A team with a limited budget for a first penetration test wants to know upfront whether either vendor sets a floor on project size. What does the published data show?

Berezha Security Group's published minimum project size is $5,000, sourced from its Clutch profile checked on 3 September 2026. BreachLock's profile carries no minimum project size field, so the catalog records that as unpublished rather than as evidence the firm takes on work of any size.

A buyer who specifically needs delivery hours inside the EU wants to confirm that the Nearshore for the EU tag on both firms is not resting on the same technicality. Where do their delivery locations actually sit?

Berezha Security Group's published delivery locations are Ukraine and Poland. BreachLock's published delivery locations are the United States, the United Kingdom, the Netherlands and India. The Nearshore for the EU condition is met by a location in the EU or the EEA, or by one in Ukraine, Georgia, Serbia or Moldova. Poland is the location that qualifies Berezha Security Group under that condition. The Netherlands plays the same role for BreachLock. Its other three delivery locations, the United States, the United Kingdom and India, sit outside the EU or the EEA.

Berezha Security Group vs BreachLock

QA Rating is published independently, and its publisher owns no company listed in this catalog.

Berezha Security Group and BreachLock meet the same applicability conditions (Nearshore for the EU), so the tags do not separate them. The catalog has Published rates, Minimum project only for Berezha Security Group, and Engagement models, Certificates only for BreachLock. Neither publishes Frameworks, Client stages, Signs a BAA / GDPR DPA, Onboarding, Crowd tester pool, Device lab, so the table cannot answer those.

Field by field

Berezha Security Group and BreachLock compared on the fields published for every company in this catalog
Field	Berezha Security Group	BreachLock
Headquarters	Kyiv, Ukraine	New York, the USA
Delivery locations	Ukraine, Poland	the USA, the UK, the Netherlands, India
Team size	11-50 people	51-200 people
Founded	2014	2019
Ownership	Independent	Independent
Services	Penetration testing, Security testing, Secure code review, Red teaming	Penetration testing, Red teaming, Secure code review, Attack surface management
Industries	Fintech, Banking, Ecommerce, Healthcare, Telecom, Games, SaaS	Banking, Manufacturing, Healthcare, Telecom, Ecommerce
Frameworks	Not published	Not published
Engagement modelspublished by one of the two	Not published	Managed testing service, On-demand testing, Continuous testing program
Client stages	Not published	Not published
Certificates	No certificate confirmed by a register entry	CRESTregister entry
Signs a BAA / GDPR DPA	Not confirmed / Not confirmed	Not confirmed / Not confirmed
Published ratespublished by one of the two	Blended $25-49/hclutch.co	Not published
Minimum projectpublished by one of the two	$5,000clutch.co	Not published
Onboarding	Not published	Not published
Crowd tester pool	Not published	Not published
Device lab	Not published	Not published

Who each one fits

A buyer whose test scope already includes ongoing exposure monitoring, not just a scheduled assessment, finds that signal in the services list: BreachLock's list reaches into attack surface management, a practice area Berezha Security Group's list does not carry. A buyer whose deciding sector is gaming or software product work reads the opposite signal from the industries list, where Berezha Security Group's history reaches into that territory and BreachLock's does not. Berezha Security Group and BreachLock also differ in where they are headquartered and how long they have operated: Berezha Security Group is the longer-established, Kyiv-headquartered firm with a narrower team, while BreachLock is the newer, New York-headquartered firm with a larger one. That distinction does not answer every question a contract will eventually need answered, and the fields the table leaves blank are the ones worth raising directly on the first call, then checking against whatever the statement of work confirms afterward.

A tag is attached when the company's published fields meet its condition, never by judgement. Both lists come from the same closed vocabulary, so a tag missing from one side means the condition was not met, not that nobody looked.

Berezha Security Group

Berezha Security Group meets no applicability condition in this catalog. That is a statement about what its published fields show, not about the company.

BreachLock

BreachLock meets no applicability condition in this catalog. That is a statement about what its published fields show, not about the company.

Both meet the conditions for Nearshore for the EU, so those conditions do not separate them.

Where the data runs out

Completeness against the 14 fields of the comparison checklist is 57% for Berezha Security Group and 64% for BreachLock. A field is counted as filled when a source confirms it, so a gap means nobody published it.

Neither company has a value recorded for these fields: Frameworks, Client stages, Signs a BAA / GDPR DPA, Onboarding, Crowd tester pool, Device lab. The table shows those rows empty rather than estimating them.

Field definitions and the completeness checklist are on the methodology page. The sources behind each field are listed on the Berezha Security Group profile and the BreachLock profile.

Questions

A team with a limited budget for a first penetration test wants to know upfront whether either vendor sets a floor on project size. What does the published data show?: Berezha Security Group's published minimum project size is $5,000, sourced from its Clutch profile checked on 3 September 2026. BreachLock's profile carries no minimum project size field, so the catalog records that as unpublished rather than as evidence the firm takes on work of any size.
A buyer who specifically needs delivery hours inside the EU wants to confirm that the Nearshore for the EU tag on both firms is not resting on the same technicality. Where do their delivery locations actually sit?: Berezha Security Group's published delivery locations are Ukraine and Poland. BreachLock's published delivery locations are the United States, the United Kingdom, the Netherlands and India. The Nearshore for the EU condition is met by a location in the EU or the EEA, or by one in Ukraine, Georgia, Serbia or Moldova. Poland is the location that qualifies Berezha Security Group under that condition. The Netherlands plays the same role for BreachLock. Its other three delivery locations, the United States, the United Kingdom and India, sit outside the EU or the EEA.

Published by QA RatingUpdated on September 6, 2026

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.