Does a vendor's published hourly rate reflect what it would cost to keep an automated test suite running over the working life of a production line?

A published hourly rate is a single blended figure for the team assigned to a project today, and it carries no information about how that figure would move across years of regression work as a line's control systems and interfaces are replaced piece by piece. 10 of the 26 companies in this composition publish a rate at all, so for the other 16 a buyer has no published starting figure regardless of how long the equipment is expected to stay in service. A rate quoted against the control software a line runs today and a rate quoted against the software it will run after its next retrofit are two different numbers, and only the first one exists as a field.

If a vendor doesn't name manufacturing clients in its profile, does that mean it hasn't tested software on a working production line?

An unnamed client history means the vendor has withheld who it has worked for from its public profile, and that gap says nothing about whether any of that undisclosed work happened on a working production line or involved on-site acceptance testing at a plant. Named clients are absent for 6 of the 26 companies in this composition, and for the other 20 a buyer can already check which sectors and settings those named clients operate in. A manufacturer evaluating a vendor with no named clients can ask directly for a reference from a comparable production environment before signing.

Does a vendor's silence on signing a GDPR data-processing agreement mean it can't take on a project handling telemetry data from plant equipment?

A blank answer on signing a GDPR data-processing agreement means the vendor has not put that specific commitment on record in its profile, and it says nothing about whether the vendor would sign one once asked for a project touching equipment telemetry. The field carries a confirmed answer for 1 of the 26 companies in this composition, leaving 25 rows with no published position either way. Whether telemetry from plant equipment crosses an EU border is decided by the architecture of the project itself, and the field records a vendor's standing position rather than an answer for any particular engagement.

For how many companies in this composition does the external-reviews field carry no published answer?

The external-reviews field carries no published answer for 15 of the 26 companies in this composition. The other 11 carry a recorded count, and on one of those the recorded count is zero.

Best Manufacturing QA companies in 2026

QA Rating is published independently, and its publisher owns no company listed in this catalog.

26 testing companies in this catalog list Manufacturing among the industries they work in. They are grouped below by what each is best suited for, in 8 groups. 6 of them hold a certificate confirmed by a register entry and 10 publish a rate card. Composition and order last changed on September 6, 2026.

26 companies. Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.

The companies

Manufacturing: 26 companies, grouped by what they are best suited for.
#	Company	Certificates	Case studies	Team size	Reviews
Nearshore for the EU At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
1	ScienceSoft	None confirmed	2	501-1000 people	85
2	DeviQA	None confirmed	5	201-500 people	44
3	BreachLock	CRESTregister entry	Not published	51-200 people	40
4	Sekurno	None confirmed	2	11-50 people	26
5	White Test Lab	None confirmed	Not published	11-50 people	14
6	Codoid	None confirmed	2	51-200 people	5
7	appmatics GmbH	None confirmed	7	201-500 people	0
8	Bit Sentinel	None confirmed	Not published	11-50 people	0
9	Blaze Information Security	CRESTregister entry	Not published	11-50 people	0
10	Cossack Labs	None confirmed	6	11-50 people	0
11	Devoteam Cyber Trust	CRESTregister entry	Not published	Not published	0
12	Ethiack	None confirmed	2	51-200 people	0
13	Tarlogic Security	None confirmed	Not published	51-200 people	0
Automation first Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
1	ScienceSoft	None confirmed	2	501-1000 people	85
2	DeviQA	None confirmed	5	201-500 people	44
14	QASource	None confirmed	1	1000 or more people	29
15	BugRaptors	None confirmed	2	501-1000 people	26
16	Frugal Testing	None confirmed	1	51-200 people	7
6	Codoid	None confirmed	2	51-200 people	5
7	appmatics GmbH	None confirmed	7	201-500 people	0
17	ImpactQA	None confirmed	5	201-500 people	0
18	QualityAI	None confirmed	2	1000 or more people	0
19	Testhouse	None confirmed	2	501-1000 people	0
Embedded team model The dedicated team engagement model is offered, and at least one published case study.
2	DeviQA	None confirmed	5	201-500 people	44
14	QASource	None confirmed	1	1000 or more people	29
7	appmatics GmbH	None confirmed	7	201-500 people	0
17	ImpactQA	None confirmed	5	201-500 people	0
18	QualityAI	None confirmed	2	1000 or more people	0
Nearshore for the USA At least one delivery location in Canada, Mexico, Central America or South America.
1	ScienceSoft	None confirmed	2	501-1000 people	85
20	Packetlabs	CRESTregister entry	Not published	51-200 people	72
14	QASource	None confirmed	1	1000 or more people	29
21	PLATO	None confirmed	1	501-1000 people	0
22	TestLauncher	None confirmed	1	51-200 people	0
Security focus Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
1	ScienceSoft	None confirmed	2	501-1000 people	85
2	DeviQA	None confirmed	5	201-500 people	44
23	Bishop Fox	CRESTregister entry	5	201-500 people	0
Performance engineering Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
14	QASource	None confirmed	1	1000 or more people	29
15	BugRaptors	None confirmed	2	501-1000 people	26
Accessibility specialists Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric.
21	PLATO	None confirmed	1	501-1000 people	0
Device lab coverage A published device lab of 100 real devices or more, with a source.
2	DeviQA	None confirmed	5	201-500 people	44
Other companies in this axis No applicability tag met its criterion for these profiles.
24	QualiZeal	None confirmed	Not published	1000 or more people	0
25	Testbytes	None confirmed	Not published	51-200 people	0
26	VSEC	CRESTregister entry	Not published	51-200 people	0

