The verdict in three sentences
Before going live, a B2B payments fintech in Singapore must show its app withstands a realistic attack: a grey-box penetration test costs roughly SGD 15,000 to 40,000 in 2026 for 5 to 10 days of testing. Ask for OWASP ASVS level 2 coverage, a retest included, and an executive report your partner bank and the MAS Technology Risk Management expectations can rely on. The schedule is decided after the test: allow 15 days to fix critical findings before the retest.
Define the scope before asking for a price
A pentest quote without a written scope is meaningless: two vendors can both say SGD 20,000 for unrelated work. Price depends on the number of user roles, API endpoints and sensitive flows (transfer, adding a payee, changing bank details).
| Scope item | B2B fintech example | Effect on duration |
|---|---|---|
| Customer web app | Corporate workspace, 4 roles (admin, maker, checker, viewer) | 2 to 3 days |
| REST API | 60 to 120 endpoints, OAuth 2.0 | 2 to 3 days |
| Internal back office | Compliance, support, limit management | 1 to 2 days |
| Mobile app | If it uses the same API | +1 to 2 days |
| Third-party integrations | Partner bank, PayNow rails, KYC vendor | 0.5 to 1 day |
| Report writing | Technical and executive | 1 day |
Grey box (the tester gets accounts for each role and the API docs) is the best trade-off: it simulates a malicious customer or compromised account, the most likely scenario in B2B payments.
2026 price grid in Singapore
| Package | Duration | 2026 ballpark (excl. GST) | For whom |
|---|---|---|---|
| Automated scan + light manual review | 2 to 3 days | SGD 5,000 to 9,000 | Prototype, not enough for launch |
| Grey-box web + API | 5 days | SGD 15,000 to 20,000 | MVP with a single portal |
| Full ASVS level 2 | 7 to 8 days | SGD 22,000 to 30,000 | Fintech before launch |
| ASVS level 2 + mobile + back office | 10 days | SGD 32,000 to 40,000 | Multi-channel platform |
| Retest after fixes | 1 to 2 days | Included in a good quote | All |
| CREST-accredited global firm | 8 to 10 days | SGD 50,000 and up | Demanding bank partner |
Check tester credentials (OSCP, OSWE, CREST CRT or equivalent): Singapore banks frequently ask for CREST-accredited providers.
What your bank partner and the regulator will actually read
Nobody reads 80 pages of screenshots. Reviewers look at the executive summary, the vulnerability list ranked by severity (CVSS score), proof of remediation and retest status. Your report should contain:
- a 2-page summary with the overall risk rating;
- the ASVS level 2 coverage matrix (authentication, sessions, access control, validation, cryptography, logging);
- for each finding: description, evidence, business impact, recommendation;
- a remediation tracker with dates and retest results.
The findings that most often delay a launch in 2026 are IDOR (reading another company's transfers by changing an ID), missing maker-checker on payee creation, and API tokens with overly long lifetimes.
Budgeting the remediation, not just the test
Most teams budget the pentest and forget the fixes. In practice, remediation of critical and high findings takes 8 to 15 developer-days on a typical B2B payments app, and the retest window is usually 30 to 60 days. Book the test at least 8 weeks before your planned launch: 1 week of testing, 3 to 5 days for the report, 2 to 3 weeks of fixes, then the retest and the final report. Teams that book it 2 weeks before launch almost always slip their date, which is far more expensive than the test itself.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Wei Ling, CTO of a B2B payments fintech in Singapore, plans to launch in 10 weeks. She picks an 8-day ASVS level 2 pentest at SGD 26,000, retest included. The test finds 2 critical issues (IDOR on transfer history, bypass of maker-checker), 5 high and 11 medium.
Her 3 developers spend 12 days fixing critical and high findings, about 36 person-days at SGD 700, so SGD 25,200 of internal time. Total cost: SGD 51,200. Compare that with a single IDOR fraud on an average SGD 120,000 transfer, or a 3-month launch delay costing around SGD 180,000 in burn with no revenue. The pentest pays for itself at the first avoided incident.
FAQ
Black, grey or white box?
Black box alone often misses cross-role access control flaws. Grey box, with test accounts and API documentation, covers 80 to 90% of realistic scenarios in 5 to 10 days.
Is the retest really included?
It should be, for 1 to 2 days within 30 to 60 days of the report. Turn down quotes that bill it at full rate.
Can we test in production?
Not advisable for a fintech. Use an identical staging environment with dummy data and capped amounts, limiting production to a few non-destructive checks.
Do we need a pentest every year?
Yes, at least annually and after each major change (new payment module, new public API). MAS guidance pushes many fintechs to budget 2 tests a year.
How long until we get the report?
Usually 3 to 5 working days after testing ends, with immediate notice of any critical finding.
Let's scope your project. We prepare your app and API for the pentest, fix the findings and support the retest within your launch timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
