If I need a penetration test specifically, does this list of security testing companies narrow down to the ones that actually do that kind of work?

Not on its own. This page lists every company that sells security testing as a service. The catalog keeps penetration testing, red teaming and code review as separate rankings elsewhere, each built from its own company set, and being listed here does not say which of those disciplines a company practices day to day. Those three rankings are also narrower by construction: penetration testing runs to 40 companies, red teaming to 24 and code review to 10, against the 47 gathered here by the broader label. A buyer who needs one of those disciplines by name starts from its own ranking, where the entry test is that discipline itself.

If this engagement's report needs to satisfy an auditor or a client's security questionnaire, does the catalog record the report's format or whether a retest after remediation is included?

No, neither is a field this catalog records. Every field behind this page describes the company: where it delivers from, how many people it employs, which credentials it holds, which engagement models it sells. A report that has to satisfy the reader you describe is a deliverable, and the catalog carries no field for a deliverable of any kind, so there is nothing here to compare on format, on the scope of findings, or on whether a second run after remediation sits inside the original price. Those terms are settled in the scope of work, and a buyer who needs them fixed writes them there rather than looking for them on a profile.

The Security focus tag lets a company qualify through either a penetration-testing offering or a verified ISO/IEC 27001 certificate. Does holding the tag mean a company runs its own penetration tests?

Not for every holder. Of the 12 companies carrying Security focus, 3 hold a verified ISO/IEC 27001 certificate, and for 2 of those 3 the certificate is the only route open, since they do not list penetration testing among their services at all; the third meets both sides of the condition at once. The remaining 9 hold no verified ISO/IEC 27001 certificate, so their tag rests on the penetration-testing side. Anyone who needs penetration-testing experience in particular should read the tag as two different kinds of evidence merged into one label, and check a shortlisted profile to see which side applies.

We need security testing repeated on every release rather than once a year. Does this ranking show which companies work that way?

Barely. The catalog records a continuous testing programme as one of the engagement models a company can sell, and on this axis it appears on 4 profiles out of 47, against 17 for managed testing, 12 for staff augmentation and 8 each for a dedicated team and for project work; 15 companies publish no engagement model at all. The field records the shapes a company sells across its whole practice, so a managed testing entry on one of these profiles can describe functional work while the security assessment is quoted separately as a project. A single assessment and a standing programme are different purchases, and the published record on this page does not separate the companies selling one from the companies selling the other.

Best Security testing companies in 2026

QA Rating is published independently, and its publisher owns no company listed in this catalog.

47 testing companies in this catalog list Security testing among their services. They are grouped below by what each is best suited for, in 11 groups. 10 of them hold a certificate confirmed by a register entry and 26 publish a rate card. Composition and order last changed on September 6, 2026.

47 companies. Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.

