STAGE 01
Intake & scoping
Your specification and gateway configuration are parsed, reconciled and normalised. Undocumented or drifted endpoints are listed as gaps.
Analyst gate 1 · scopeAssessment, not a penetration test
Know what your APIs expose — before someone else does.
A self-serve API security assessment for Singapore SMEs. Upload your API documentation and gateway configuration; the portal derives the endpoint count and price. Every finding is human-reviewed and mapped to the PDPC/CSA joint advisory on insecure APIs.
Fixed scope · no per-seat SaaS fees · your data stays on your infrastructure · from S$1,200
Methodology
Seven stages, three human gates
The software does the volume. A named person does the judgement. Nothing is scored, approved or sent to you until it has passed a human gate.
STAGE 02
Configuration assessment
Deterministic rules evaluate declared authentication, authorisation, transport, headers and rate-limit settings against a published rule set.
AutomatedSTAGE 03
Automated assessment
Specification-driven test generation, stateful probing, configuration scanning and dependency checks run against the agreed boundary.
AutomatedSTAGE 04
Analytics & correlation
Raw results are deduplicated, correlated and grouped into candidate findings with a proposed category and severity.
AI-assistedSTAGE 05
Human validation
Each candidate finding is reproduced and confirmed, or rejected with a reason. Severity is ratified against the business impact.
Analyst gate 2 · findingsSTAGE 06
Report & recommendations
A second reviewer signs off the report, the advisory conformance summary and the remediation sequence before anything is issued.
Reviewer gate 3 · sign-offSTAGE 07
Customer review
You walk through the findings and agree what to fix first. You decide the order; we explain the trade-offs.
You · with usAI & human review
Fast where it should be. Accountable where it matters.
The model reads, groups and drafts. It never decides. Every externally visible claim carries a named human reviewer.
What AI does
Volume work, always checked by a person.
- Document interpretation — proposes candidate endpoints from unstructured gateway configuration, each confirmed against the source
- Test-case suggestion — additional probe cases drawn from your documented business description
- Triage and grouping — clusters raw results describing the same underlying issue
- Category mapping — suggests the OWASP category and advisory measure for each finding
- Report drafting — executive summary and finding descriptions from validated findings only
- PII redaction — flags personal data in evidence samples for masking
What a human owns
Judgement, severity and every external claim.
- Finding validation — a finding exists only once a person has reproduced it
- Severity ratification — the business impact, not just the CVSS base score
- Scope and rule-set approval — what may be tested, and against which rules
- Report sign-off — a second reviewer before anything reaches you
- Re-assessment decisions — whether a prior finding is genuinely closed
- Remediation advice — what to fix first, and why
What AI never does: originate a finding, set the final severity, approve anything, invent a countable value, or decide scope. Where data is ambiguous or missing, the output routes to a person rather than being inferred.
Pricing
Fixed scope, fixed price
The endpoint count is derived from your artefacts, not self-declared. You see the count, the breakdown and the price before you pay anything.
Essential
S$1,200 one-time
Up to 10 endpoints
- Full seven-stage assessment
- 1 human review included
- Advisory conformance summary
- Remediation roadmap
Standard
S$2,400 one-time
Up to 30 endpoints
- Everything in Essential
- Free re-assessment within 1 month
- Shadow-API reconciliation
- Annual option available at S$6,000
Extended
S$4,800 one-time
Up to 80 endpoints
- Everything in Standard
- Free re-assessment within 3 months
- Priority scheduling
- Annual option available at S$12,000
Estate
S$9,600 one-time
Up to 200 endpoints
- Everything in Extended
- Free re-assessment within 6 months
- Named delivery lead
- Annual option available at S$24,000
Annual subscription
Every plan is available annually at 2.5× the one-time price, with unlimited assessments and unlimited re-assessment for the subscription year.
Annual plans include two human reviews: the initial review after your first assessment, plus one additional review you schedule at any point in the subscription period. Recurring assessment and re-assessment results are shared automatically as soon as they complete — the human reviews are yours to spend, not a gate on your results.
Included
- Unlimited assessments
- Unlimited re-assessments
- Two human reviews
- Automatic result sharing
Chargeable
- Additional human reviews
- Scope above your endpoint band
- Remediation engineering
- Commercial tooling, if required
Additional human review of an assessment or re-assessment report: S$1,200 per review. · Commercial tooling is not included in the launch configuration; where a higher-assurance engagement needs it, it is scoped separately.
Scope boundary
An assessment, not a penetration test
Digital Futures is not licensed to provide penetration testing. This service is an assessment of how your APIs are configured and documented — and we say so plainly rather than let you infer otherwise.
What API-SAS does
We examine your documentation, gateway configuration and declared controls. We identify gaps, map them to the advisory, and tell you what to fix first.
In scope
- Parse and reconcile your API artefacts
- Assess declared authentication and authorisation
- Assess transport, header and rate-limit configuration
- Identify shadow and undocumented endpoints
- Map findings to OWASP and the advisory
- Recommend remediation and re-assessment
Not in scope
- Exploitation or proof-of-concept exploits
- Establishing or maintaining access
- Bypassing authentication controls
- Denial-of-service or stress testing
- Credential brute-forcing
- Any licensed penetration test
Need a penetration test instead?
Then you need a CSRO-licensed provider. We will tell you that directly and point you to the public register at csro.gov.sg, rather than implying a capability we do not have.
Our assessment is the thing that comes before that conversation: it tells you whether you need one, and where to point it.
Working with us
How engagements actually run
No sales sequence, no obligation, no procurement maze. These are the three ways customers start.
1
Self-serve, start to finish
Most common starting point
Upload your specification and gateway configuration, review the derived count and price, pay by card, and pick an assessment window. No call required unless you want one.
Upload → count → price → pay2
Consultation first
If you want a human before committing
Send your name, company, title, contact number, email and two or three preferred times. We confirm within one business day and run a 30-minute call — free, with no obligation to proceed.
30 minutes · no obligation3
Annual assurance
For teams that must show it annually
A year-round relationship: unlimited assessments and re-assessment, with results shared automatically as they complete, plus two human reviews to spend when you need them.
From S$3,000 / yearGet started
Tell us what you’re trying to fix.
Send your details and we’ll confirm a time within one business day. Or start self-serve and see your scope and price in minutes.
Email steve@digitalfutures.asia
Include: name · company · title · contact number · email · preferred date and time (with time zone).
Prefer to talk now? +65 9634 8084