This is the 2026 version of this list, taken on 2026-09-03. The current version is at Type of testing: Penetration testing.
Penetration testing companies in 2026
QA Rating is published independently, and its publisher owns no company listed in this catalog.
This is the 2026 state of the list, taken on September 3, 2026, with 20 companies. Since then 21 entered the list and 0 left it, and 16 changed position. Field values on this page are the ones recorded at the time of the snapshot.
20 companies in this version. Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
The companies, as of 2026-09-03
| # | Company | Frameworks | Case studies | Published rates | Reviews |
|---|---|---|---|---|---|
| Nearshore for the EU At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 2 | Edgescan | Not published | 1 | Not published | 53 |
| 3 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 4 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 5 | BreachLock | Not published | Not published | Not published | 40 |
| 6 | UNGUESS | Not published | 1 | Not published | 27 |
| 7 | Sekurno | Not published | 2 |
| 26 |
| 8 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| 9 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| 10 | QA Mentor | Selenium | Not published |
| 7 |
| 11 | Soflab Technology | SAP, Tricentis Tosca, Selenium | 1 |
| 3 |
| 12 | Cobalt | Not published | 2 | Not published | 0 |
| Security focus Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 2 | Edgescan | Not published | 1 | Not published | 53 |
| 3 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 4 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 13 | Qualysec | Not published | 2 |
| 31 |
| 8 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| 9 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| 14 | NetSPI | Not published | 2 | Not published | 11 |
| 15 | Bishop Fox | Not published | 5 | Not published | 0 |
| 12 | Cobalt | Not published | 2 | Not published | 0 |
| Automation first Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 3 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 4 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 9 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| Embedded team model The dedicated team engagement model is offered, and at least one published case study. | |||||
| 3 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 4 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 9 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| Nearshore for the USA At least one delivery location in Canada, Mexico, Central America or South America. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 16 | Packetlabs | Not published | Not published | Not published | 72 |
| 14 | NetSPI | Not published | 2 | Not published | 11 |
| Device lab coverage A published device lab of 100 real devices or more, with a source. | |||||
| 3 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 8 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| Performance engineering Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric. | |||||
| 8 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| 11 | Soflab Technology | SAP, Tricentis Tosca, Selenium | 1 |
| 3 |
| Crowdtesting at scale The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source. | |||||
| 6 | UNGUESS | Not published | 1 | Not published | 27 |
| Fast onboarding A published onboarding time of 14 days or less, with a source. | |||||
| 8 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| Other companies in this axis No applicability tag met its criterion for these profiles. | |||||
| 17 | Kualitatem | Not published | Not published |
| 9 |
| 18 | Bugcrowd | Not published | 2 | Not published | 0 |
| 19 | Testbytes | Selenium, Apache JMeter, Appium | Not published |
| 0 |
| 20 | Zoonou | Not published | Not published | Not published | 0 |
What changed since
- Entered the list since this snapshot: berezha-security-group, iterasec, bit-sentinel, blaze-information-security, char49, devoteam-cyber-trust, ethiack, euro-testing, internet-security-auditors, qytera, sepp-med, tarlogic, visionware, zerolynx, software-secured, halo-security, secuna, verichains, viettel-cyber-security, vncs, vsec.
- Left the list since this snapshot: none.
- Changed position: BreachLock from 5 to 6, UNGUESS from 6 to 7, Sekurno from 7 to 8, QATestLab from 8 to 10, QAwerk from 9 to 11, QA Mentor from 10 to 12, Soflab Technology from 11 to 13, Cobalt from 12 to 17, Qualysec from 13 to 27, NetSPI from 14 to 28, Bishop Fox from 15 to 29, Packetlabs from 16 to 30, Kualitatem from 17 to 32, Bugcrowd from 18 to 34, Testbytes from 19 to 36, Zoonou from 20 to 41.
Every change of composition and order between versions is recorded in the changelog.
Published by QA RatingPublished on September 3, 2026Updated on September 3, 2026
Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.