The companies

Security testing: 47 companies, grouped by what they are best suited for.
#	Company	Frameworks	Case studies	Published rates	Reviews
Nearshore for the EU At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
1	ScienceSoft	Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman	2	Blended $50-99/hclutch.co	85
2	Edgescan	Not published	1	Not published	53
3	DeviQA	Playwright, Cypress, Selenium, Appium, k6	5	Blended $25-49/hclutch.co	44
4	QA Madness	Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter	2	Blended $25-49/hclutch.co	44
5	Berezha Security Group	Not published	Not published	Blended $25-49/hclutch.co	40
6	Applause	Not published	3	Not published	39
7	Luxe Quality	Salesforce, Selenium, Cypress, Playwright, Cucumber, WebdriverIO, Robot Framework, TestComplete, Appium, Espresso, XCUITest, Postman, SoapUI, REST Assured	2	Blended $25-49/hclutch.co	21
8	a1qa	Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI	3	Blended $25-49/hclutch.co	20
9	QATestLab	Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman	2	Blended $25-49/hclutch.co	17
10	QAwerk	Selenium, Robot Framework, Appium, TestNG, JUnit	3	Blended $25-49/hclutch.co	13
11	AskYourQA	Selenium, Playwright, Appium, Espresso, Cypress	1	Blended $25-49/hclutch.co	7
12	QA Mentor	Selenium	Not published	Blended up to $25/hclutch.co	7
13	Codoid	Selenium	2	Blended up to $25/hclutch.co	5
14	BetterQA	Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured	4	Not published	0
15	Bit Sentinel	Not published	Not published	Not published	0
16	Cobalt	Not published	2	Not published	0
17	Devoteam Cyber Trust	Not published	Not published	Not published	0
18	Euro-Testing Software Solutions	Tricentis Tosca	Not published	Not published	0
19	imbus AG	SAP, Robot Framework	Not published	Not published	0
20	QualityMinds	Not published	1	Not published	0
21	Tarlogic Security	Not published	Not published	Not published	0
22	VisionWare	Not published	Not published	Not published	0
Automation first Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
1	ScienceSoft	Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman	2	Blended $50-99/hclutch.co	85
3	DeviQA	Playwright, Cypress, Selenium, Appium, k6	5	Blended $25-49/hclutch.co	44
4	QA Madness	Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter	2	Blended $25-49/hclutch.co	44
23	QASource	Salesforce, Selenium, Playwright, Cypress, Apache JMeter, Appium, Espresso, XCUITest	1	Blended $25-49/hclutch.co	29
24	BugRaptors	Selenium, WebdriverIO, Cypress, Playwright	2	Blended up to $25/hclutch.co	26
25	Abstracta	Appium, Gatling	4	Blended $50-99/hclutch.co	24
7	Luxe Quality	Salesforce, Selenium, Cypress, Playwright, Cucumber, WebdriverIO, Robot Framework, TestComplete, Appium, Espresso, XCUITest, Postman, SoapUI, REST Assured	2	Blended $25-49/hclutch.co	21
26	QAlified	Postman, SoapUI	5	Blended $25-49/hclutch.co	21
8	a1qa	Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI	3	Blended $25-49/hclutch.co	20
27	OnPath Testing	Selenium, Cypress, Postman, Cucumber, Apache JMeter	3	Blended $25-49/hclutch.co	17
10	QAwerk	Selenium, Robot Framework, Appium, TestNG, JUnit	3	Blended $25-49/hclutch.co	13
28	Frugal Testing	Microsoft Dynamics 365, ServiceNow, Selenium, TestNG, Apache JMeter	1	Blended up to $25/hclutch.co	7
29	Moolya	Selenium	4	Blended $25-49/hclutch.co	7
30	SHIFT ASIA	Not published	3	Blended up to $25/hclutch.co	7
13	Codoid	Selenium	2	Blended up to $25/hclutch.co	5
31	Software Testing Bureau	Not published	1	Blended $25-49/hclutch.co	1
14	BetterQA	Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured	4	Not published	0
32	ImpactQA	Oracle applications, SAP, Tricentis Tosca	5	Not published	0
Security focus Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
1	ScienceSoft	Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman	2	Blended $50-99/hclutch.co	85
2	Edgescan	Not published	1	Not published	53
3	DeviQA	Playwright, Cypress, Selenium, Appium, k6	5	Blended $25-49/hclutch.co	44
4	QA Madness	Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter	2	Blended $25-49/hclutch.co	44
33	Qualysec	Not published	2	Blended $25-49/hclutch.co	31
9	QATestLab	Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman	2	Blended $25-49/hclutch.co	17
