Regulators, customers, and boards all want evidence that your systems have been tested by people thinking like attackers. VAPT (vulnerability assessment and penetration testing) provides that evidence and, done well, gives developers and administrators clear, reproducible findings they can fix. WC1 scopes, coordinates, and delivers VAPT engagements and the remediation that follows, including a grey-box assessment of a Philippine government system, and helps organisations in Singapore and the Philippines build vulnerability management programmes that keep risk down between tests.
The problem: why VAPT and vulnerability management matters
Many penetration test reports are long lists of scanner output with generic recommendations, delivered weeks after testing and never retested. Development teams struggle to reproduce findings, and critical issues remain open until the next annual test finds them again.
Between tests, new code, new infrastructure, and newly disclosed vulnerabilities change your risk constantly. Without a vulnerability management process, the test becomes a compliance ritual rather than a security improvement.
Who this service is for
Organisations launching or significantly changing applications, regulated entities with testing obligations, government agencies and their vendors, and software companies whose customers require independent security testing.
What WC1 delivers
Every engagement is scoped to your environment and risk. These are the building blocks we combine for VAPT and vulnerability management:
- Web application testing: Testing of authentication, authorisation, session management, input handling, and business logic, aligned to OWASP testing guidance.
- API and mobile testing: Testing of REST and GraphQL APIs and iOS and Android applications, including data storage and backend interaction.
- Network and infrastructure testing: External and internal network testing, including Active Directory and segmentation validation.
- Cloud configuration testing: Review and testing of cloud accounts for misconfigurations and privilege escalation paths.
- Grey-box and black-box options: Testing with varying levels of access and knowledge to match your objectives, from an external attacker to an insider.
- Vulnerability management programme: Scanning cadence, prioritisation, SLAs, exception handling, and reporting between penetration tests.
How the engagement runs
1. Scope
Agree objectives, targets, testing approach, rules of engagement, and testing windows. Obtain written authorisation.
2. Test
Perform assessment and manual testing, with immediate escalation of critical findings.
3. Report
Deliver an executive summary and technical findings with reproduction steps, risk ratings, and specific remediation guidance.
4. Support
Walk developers and administrators through findings and advise on fixes.
5. Retest and sustain
Retest remediated issues and, where required, set up continuous vulnerability management.
Commercial shape follows the work: a fixed-scope assessment or implementation when the problem is well bounded, or a retainer when you need ongoing operation, tuning, and reporting. Coverage hours, response times, and responsibilities are written into the statement of work so there are no surprises.
Deliverables you can expect
- Rules of engagement and signed authorisation
- Executive summary for management and auditors
- Technical report with reproducible findings and remediation guidance
- Findings walkthrough session
- Retest report confirming closure
- Vulnerability management process and SLAs (optional)
Platforms and tools we integrate
Testing uses industry-standard tooling such as Burp Suite, Nmap, OWASP ZAP, Nessus, and cloud assessment tools, alongside manual techniques. For ongoing vulnerability management we integrate Tenable, Qualys, Rapid7, Microsoft Defender Vulnerability Management, and Palo Alto Networks Cortex Xpanse with your ticketing system.
WC1 is vendor-neutral: we integrate the platforms you already own before recommending anything new. Naming a product here describes technology we work with; it does not imply a partnership, reseller agreement, or vendor certification.
Singapore: regulatory and market relevance
The MAS TRM Guidelines expect financial institutions to conduct penetration testing of internet-facing systems at least annually and before launching new systems or major changes, and to remediate findings promptly. IM8 requires security testing for government systems, and CSA’s Cybersecurity Code of Practice requires CII owners to conduct regular testing. We structure reports so they serve both remediation and audit evidence. Note that penetration testing offered in Singapore is a licensable cybersecurity service under the Cybersecurity Act, so for Singapore engagements we confirm the licensing position at scoping and, where required, testing is performed by or with a CSA-licensed provider while WC1 handles scoping, remediation engineering, and retest evidence.
Philippines: regulatory and market relevance
BSP Circular 982 expects banks to conduct regular vulnerability assessments and penetration testing. The National Cybersecurity Plan 2023-2028, adopted through Executive Order No. 58 (2024), calls for government agencies to submit annual VAPT reports on their critical information assets. WC1 has scoped and delivered a grey-box VAPT engagement for a Philippine government system, and we understand the documentation, authorisation, and handling expectations these engagements carry. Testing also supports reasonable security measures under the Data Privacy Act.
How this fits the rest of your security programme
VAPT and Vulnerability Management rarely stands alone. It works best alongside Continuous Threat Exposure Management, External Attack Surface Management, Application and API Security, Cloud Security and CNAPP. It also connects to our Custom Software, Application Modernization in Singapore services. See the full catalogue on our Cybersecurity services page.
Related reading: Acceptance test evidence pack before go-live.
Frequently asked questions
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment identifies and rates known weaknesses, often with automated tools. A penetration test goes further, manually exploiting weaknesses to show real impact, such as data access or privilege escalation.
What is grey-box testing?
Testing where the tester has partial knowledge or access, such as a user account or architecture documents. It is efficient and realistic for most business applications.
How often should we test?
At least annually for important systems, and before major releases or changes. Regulated institutions may have specific requirements, such as MAS expectations for internet-facing systems.
Do you retest after we fix issues?
Yes. Retesting of remediated findings is included in our standard engagements so you have evidence of closure.
Are you licensed to perform penetration testing in Singapore?
Penetration testing for the Singapore market is licensed by CSA. We confirm the licensing arrangement for each Singapore engagement during scoping, and where a licence is required the testing is carried out by or with a CSA-licensed provider. Engagements in the Philippines and other markets follow local requirements.
Will testing affect our production systems?
Testing is planned to avoid disruption, with agreed windows, rate limits, and no destructive techniques unless explicitly authorised.
Next step
Tell us which systems need testing, their size, and any regulatory deadline. We will propose a scope and testing approach. Contact WC1 for a no-obligation conversation; we will tell you honestly if we are not the right fit.