Questions About Working With Palisade

Book a free scoping call through the website. We will discuss your goals, current setup, timeline, and the pressure you are facing, then recommend a practical next step.

You do not need to choose perfectly before contacting us. If you need to build, redesign or clean up cloud or on-premises infrastructure, migrate systems, reduce cloud costs or improve deployments and reliability, start with Cloud & DevOps Consulting. If you need independent testing of an application, API, mobile app, cloud environment, or AI system, it usually starts with penetration testing. If you need help answering customer, compliance, or security readiness questions, it usually starts with Security Consulting & Readiness.

No. Many clients are early-stage or lean teams with founder-built infrastructure, a small engineering team, or no dedicated security function. We meet you where you are and focus on improvements that fit your stage and budget.

Most engagements begin within 1-2 weeks of scoping and approval. If you have a time-sensitive customer review, launch, or security concern, we can usually prioritize the first call and confirm what is realistic.

Every engagement starts with a scoping call. We look at the complexity of your environment, the service required, the depth of testing or advisory support, and your timeline. For penetration testing, bring the applications or systems in scope, user roles, available test access, and any customer or audit evidence requirements. You receive a proposal with the agreed coverage, deliverables and fees before work begins. Explore pricing and scope options

We review your cloud or on-premises infrastructure and agree what you want to improve. This can include checking an architecture before you build it, finding ways to reduce cloud costs, assessing an existing setup or planning a migration. We also review deployments, access, backups and monitoring where relevant. You receive a prioritised plan that your team can implement or engage us to help deliver.

Yes. We carry out the agreed work, including new cloud or on-premises builds, infrastructure redesign, migrations, cost optimisation and deployment automation. You can engage us to implement review findings or scope a project directly. Focused work is available on a daily-rate basis, with scope and fees agreed before it begins. View cloud and DevOps pricing

Yes. We design and build cloud and on-premises infrastructure around your applications, security needs and budget. For an existing environment, we help simplify the architecture, clean up unused resources and configuration, and make it easier for your team to maintain. The work includes implementation, testing and documentation so your team can operate the result.

Yes. We plan and carry out full migrations between cloud providers, from on-premises to cloud, and from cloud back to on-premises. We agree which applications and data need to move, prepare the destination, plan the production switchover and rollback, and test the migrated systems with your team before handover.

Yes. We compare your cloud bills with how your systems are actually used, identify unnecessary spending and help implement changes. This can mean removing unused resources, adjusting capacity, changing storage arrangements or simplifying the architecture. We consider performance, reliability and recovery needs when deciding what to change.

Yes. You can retain an engineer from quarter-time through to full-time, working on-site with your team in Singapore. The monthly retainer provides ongoing hands-on engineering and technical advice. We help build, redesign, clean up and migrate cloud or on-premises infrastructure, reduce cloud costs and improve deployments and reliability. We agree the capacity, scope and fees around the work your team needs. Explore ongoing engineering support

We agree priorities with your founder or engineering lead and work alongside your engineers on the selected improvements. During scoping, we establish the access needed, who reviews and approves changes, and who will operate the systems afterwards. Technical advisory supports the architecture and delivery decisions involved in that work.

Yes. A lot of useful work starts with systems that were built quickly to get a product to market. We help make that setup easier to operate, safer to change, easier to explain to customers, and more ready for the next stage of growth.

Yes. We can help map your cloud architecture, access model, deployment process, backup approach, logging, monitoring, and change controls into clear evidence for customer security reviews and vendor questionnaires.

Palisade Security Pte. Ltd. holds CSRO Licence CS/PTS/C-202507-002 for penetration testing services in Singapore. You can check the CSRO register of licensed service providers. View the CSRO register

A vulnerability assessment identifies and prioritises potential weaknesses, often with automated scanning and manual review. A penetration test goes further by validating exploitability and real-world impact. If a customer or auditor requests a penetration test, confirm the required scope and evidence before choosing a scanning-only assessment.

We test web applications, APIs, mobile applications, cloud infrastructure, and AI & LLM systems. Each assessment is scoped to your environment and follows recognized methodologies such as OWASP, OWASP MASVS, PTES, and NIST guidance where relevant.

Testers examine a system using internal information such as source code, architecture diagrams, and technical documentation. This helps them understand how security controls and business logic are implemented and test whether weaknesses can be exploited. We agree the scope, materials, and access before testing begins.