10	QAwerk	Selenium, Robot Framework, Appium, TestNG, JUnit	3	Blended $25-49/hclutch.co	13
34	NetSPI	Not published	2	Not published	11
30	SHIFT ASIA	Not published	3	Blended up to $25/hclutch.co	7
14	BetterQA	Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured	4	Not published	0
35	Bishop Fox	Not published	5	Not published	0
16	Cobalt	Not published	2	Not published	0
Nearshore for the USA At least one delivery location in Canada, Mexico, Central America or South America.
1	ScienceSoft	Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman	2	Blended $50-99/hclutch.co	85
23	QASource	Salesforce, Selenium, Playwright, Cypress, Apache JMeter, Appium, Espresso, XCUITest	1	Blended $25-49/hclutch.co	29
25	Abstracta	Appium, Gatling	4	Blended $50-99/hclutch.co	24
26	QAlified	Postman, SoapUI	5	Blended $25-49/hclutch.co	21
8	a1qa	Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI	3	Blended $25-49/hclutch.co	20
34	NetSPI	Not published	2	Not published	11
36	CyStack	Not published	Not published	Not published	1
31	Software Testing Bureau	Not published	1	Blended $25-49/hclutch.co	1
19	imbus AG	SAP, Robot Framework	Not published	Not published	0
37	TestLauncher	Not published	1	Not published	0
Embedded team model The dedicated team engagement model is offered, and at least one published case study.
3	DeviQA	Playwright, Cypress, Selenium, Appium, k6	5	Blended $25-49/hclutch.co	44
4	QA Madness	Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter	2	Blended $25-49/hclutch.co	44
23	QASource	Salesforce, Selenium, Playwright, Cypress, Apache JMeter, Appium, Espresso, XCUITest	1	Blended $25-49/hclutch.co	29
8	a1qa	Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI	3	Blended $25-49/hclutch.co	20
10	QAwerk	Selenium, Robot Framework, Appium, TestNG, JUnit	3	Blended $25-49/hclutch.co	13
32	ImpactQA	Oracle applications, SAP, Tricentis Tosca	5	Not published	0
20	QualityMinds	Not published	1	Not published	0
Performance engineering Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
23	QASource	Salesforce, Selenium, Playwright, Cypress, Apache JMeter, Appium, Espresso, XCUITest	1	Blended $25-49/hclutch.co	29
24	BugRaptors	Selenium, WebdriverIO, Cypress, Playwright	2	Blended up to $25/hclutch.co	26
25	Abstracta	Appium, Gatling	4	Blended $50-99/hclutch.co	24
9	QATestLab	Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman	2	Blended $25-49/hclutch.co	17
30	SHIFT ASIA	Not published	3	Blended up to $25/hclutch.co	7
Device lab coverage A published device lab of 100 real devices or more, with a source.
3	DeviQA	Playwright, Cypress, Selenium, Appium, k6	5	Blended $25-49/hclutch.co	44
9	QATestLab	Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman	2	Blended $25-49/hclutch.co	17
38	Latis Global	Not published	Not published	Not published	0
Fast onboarding A published onboarding time of 14 days or less, with a source.
9	QATestLab	Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman	2	Blended $25-49/hclutch.co	17
39	CHEQ Systems	Selenium, Cypress, Appium, TestNG	Not published	Not published	0
Accessibility specialists Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric.
40	Vervali Systems	Not published	1	Blended $25-49/hclutch.co	11
Crowdtesting at scale The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source.
6	Applause	Not published	3	Not published	39
Regulated industries At least two verified certificates from ISO 13485, HITRUST CSF, PCI QSA and ISO/IEC 27001.
14	BetterQA	Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured	4	Not published	0
Other companies in this axis No applicability tag met its criterion for these profiles.
41	Indium Software	Salesforce	1	Not published	21
42	Q-Pros	Not published	Not published	Blended from $300/hclutch.co	20
43	Coderio	Selenium, Cypress, Playwright, Appium, XCUITest, Postman, REST Assured, Apache JMeter	Not published	Blended $50-99/hclutch.co	10
44	Testrig Technologies	Salesforce, Selenium, Cypress, Playwright, Tricentis Tosca, Katalon, Appium, TestComplete, Robot Framework, REST Assured, Postman, Apache JMeter, SoapUI, k6, Cucumber	Not published	Blended up to $25/hclutch.co	7
45	Testriq QA Lab	SAP, Selenium, Appium	Not published	Blended up to $25/hclutch.co	6
46	RTTS	Salesforce	Not published	Not published	0
47	VSEC	Not published	Not published	Not published	0