Applicability tags in this composition are unevenly distributed

Eight applicability tags cover the 26 companies in this composition, and the tag counts span a wide range. Nearshore for the EU and Automation first each apply to more companies than any of the other six tags on this axis, while at the other end Accessibility specialists and Device lab coverage each apply to a single company. Three companies, QualiZeal, Testbytes and VSEC, carry no applicability tag at all: their published records do not meet any of the eight tag conditions used on this axis.

DeviQA carries five tags, Automation first, Security focus, Embedded team model, Device lab coverage and Nearshore for the EU, more than any other company in this composition. ScienceSoft carries four tags and is the only company in this composition that holds both Nearshore for the EU and Nearshore for the USA together, alongside Automation first and Security focus.

Delivery-location tags and headquarters follow different splits

Nearshore for the EU and Nearshore for the USA are both based on delivery location, a field recorded separately from headquarters address. Nearshore for the EU requires at least one delivery location in the EU, the EEA, Ukraine, Georgia, Serbia or Moldova, and 13 of the 26 companies meet it. Nearshore for the USA requires at least one delivery location in Canada, Mexico, Central America or South America, and 5 of the 26 companies meet it.

Headquarters addresses in this composition span 12 countries: 6 companies are headquartered in the United States, 4 in India, 3 each in Canada, Portugal and the United Kingdom, and one each in Poland, Estonia, Ukraine, Germany, Romania, Spain and Vietnam. A headquarters address and a delivery-location tag are separate facts: the company that holds both nearshore tags is headquartered in the United States, and its delivery locations sit apart from that headquarters record.

Confirmed certificates and the Security focus tag rest on different conditions

A verified certificate is confirmed for 6 of the 26 companies in this composition, and all six hold a CREST certificate. The Security focus tag requires security testing offered together with either penetration testing or a verified ISO/IEC 27001 certificate, plus at least one published case study. A CREST certificate is a different credential from the ISO/IEC 27001 certificate the tag names.

Security focus reaches three companies here, and Bishop Fox is the only one of the three whose profile also carries a confirmed certificate. Of the five remaining certificate holders, four carry a delivery-location tag and none carries Security focus, and one is among the three companies with no applicability tag at all. A confirmed certificate therefore places no company in a tag group on this page.

