Mobile Application Penetration Testing (VAPT) Service
in Singapore

Yes, eligible SMEs can apply for CISOaaS VAPT grant of up to 70%, cap at endpoint tier.

More details here.

A Web Application VAPT focuses primarily on server-side components, such as web pages, backend applications, APIs, authentication, authorization, and business logic that are accessed through a web browser.

A Mobile Application VAPT includes these server-side assessments but also evaluates the mobile application installed on the user’s device. Additional client-side testing includes reverse engineering the compiled application, analyzing insecure local data storage, assessing runtime behaviour, and validating security controls such as SSL Certificate Pinning, Root & Jailbreak Detection, and anti-tampering mechanisms. These client-side assessments help identify risks that are unique to Android and iOS applications and cannot be evaluated through a standard web application penetration test.

• Lite Package: Best for hybrid apps, WebView wrappers (e.g., Capacitor, Ionic, Cordova), standalone apps, or clients who are already testing their APIs under a separate Web/API pentest. Focuses strictly on client-side security (binary reverse engineering, local data storage, hardcoded secrets, and local runtime behavior).

• Essential Package: Best for standard mobile apps with user authentication where you need full end-to-end testing, including live API security, network traffic interception, and server-side vulnerability checks.

• Enterprise Package: Best for complex applications with multiple user roles (e.g., Admin vs. Standard User), multi-tenant data isolation, custom business logic workflows, or strict compliance requirements.

If your backend APIs or web application are already covered under a separate Web Application or API Pentest, the Lite Package is the perfect complement. It ensures your mobile binary, client runtime, local storage, and app wrapper are secure without charging you twice for backend API testing.

An Application Security Control Assessment evaluates the effectiveness of security protections built into a mobile application to determine whether they can be bypassed under realistic attack scenarios. These controls are designed to make reverse engineering, traffic interception, and application tampering more difficult.

Typical assessments include validating the implementation and effectiveness of:

• SSL Certificate Pinning
• Root & Jailbreak Detection

Where applicable, controlled bypass techniques are performed to verify whether these security controls can be circumvented by an attacker, helping organizations understand their effectiveness and identify opportunities for improvement.

This is included in the Enterprise package.

Yes for Essential and Enterprise package. Backend APIs that are used by the mobile application are included in the assessment. Since mobile applications rely on APIs to authenticate users, exchange data, and perform business functions, testing these APIs is essential to identify security vulnerabilities such as broken authentication, authorization flaws, insecure data exposure, and other API-related risks.

Yes. We support penetration testing for both Android (.APK) and iOS (.IPA) applications.

Where the Android and iOS applications share the same backend APIs and implement similar business logic, many organizations choose to test the Android application only as a cost-effective approach. Android applications are generally easier to assess due to the availability of testing and instrumentation tools, while common backend vulnerabilities are identified through the shared API assessment.

However, testing both platforms is recommended when the Android and iOS applications have different implementations, platform-specific features, or unique security controls. An iOS assessment can identify issues that are specific to the iOS application, such as Keychain usage, platform-specific storage, or iOS-specific security implementations.

Yes, our testing methodology is  guided by the OWASP API Security Top 10 framework. We focus our assessments on the most critical, high-prevalence vulnerabilities and logic flaws within this standard that pose the greatest risk to your business

Duration depends on the scope:

Lite Package ~ 2-3 days

Essential Package ~1 week

Enterprise Package ~ 1.5 to 2 weeks.

Our report consists of:

1. Executive Summary
   • Overview of assessment
   • Findings categorized by OWASP Top 10
   • Attestation on areas you have done well
2. Risk Register
   • Findings tracker
3. Engagement scope
   • Scope of work, methodology and risk model used
4. Detailed Findings
   • Issue details and background
   • Issue remediation
   • Attestation