What security testing covers in this list

Security testing is recorded as a service sold by every one of the 47 companies on this page, a claim taken from each company's own site. The Security focus tag applies to a narrower set, 12 of the 47. It needs more than the service claim: security testing has to be offered together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study has to back the combination up. The other 35 companies here sell security testing without meeting that stricter condition.

Where these 47 companies are headquartered

The United States accounts for 15 of the 47 headquarters on this page, the largest single-country share. India follows with 9, and Romania with 4; together the three cover 28 of the 47 companies. The remaining 19 companies spread across twelve further countries: Vietnam holds 3, Poland, Ukraine, Uruguay, Portugal and Germany hold 2 each, and Ireland, Cyprus, the Philippines, South Korea, Spain and Canada each hold exactly 1.

Nearshore for the EU is the largest tag on this list

Nearshore for the EU covers 22 of the 47 companies, the largest applicability group on this page. Automation first is next, covering 18. Security focus follows at 12, and Nearshore for the USA covers 10, the fourth-largest group on this page. Eleven applicability tags reach at least one company here, and the seven not named in this ranking each cover 7 companies or fewer, so these four are the four largest. Nearshore for the EU and Nearshore for the USA overlap: three companies, ScienceSoft, a1qa and imbus AG, carry both, so together the two nearshore tags reach 29 of the 47 companies. The remaining 18 companies carry neither nearshore tag, which means only that no qualifying EU, EEA, Ukrainian, Georgian, Serbian, Moldovan, Canadian, Mexican, Central American or South American delivery location is published for those 18; a delivery location may still exist without a published record of it.

How the service-depth tags overlap

Automation first covers 18 of the 47 companies. Six of those 18 also carry Security focus: exactly half of the 12 companies with Security focus also carry Automation first, and the other six do not, among them four holders of a verified CREST accreditation. Performance engineering covers five companies, fewer than either Automation first or Security focus. Four of them, QASource, BugRaptors, Abstracta and SHIFT ASIA, also carry Automation first. QATestLab does not carry Automation first. Its five tags, tied for the most of any company on this page, are Fast onboarding, Device lab coverage, Performance engineering, Security focus and Nearshore for the EU. DeviQA also reaches five tags, with Embedded team model, Device lab coverage, Automation first, Security focus and Nearshore for the EU. At the opposite end, seven companies, Indium Software, Q-Pros, Coderio, Testrig Technologies, Testriq QA Lab, RTTS and VSEC, carry no applicability tag on this page. Two of the seven, Q-Pros and VSEC, each hold a verified certificate anyway, a TMMi assessment and a CREST accreditation respectively. A verified certificate and an applicability tag are computed from different fields here, and holding one does not extend to the other.

What the certificate count shows

Ten of the 47 companies hold at least one certificate this catalog records as verified, and between them they hold 14 verified certificates, since three of the ten hold more than one. CREST is the most common: six companies, Edgescan, Cobalt, Devoteam Cyber Trust, NetSPI and Bishop Fox, plus VSEC, hold a verified CREST accreditation. ISO/IEC 27001 follows with four holders: Edgescan again, BetterQA, imbus AG and SHIFT ASIA. Two of those four, BetterQA and imbus AG, also hold ISO 9001, and BetterQA alone adds a verified ISO 13485 certificate, which is why BetterQA is the only company on this page holding two or more verified certificates from the specific set that defines the Regulated industries tag. A certificate counts as verified here only when a public registry run by the certification body, a certificate file hosted on the vendor's own domain, or a direct auditor confirmation backs it, and the methodology page lists every condition checked on this axis together with the fields each one reads; a claim on a marketing page is not enough on its own. For the 37 companies with no certificate recorded, an unset field records the absence of published proof, which leaves open whether a certificate exists. Seventeen of those 37 name a certificate about themselves on their own site; each such claim is printed on that company's profile under a separate heading, marked as claimed and linked to the page carrying it, and counts nowhere on this page.

Where the published record thins out

Twenty-one of the 47 companies publish no hourly rate, leaving no published price to weigh against the certificate and tag evidence above for those companies. Of the 26 that do publish one, the figure is a blended hourly band covering every service the company sells, with security work as one line inside it, so two companies in the same band can be quoting very different security engagements. Compliance fields are recorded even less often: whether a company signs a business associate agreement or a GDPR data processing agreement is recorded for only 3 of the 47. Client stage, whether a company names a startup or an enterprise focus, is unrecorded for 25 of the 47, and the frameworks field is unrecorded for 20. None of these gaps lines up with the tag or certificate counts above: a company can carry Security focus and still leave its BAA or DPA status unrecorded.

