one. The list of licensed businesses itself is published, and updated weekly, by CSRO: use the official CSRO register as the only source, because names are added and removed over time.
Who publishes this page. Budget Security, a penetration testing provider based in The Hague, the Netherlands. We do not hold a Singapore licence and we do not offer, sell or perform penetration testing for customers in Singapore. This page is information only: it summarises the public licensing rules and links to the regulator's own pages. We are not on the CSRO register. Corrections. If something on this page is wrong or out of date, email info@budgetsecurity.com and we correct it within two business days.
What counts as a penetration testing service
The Cybersecurity Act 2018 defines a penetration testing service as "a service for assessing, testing or evaluating the level of cybersecurity of a computer or computer system, by searching for vulnerabilities in, and compromising, the cybersecurity defences of the computer or computer system".
The definition expressly includes finding and demonstrating exploitable vulnerabilities, simulated attacks that test how an organisation detects and responds, quantifying vulnerabilities with mitigation advice, and social engineering. Since 31 October 2025, virtual computers and virtual systems are covered as well. The only other licensable service is managed security operations centre (SOC) monitoring, which needs its own licence.
Who needs a licence
- Businesses that provide penetration testing in Singapore. Section 24(1) bars anyone from engaging in the business of providing the service without a licence.
- Businesses that advertise it. The same section also covers anyone in the business who "advertise[s], or in any way hold[s] out" that they provide the service.
- Overseas providers. CSRO's FAQ says overseas providers "who provide licensable cybersecurity services to the Singapore market would need to be licensed", and that the Singapore market includes "persons with customers located in Singapore".
- Not employees. Staff who test on behalf of a licensed employer do not need their own licence. Freelancers without a registered business apply as individuals.
- Not related companies. A company that tests systems of its own related company does not need a licence.
- Not customers. Hiring an unlicensed provider is not an offence for the customer, but the provider commits one.
Fees, validity and how to apply
| Item | Current position (CSRO / GoBusiness) |
|---|---|
| Licence fee | S$2,500 for a company, S$1,250 for an individual. Paid after approval. |
| Validity | 5 years for applications approved from 16 March 2026 (older sources still quote 2 years). |
| Processing time | About 8 weeks after a complete application. |
| Where to apply | GoBusiness Licensing. Foreign companies without a Singapore presence use a Corppass account for foreign entities. |
| Fit and proper test | Officers are assessed for fraud or dishonesty convictions, insolvency and earlier revocations. Overseas officers supply a Certificate of Clearance. |
| Certification | From 16 March 2026, a Cyber Trust Mark Promoter (Tier 3) certificate or ISO/IEC 27001 scoped to the service, with a grace period to 31 December 2026. |
| Records | Customer, tester, date and type of service, kept for at least 3 years. |
| Conduct | No false representation, confidentiality of customer information, no conflicts of interest, compliance with the Computer Misuse Act and PDPA. |
Sources: Cybersecurity Act 2018, CSRO FAQ, GoBusiness licence page.
Penalties for testing without a licence
- Providing or advertising without a licence: "a fine not exceeding $50,000 or to imprisonment for a term not exceeding 2 years or to both" (section 24(2)).
- No right to be paid: an unlicensed provider cannot sue to recover its fee (section 31).
- False statements in an application: up to S$10,000 or 12 months.
- Licensees that breach conditions: up to S$10,000 per breach, capped at S$50,000, plus possible suspension or revocation.
How to check a provider
- Open the CSRO register of licensed service providers and download the Business Entity list. Penetration testing is section (B).
- Match the exact legal name and UEN on the provider's contract or invoice. Groups often hold licences per entity, so the entity you sign with must be on the list.
- Check the licence covers penetration testing, not only SOC monitoring.
- Licensees may describe their licence in text but may not use the CSRO or CSA logo.
Where penetration testing is expected in Singapore
The licence governs who may sell the service. Separate rules decide when an organisation is expected to commission one. The most common:
- MAS Technology Risk Management Guidelines (financial institutions and their vendors): section 13.1.1 asks for "regular vulnerability assessment (VA)", section 13.2.1 for "penetration testing (PT) to obtain an in-depth evaluation of its cyber security defences", and section 13.2.4 sets the cadence for internet-facing systems at "at least once annually or whenever these systems undergo major changes or updates". Source: MAS TRM Guidelines.
- CSA Cyber Essentials and Cyber Trust marks: neither names penetration testing as a condition on its CSA page, but a test report is common evidence that the declared measures hold.
- Customer and tender requirements: enterprise and government buyers often ask for "VAPT" (vulnerability assessment and penetration testing) as a line item. See VAPT vs penetration testing for what the term covers.
Questions to ask before you sign
- Which legal entity holds the licence? Ask for the exact name and UEN, and find it on the CSRO register under penetration testing.
- What exactly is in scope? Systems, environments, test types and testing days should be written down before work starts.
- Who does the testing? Ask for the testers' qualifications and whether any of the work is subcontracted.
- What does the report contain? Expect an executive summary, each finding with evidence, severity and remediation advice, and the scope and dates tested.
- Is a retest included? Most frameworks want proof that findings were fixed, not only found.
- How is your data handled? Licensees must keep customer information confidential and keep service records for at least 3 years.
Official sources
- CSRO register of licensed service providers: the current list of licensed businesses and individuals.
- CSRO FAQ: who needs a licence, overseas providers, customers.
- GoBusiness licence page: fees, documents and how to apply.
- Cybersecurity Act 2018: the law itself, Part 5 on licensing.
- Cyber Security Agency of Singapore: the national agency that runs CSRO.
FAQ
Questions about the Singapore licence
Where can I find the list of licensed penetration testing companies in Singapore?
On the CSRO website, under licensed service providers. Download the business entity list and look at the penetration testing section. CSRO updates it weekly, so check it on the day you engage a provider.
Do overseas penetration testing companies need a Singapore licence?
Yes, according to CSRO. Its FAQ says overseas providers that provide licensable services to the Singapore market need a licence, and the Singapore market includes providers with customers located in Singapore. Many foreign entities are on the register.
How much does a Singapore penetration testing licence cost?
S$2,500 for a company and S$1,250 for an individual, valid for 5 years for applications approved from 16 March 2026. Processing takes about 8 weeks.
Is it illegal to hire an unlicensed penetration tester in Singapore?
Not for the customer. CSRO's FAQ says engaging an unlicensed provider is not an offence for the customer. The provider commits the offence and cannot sue to recover its fee.
Do individual pentesters need a licence?
Not if they test on behalf of a licensed employer. Freelancers without a registered business need an individual licence.
Is Budget Security licensed in Singapore?
No. Budget Security does not hold a Singapore licence and does not offer or perform penetration testing for customers in Singapore. This page is information only.