Penetration testing a fintech web app before launch in Singapore (2026)

The verdict in three sentences

For a lending fintech handling bank data and automated disbursements, a grey-box penetration test of 8 to 12 days scoped on OWASP ASVS level 2 costs SGD 15,000 to 35,000 in Singapore as a 2026 order of magnitude. The report only carries weight with MAS TRM expectations and your partner banks if it is followed by critical fixes within 2 weeks and a retest proving closure. Budget now for an annual test and a fresh test after every major change.

Black, grey or white box: choosing the scope

A black-box test simulates an outsider with no access: fine for the public surface, not enough for a lending app where the main risk comes from authenticated users. In grey box, testers get test accounts for each role (merchant, field officer, credit analyst, admin) and API documentation. They can then test what matters: can a merchant read another merchant's file, change a loan amount, or trigger a PayNow disbursement to an account that is not theirs?

For a launch, the best value is grey box on the web app and API, plus 3 to 4 days on the field officers' mobile app if there is one.

Prices and deliverables in Singapore in 2026

Rates depend on team experience, accreditation (CREST, OSCP, OSCE) and report depth. MAS-regulated entities and their bank partners generally expect CREST-accredited providers. A regulator-ready report includes an executive summary, CVSS scoring per finding, reproducible evidence and precise remediation guidance.

Always require a signed authorisation letter, a defined test window, a staging environment that mirrors production and an NDA. Without faithful staging, testers assess a different app from the one you launch.

Findings that keep coming back in lending fintechs

The same categories recur. First is broken access control (IDOR): changing an ID in the URL exposes another customer's file, with NRIC copies and bank statements. Next come business logic flaws: double submission of a disbursement request, changing the amount between approval and payout, bypassing limits by splitting loans. Unsigned payment webhooks let attackers fake repayments. Finally, long-lived session tokens on the field app expose the whole portfolio if a phone is lost.

OWASP ASVS gives a checkable list of more than 280 requirements, so MAS reviewers or bank risk teams can see what was tested. The MAS Technology Risk Management Guidelines and the Cyber Hygiene Notice add expectations on MFA, patching and security testing, while PDPA covers the KYC documents you collect. Centralising staff authentication also helps, as explained in our article on SSO and MFA for internal apps.

Mini case study

Wei Ling, CTO of a Singapore fintech lending to F&B and retail merchants, is preparing launch with a partner bank that requires a pentest report.

• Grey-box test of web, API and field app: SGD 28,000, 11 days.
• Report: 3 critical findings (IDOR on loan files, unverified payment webhook, bypassable limit), 7 medium.
• Fixes: 2 developers for 10 days at SGD 800 per day, SGD 16,000.
• Total pre-launch security spend: SGD 44,000, retest included.

On the other side, the unsigned webhook would have allowed unpaid loans to be marked as repaid. With 40 fraudulent files at an average SGD 25,000, the loss reaches SGD 1,000,000, about 23 times the cost of the exercise, before counting a likely freeze of the bank funding line.

FAQ

Does MAS require a pentest?

The TRM Guidelines expect regular security testing, including penetration testing, of internet-facing systems. In practice, partner banks ask for a report less than 12 months old.

How far ahead of launch should we book it?

Allow 6 to 8 weeks: 2 to 4 weeks lead time, 8 to 12 testing days, 2 weeks of fixes and the retest. A test started 10 days before go-live leaves critical findings in production.

Should the field officers' mobile app be tested?

Yes if it accesses customer files or triggers payouts. The extension costs SGD 6,000 to 10,000, small next to a portfolio exposed by one lost phone.

Isn't an automated scanner enough?

A scanner finds known technical flaws in hours but misses nearly all business logic issues, often more than half of the criticals in a fintech. It complements a pentest rather than replacing it.

How often should we retest?

At least yearly, and after each major change such as a new payment rail. The second test usually costs 60 to 80% of the first.

Let's scope your project. We prepare staging, test accounts and the remediation plan so your pentest report is usable before launch. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.