What minimum project size does Testlio publish, and does Edgescan publish one of its own?

Testlio's profile lists a minimum project size of 75,000 US dollars, sourced from its Clutch listing and checked 3 September 2026. Edgescan's profile carries no minimum project size at all, checked 2 September 2026. A buyer scoping a smaller security assessment has no equivalent figure to weigh against Testlio's stated floor, only its absence. The field to watch afterward is minimum project on Edgescan's own profile, since a later update could add a number where none exists now.

Are Edgescan and Testlio each independently owned, or does either sit inside a larger group?

Edgescan's profile records its ownership type as independent, checked 2 September 2026. No source reviewed names a parent company for it. Testlio's profile records the same ownership type, independent, checked 3 September 2026. No source reviewed names a parent company for it either. A matching value on each profile records what the sources show today, not a guarantee against a future sale or acquisition. A buyer with a procurement rule against vendors tied to a parent group should ask each company directly whether a sale or merger is under discussion, then recheck the answer against the ownership field on the relevant profile.

Edgescan vs Testlio

QA Rating is published independently, and its publisher owns no company listed in this catalog.

Edgescan meets the conditions for Security focus; Testlio meets the conditions for Embedded team model. The catalog has Certificates, Signs a BAA / GDPR DPA only for Edgescan, and Published rates, Minimum project only for Testlio. Neither publishes Frameworks, Client stages, Onboarding, Crowd tester pool, Device lab, so the table cannot answer those.

Field by field

Edgescan and Testlio compared on the fields published for every company in this catalog
Field	Edgescan	Testlio
Headquarters	Dublin, Ireland	Austin, the USA
Delivery locations	Ireland, the USA	the USA, Estonia
Team size	51-200 people	51-200 people
Founded	2011	2012
Ownership	Independent	Independent
Services	Penetration testing, Security testing, Attack surface management	Manual testing, Payment flow testing, AI system testing, Accessibility testing, Localization testing, Usability testing, Mobile app testing
Industries	Banking, Healthcare, Ecommerce, Telecom	Ecommerce, Banking, Media, Education, Automotive, Travel
Frameworks	Not published	Not published
Engagement models	Continuous testing program, On-demand testing	Crowdtesting, Dedicated team
Client stages	Not published	Not published
Certificates	ISO/IEC 27001register entryCRESTregister entry	No certificate confirmed by a register entry
Signs a BAA / GDPR DPA	Not confirmed / Yes	Not confirmed / Not confirmed
Published ratespublished by one of the two	Not published	Blended $25-49/hgoodfirms.co
Minimum projectpublished by one of the two	Not published	$75,000clutch.co
Onboarding	Not published	Not published
Crowd tester pool	Not published	Not published
Device lab	Not published	Not published

Who each one fits

Edgescan fits a buyer whose priority is an outside check on where a network or application could be broken into, run as a narrow, security-only engagement instead of a broader QA relationship. Testlio fits a buyer whose priority is a team that sits alongside product development across many functional areas, from payment flows to localization, where a security check alone would not cover the rest of the release.

Onboarding is unpublished on either profile, and the gap plays out differently depending on which side of this pair a buyer is looking at. A security engagement usually opens with asset discovery, scoping which systems are actually in play before testing starts, and no source says how long that stage runs before findings begin to arrive. An embedded team opens with the reverse problem: the assigned testers need to learn the product before they can work without the buyer's own staff walking them through it, and no ramp-up timeline is published either. A buyer weighing the pair should ask what the first weeks actually produce: security findings on Edgescan's side, or an independent working team on Testlio's, then check the answer later against onboarding once either profile publishes it.

A tag is attached when the company's published fields meet its condition, never by judgement. Both lists come from the same closed vocabulary, so a tag missing from one side means the condition was not met, not that nobody looked.

Edgescan

Security focus

Testlio

Embedded team model

Both meet the conditions for Nearshore for the EU, so those conditions do not separate them.

Where the data runs out

Completeness against the 14 fields of the comparison checklist is 71% for Edgescan and 71% for Testlio. A field is counted as filled when a source confirms it, so a gap means nobody published it.

Neither company has a value recorded for these fields: Frameworks, Client stages, Onboarding, Crowd tester pool, Device lab. The table shows those rows empty rather than estimating them.

Field definitions and the completeness checklist are on the methodology page. The sources behind each field are listed on the Edgescan profile and the Testlio profile.

Questions

What minimum project size does Testlio publish, and does Edgescan publish one of its own?: Testlio's profile lists a minimum project size of 75,000 US dollars, sourced from its Clutch listing and checked 3 September 2026. Edgescan's profile carries no minimum project size at all, checked 2 September 2026. A buyer scoping a smaller security assessment has no equivalent figure to weigh against Testlio's stated floor, only its absence. The field to watch afterward is minimum project on Edgescan's own profile, since a later update could add a number where none exists now.
Are Edgescan and Testlio each independently owned, or does either sit inside a larger group?: Edgescan's profile records its ownership type as independent, checked 2 September 2026. No source reviewed names a parent company for it. Testlio's profile records the same ownership type, independent, checked 3 September 2026. No source reviewed names a parent company for it either. A matching value on each profile records what the sources show today, not a guarantee against a future sale or acquisition. A buyer with a procurement rule against vendors tied to a parent group should ask each company directly whether a sale or merger is under discussion, then recheck the answer against the ownership field on the relevant profile.

Published by QA RatingUpdated on September 6, 2026

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.