We recommend testing at least annually, and after major infrastructure changes, product launches, authentication changes, sensitive feature releases, or significant cloud architecture changes. Regulated or higher-risk environments may need testing more often.

A scoped assessment can provide evidence for financial institutions addressing MAS Technology Risk Management (TRM) expectations, and for organisations with applicable PCI DSS penetration testing requirements. For the PDPA, testing helps validate controls protecting personal data; PDPC guidance recommends vulnerability assessment and penetration testing in relevant circumstances. Each has different coverage and evidence needs. Share the applicable requirements during scoping so we can agree the systems, testing approach and reporting. Compliance also depends on controls and obligations beyond the test.

Yes. We test AI and LLM systems for risks such as prompt injection, unsafe tool use, data exposure, insecure integrations, model manipulation, and weak controls around AI-enabled workflows.

We follow recognized frameworks including OWASP Top 10, OWASP MASVS for mobile, PTES, and NIST guidance where relevant. Our approach combines automated coverage, targeted validation, exploitation where appropriate, and practical reporting by experienced security engineers.

Findings, remediation records, and retest results can provide evidence of how your security controls operate. We agree the test scope around your systems, risks, and evidence needs. Your independent CPA firm evaluates that evidence alongside the other controls and records needed for the SOC 2 examination.

Scanning helps identify technical vulnerabilities so your team can assess their significance and track remediation within its information security management system. Findings, risk decisions, and follow-up checks support your vulnerability management evidence. Scope and frequency should reflect your risks and controls; your certification body assesses the wider management system.

Yes. Public samples from an API assessment are available: a technical report, a management report, and a remediation summary. You can review the findings, supporting evidence, risk ratings, and remediation guidance before an engagement. View Sample Reports

We agree the target environment, testing window, permitted techniques, exclusions and emergency contact before testing. For production environments, we use non-destructive techniques unless otherwise agreed. If testing uses staging, we discuss differences from production that may limit what the results establish.

You receive an initial report with an executive summary, technical findings ranked by severity, proof-of-concept evidence, and remediation guidance. A findings walkthrough and one retest of the original findings within 60 days are included, followed by a final report. A letter of attestation is available on request. Agree any customer-specific reporting needs during scoping. View sample penetration testing reports

We provide remediation guidance and answer developer questions. One retest of the original findings within 60 days is included, followed by a final report. New features, substantial changes, or additional systems are scoped separately. For teams that need deeper help, we can also support practical remediation work through an advisory or implementation engagement.

Yes. If we discover a critical or actively exploitable issue, we notify you promptly instead of waiting for the final report. We then agree on a safe communication path and help your team understand the fix priority.

Yes. A penetration test evaluates specific systems for exploitable weaknesses. Security Consulting & Readiness looks at the broader operating model: customer security reviews, policies, cloud controls, secure development workflows, evidence, and practical remediation priorities.

Yes. We help teams answer vendor and customer security questionnaires with clearer evidence, realistic commitments, and remediation plans for gaps that need attention before the review is returned.

Yes. We can help prepare for these frameworks by reviewing current controls, identifying gaps, organizing evidence, and building a practical remediation plan. We do not turn readiness work into paperwork for its own sake. The goal is controls your team can actually operate.

Yes. All Palisade services are covered by our independently certified ISO/IEC 27001:2022 information security management system, including penetration testing, technical consultancy, and SaaS application services.

Yes. Training can be focused on the systems your team actually builds, such as secure API design, authentication, authorization, secrets handling, dependency hygiene, cloud security basics, AI security risks, and secure review habits.

Both. You can engage us for a focused review or test, or a project to build, redesign, clean up or migrate cloud and on-premises infrastructure. Retainers can cover hands-on cloud and DevOps work, cost optimisation, reliability improvements, periodic testing, customer review support, remediation guidance and secure development enablement. The scope is tailored to the work you actually need.

Our Pricing page shows starting prices for common penetration testing scopes, a fixed startup package, and Cloud & DevOps Consulting engagement options. Security Consulting & Readiness is quoted around the agreed outcomes and deliverables. Final scope, timing, and fees are confirmed in writing before work begins.

We accept bank transfers and major credit cards. For retainer engagements, we can discuss monthly or quarterly billing cycles.