10 Reliable Cybersecurity Audit Firms in Singapore

Singapore’s Cybersecurity Act 2018 and the Cybersecurity (Cybersecurity Service Providers) Regulations 2022 made it unlawful to offer penetration testing or managed SOC services without a valid CSA licence. Every firm below holds that licence, carries CREST accreditation, and can quote audit timelines in concrete person-days. None of them work on vague “advisory slides”; they issue findings that directly matter to MAS, IMDA, and your insurance carrier.

1. Ensign InfoSecurity

Ensign is Singapore’s largest homegrown cybersecurity firm, spun off from Singtel. Their audit practice focuses on critical information infrastructure (CII) and government-linked entities, running threat-led penetration tests against MITRE ATT&CK frameworks and simulating assumed-breach scenarios. A typical audit engagement lasts four to six weeks and ends with a findings report mapped against MAS TRM and CSA Cyber Essentials controls. They also operate a 24/7 SOC at their Singapore headquarters, so audit recommendations get tested against live telemetry, not just screenshots.

2. Horangi Cyber Security

Horangi, founded in Singapore and now part of the CrowdStrike group, is strongest in cloud-native audits. Their Warden product continuously scans AWS, Azure, and Google Cloud environments against the Australian government’s ISM, CIS Benchmarks, and AWS Foundational Security Best Practices. For audit work, Horangi runs cloud security posture reviews that pinpoint privilege escalation paths, misconfigured IAM policies, and exposed storage buckets — the exact issues Singaporean fintechs fail on during MAS visits. They are CREST-accredited and can deliver a cloud audit in two to three weeks for a mid-size environment.

3. Attila Cybertech

Attila is a boutique Singapore firm founded by ex-ST Engineering and government-linked security operators. They specialise in purple team audits where they fuse red team attack simulation with blue team detection validation. Their engagements often include building custom exploit chains against specific Java or .NET stacks used by local banks and maritime logistics platforms. Expect scoped bespoke work priced in the S$20,000–S$80,000 range, with written deliverables that document actual command-line execution paths, not generic OWASP Top 10 boilerplate.

4. Blackpanda

Blackpanda is Singapore-headquartered and focuses on incident response, digital forensics, and cyber insurance-grade security audits. Their audit reports rate client security controls against standards used by Lloyd’s and Lloyd’s-approved cyber underwriters — a practical requirement for any Singapore company buying cyber liability coverage. Their local DFIR team has an average incident triage response time under three hours within the island. For audit engagements, Blackpanda runs security fitness upgrades that test endpoint detection response (EDR) coverage, email gateway filtering, and backup integrity.

5. TrustNet

TrustNet is a compliance auditing firm with a dedicated Singapore practice for SOC 2, ISO 27001, HIPAA, and PDPA assessments. They are a practical choice for SaaS and fintech firms that need a clean external audit to close enterprise contracts. Their audit cycle typically runs four to six weeks, and they use their Compliance Manager portal to let clients track evidence requests in real time. For Singapore registrants, TrustNet’s team specifically checks PDPA breach notification obligations, consent withdrawal processes, and data retention schedules.

6. KPMG Singapore

KPMG’s Cyber Risk & Assurance practice in Singapore is a default auditor for financial institutions required to comply with MAS TRM Notice 644. They validate controls across internet banking, mobile apps, API gateways, and core banking systems. Their audit teams combine commercial vulnerability scanners with manual testing of transaction logic and anti-fraud systems. Engagements run eight to twelve weeks for large FSI scopes, and KPMG routinely advises on outsourcing notifications to MAS under paragraph 9.1 of TRM. Their reports are written to be submitted directly to regulators.

7. Deloitte Singapore

Deloitte’s Cyber & Strategic Risk team runs architecture-level audits, particularly zero-trust network assessments and privileged access management reviews. They are commonly brought in by multinational subsidiaries in Singapore that need an audit aligned with both local PDPA obligations and global parent-company frameworks like NIST 800-207. Their audit methodology includes cloud control matrix testing for public cloud workloads and identity governance reviews across Okta, Azure AD, and on-prem LDAP. For a typical enterprise environment, expect a six-to-eight-week timeline with multiple onsite verification rounds.

8. ST Engineering

ST Engineering’s cybersecurity division handles audits of operational technology (OT) and industrial control systems (ICS) for critical infrastructure — power grids, water treatment plants, and transport systems protected under the Cybersecurity Act. Their engineers test PLCs, SCADA HMIs, and serial-to-Ethernet gateways using specialised tools like Wireshark dissectors, Modbus fuzzing scripts, and honeypot deployments. ST Engineering also operates the national-level SOC infrastructure for several government agencies, giving them visibility that pure commercial firms lack. OT network penetration tests with physical plant access typically take four to six weeks.

9. Trustwave

Trustwave’s Singapore office maintains the SpiderLabs offensive security unit, which runs application penetration tests and PCI-DSS compliance assessments. Their audit relevance is high for e-payments operators using PayNow, SGQR, or NETS systems because Trustwave holds Qualified Security Assessor (QSA) status from the PCI Security Standards Council. A typical assessment covers cardholder data flows, tokenisation logic, and firewall rule reviews. Turnaround is three to four weeks for a standard web application, and their findings integrate directly with ServiceNow, Jira, and Redmine workflows.

10. ACROSS

ACROSS (Asia Cyber Risk & Security Solutions) is a Singapore consulting firm focused on governance, risk, and compliance (GRC) audits. They are the straightforward choice for SMEs applying for the CSA Cyber Trust Mark or needing a third-party security audit to satisfy corporate customers. Their audits cover the 18 control areas in the Cyber Trust framework and include a practical gap report that lists prioritised fixes with vendor-neutral product suggestions. ACROSS completes most SME certification audits in two to three weeks at fixed, published fees.