Case-study tags cover five of the eight applicability conditions on this page

Five of the eight tag conditions used on this axis require at least one published case study: Automation first, Security focus, Embedded team model, Performance engineering and Accessibility specialists. The remaining three conditions, the two nearshore tags and Device lab coverage, read a delivery location or a published device-lab size instead of a case study.

A published case study is present for 16 of the 26 companies in this composition and absent for 10. Because a case study is a precondition for the majority of the tag conditions on this page, a company without one can still meet the two nearshore conditions or Device lab coverage, while the other five conditions stay out of reach for it.

Several other profile fields stay unpublished for large parts of this composition

Client-stage information is absent for 19 of the 26 companies, so most rows in this composition do not state which client stage a vendor typically serves. Framework names are absent for 15 of the 26 companies. Engagement-model information is absent for 9 of the 26 companies. An absent field in each of these three cases records the absence of a published answer, not a claim that the company lacks the underlying capability or offering.

How this ranking was put together

Membership is computed from the profile, not chosen: companies appear here when they list Manufacturing among the industries they work in, as their own profile states. Position in a ranking cannot be bought. Paid options are limited to the extended profile, labelled sponsor slots and lead forms, and none of them affect tags or order.

The table compares the fields that decide this axis: certificates, case studies, team size, plus the number of verified reviews on external platforms. Rates, minimum project size and onboarding time carry the source they came from next to the value.

Nearshore for the EU: At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
Automation first: Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
Embedded team model: The dedicated team engagement model is offered, and at least one published case study.
Nearshore for the USA: At least one delivery location in Canada, Mexico, Central America or South America.
Security focus: Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
Performance engineering: Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
Accessibility specialists: Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric.
Device lab coverage: A published device lab of 100 real devices or more, with a source.

The criteria for this axis are on the methodology page, together with field definitions and the rule for editorial order. Changes of order are recorded in the changelog.

Questions

Does a vendor's published hourly rate reflect what it would cost to keep an automated test suite running over the working life of a production line?: A published hourly rate is a single blended figure for the team assigned to a project today, and it carries no information about how that figure would move across years of regression work as a line's control systems and interfaces are replaced piece by piece. 10 of the 26 companies in this composition publish a rate at all, so for the other 16 a buyer has no published starting figure regardless of how long the equipment is expected to stay in service. A rate quoted against the control software a line runs today and a rate quoted against the software it will run after its next retrofit are two different numbers, and only the first one exists as a field.
If a vendor doesn't name manufacturing clients in its profile, does that mean it hasn't tested software on a working production line?: An unnamed client history means the vendor has withheld who it has worked for from its public profile, and that gap says nothing about whether any of that undisclosed work happened on a working production line or involved on-site acceptance testing at a plant. Named clients are absent for 6 of the 26 companies in this composition, and for the other 20 a buyer can already check which sectors and settings those named clients operate in. A manufacturer evaluating a vendor with no named clients can ask directly for a reference from a comparable production environment before signing.
Does a vendor's silence on signing a GDPR data-processing agreement mean it can't take on a project handling telemetry data from plant equipment?: A blank answer on signing a GDPR data-processing agreement means the vendor has not put that specific commitment on record in its profile, and it says nothing about whether the vendor would sign one once asked for a project touching equipment telemetry. The field carries a confirmed answer for 1 of the 26 companies in this composition, leaving 25 rows with no published position either way. Whether telemetry from plant equipment crosses an EU border is decided by the architecture of the project itself, and the field records a vendor's standing position rather than an answer for any particular engagement.
For how many companies in this composition does the external-reviews field carry no published answer?: The external-reviews field carries no published answer for 15 of the 26 companies in this composition. The other 11 carry a recorded count, and on one of those the recorded count is zero.

Other axes these companies appear on

Delivery location: Europe 18 of these 26 companies also stand there
Type of testing: Manual testing 15 of these 26 companies also stand there
Type of testing: Test automation 15 of these 26 companies also stand there
Type of testing: Performance testing 14 of these 26 companies also stand there

How to choose a vendor on this axis

Published by QA RatingPublished on September 3, 2026Updated on September 5, 2026

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.