Services
AI risk and cybersecurity, delivered on a fixed timeline
We help regulated companies in Singapore with security testing (including AI systems), the compliance evidence regulators ask for, and AI governance such as the AI inventory MAS requires. Fixed price, fixed dates.For licensed financial advisers, insurers, brokers, fund managers, payment institutions and digital banks.
Services and starting prices
MAS AI Inventory Sprint
Every AI use case in your firm found, risk-rated and ready for board approval in 10 business days.
S$15,000–20,000 fixed
AI system and agent red-team
One AI system or agent tested in 5 days against the risks Singapore's regulators name, retest included.
S$10,000–20,000 per system
Penetration testing
Web, API and network testing (VAPT), with the report in MAS TRM format and a retest.
From S$1,500 per asset
Cyber Essentials and Cyber Trust
Readiness for CSA's cybersecurity marks, through to certification.
From S$2,000
Compliance documentation
The evidence pack your auditor or regulator asks for, mapped to MAS TRM, CSA, IMDA or ISO/IEC 42001.
Priced per framework
Training
Board briefings and team sessions on the MAS AI guidelines, CSA and IMDA AI frameworks, and Cyber Essentials and Cyber Trust.
Priced per session
Starting prices in Singapore dollars. The price and dates for your scope are fixed in the proposal before work starts.
The MAS AI inventory
MAS has given every financial institution in Singapore until 7 October 2027 to identify and risk-rate every AI use case it runs, including AI inside the services of its material third-party providers. Epiphyte runs the inventory with your teams.
Identification. Across business units and vendors, including AI in services from material third-party providers (para 4.2) and SaaS not sold as AI that contains AI features (footnote 21).
The rating. Each use case rated on impact, complexity and reliance (para 4.12). Residual materiality sits within your risk appetite before deployment (para 4.11), and a designated control function approves the rating (para 4.13).
Gaps by paragraph. The open gaps against the Guidelines, listed by paragraph, and the work to close them.
The board's numbers. AI risk sits in the board's risk appetite (para 3.4(b)). Footnote 18 names the measures: number and financial impact of AI incidents, material AI use cases dependent on a single provider, and material AI use cases breaching performance thresholds.
For AI vendors. Under para 5.10 your customers test your AI in their own use cases, with their own data. Vendors that arrive with their own test evidence shorten that process. Epiphyte prepares it.
Two dates
MAS issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They apply to all financial institutions (para 1.5), and para 1.8 sets two dates.
7 October 2027. Sections 3 and 4: board-approved AI governance, AI in the risk appetite, and a risk-rated inventory of every AI use case.
7 October 2028. Sections 5 and 6: lifecycle controls, including testing, validation, monitoring, third-party AI, change and decommissioning.
The 2027 rating sets the 2028 workload.
What counts as AI
Footnote 6: machine learning, natural language processing, computer vision, generative AI and AI agents. Rule-based systems, manually specified formulae and fixed-instruction RPA are not ordinarily in scope. One test: was the logic learned from data, or written by a person?
MAS AI Inventory Sprint: board-ready in 10 business days
From 7 October 2027 MAS expects a board-approved inventory of every AI use, including AI inside vendor software, each rated for materiality. We build it in 10 business days: discovery, inventory and ratings, vendor questionnaires, and a gap list by MAS paragraph with a board paper ready for approval.
S$15,000–20,000, fixed.
Fee refunded if not delivered on time.
Other services
- AI security testingRed-teaming and testing of AI systems against the OWASP Top 10 for LLM Applications, with Monarch.Read more
- EU AI Act and ISO/IEC 42001 readinessReadiness and gap assessments for the EU AI Act and the ISO/IEC 42001 AI management system standard.Read more
- Cyber Essentials to ISO/IEC 27001From a CSA Cyber Essentials mark to Cyber Trust and ISO/IEC 27001, reusing the work you already have.Read more
- Automotive cybersecurity trainingUN R155 and R156 training for regulators, manufacturers and suppliers, as private cohorts from one day to a 13-day assessor track.Read more
Talk to us
Advisory, testing and gap closure.