How this ranking was put together

Membership is computed from the profile, not chosen: companies appear here when they list Security testing among their services, as their own profile states. Position in a ranking cannot be bought. Paid options are limited to the extended profile, labelled sponsor slots and lead forms, and none of them affect tags or order.

The table compares the fields that decide this axis: frameworks, case studies, published rates, plus the number of verified reviews on external platforms. Rates, minimum project size and onboarding time carry the source they came from next to the value.

Nearshore for the EU: At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova.
Automation first: Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric.
Security focus: Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study.
Nearshore for the USA: At least one delivery location in Canada, Mexico, Central America or South America.
Embedded team model: The dedicated team engagement model is offered, and at least one published case study.
Performance engineering: Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric.
Device lab coverage: A published device lab of 100 real devices or more, with a source.
Fast onboarding: A published onboarding time of 14 days or less, with a source.
Accessibility specialists: Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric.
Crowdtesting at scale: The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source.
Regulated industries: At least two verified certificates from ISO 13485, HITRUST CSF, PCI QSA and ISO/IEC 27001.

The criteria for this axis are on the methodology page, together with field definitions and the rule for editorial order. Changes of order are recorded in the changelog.

Questions

If I need a penetration test specifically, does this list of security testing companies narrow down to the ones that actually do that kind of work?: Not on its own. This page lists every company that sells security testing as a service. The catalog keeps penetration testing, red teaming and code review as separate rankings elsewhere, each built from its own company set, and being listed here does not say which of those disciplines a company practices day to day. Those three rankings are also narrower by construction: penetration testing runs to 40 companies, red teaming to 24 and code review to 10, against the 47 gathered here by the broader label. A buyer who needs one of those disciplines by name starts from its own ranking, where the entry test is that discipline itself.
If this engagement's report needs to satisfy an auditor or a client's security questionnaire, does the catalog record the report's format or whether a retest after remediation is included?: No, neither is a field this catalog records. Every field behind this page describes the company: where it delivers from, how many people it employs, which credentials it holds, which engagement models it sells. A report that has to satisfy the reader you describe is a deliverable, and the catalog carries no field for a deliverable of any kind, so there is nothing here to compare on format, on the scope of findings, or on whether a second run after remediation sits inside the original price. Those terms are settled in the scope of work, and a buyer who needs them fixed writes them there rather than looking for them on a profile.
The Security focus tag lets a company qualify through either a penetration-testing offering or a verified ISO/IEC 27001 certificate. Does holding the tag mean a company runs its own penetration tests?: Not for every holder. Of the 12 companies carrying Security focus, 3 hold a verified ISO/IEC 27001 certificate, and for 2 of those 3 the certificate is the only route open, since they do not list penetration testing among their services at all; the third meets both sides of the condition at once. The remaining 9 hold no verified ISO/IEC 27001 certificate, so their tag rests on the penetration-testing side. Anyone who needs penetration-testing experience in particular should read the tag as two different kinds of evidence merged into one label, and check a shortlisted profile to see which side applies.
We need security testing repeated on every release rather than once a year. Does this ranking show which companies work that way?: Barely. The catalog records a continuous testing programme as one of the engagement models a company can sell, and on this axis it appears on 4 profiles out of 47, against 17 for managed testing, 12 for staff augmentation and 8 each for a dedicated team and for project work; 15 companies publish no engagement model at all. The field records the shapes a company sells across its whole practice, so a managed testing entry on one of these profiles can describe functional work while the security assessment is quoted separately as a project. A single assessment and a standing programme are different purchases, and the published record on this page does not separate the companies selling one from the companies selling the other.

Previous versions

Each year is frozen as it stood when the snapshot was taken, with the field values recorded at that date. This page always shows the current version.

The 2026 list: 30 companies, taken 2026-09-03. 17 entered and 0 left since.

Other axes these companies appear on

Industry: Healthcare 39 of these 47 companies also stand there
Industry: Banking 35 of these 47 companies also stand there
Industry: Ecommerce 34 of these 47 companies also stand there
Delivery location: Europe 29 of these 47 companies also stand there

How to choose a vendor on this axis

Published by QA RatingPublished on September 3, 2026Updated on September 5, 2026

Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.