This is the 2026 version of this list, taken on 2026-09-03. The current version is at Type of testing: Security testing.
Security testing companies in 2026
QA Rating is published independently, and its publisher owns no company listed in this catalog.
This is the 2026 state of the list, taken on September 3, 2026, with 30 companies. Since then 17 entered the list and 0 left it, and 28 changed position. Field values on this page are the ones recorded at the time of the snapshot.
30 companies in this version. Ordered by the number of verified reviews on external platforms, highest first. Companies with an equal count are ordered by name.
The companies, as of 2026-09-03
| # | Company | Frameworks | Case studies | Published rates | Reviews |
|---|---|---|---|---|---|
| Automation first Test automation is offered as a service, and at least one published case study reports a coverage or regression time metric. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 2 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 3 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 4 | QASource | Salesforce, Selenium, Playwright, Cypress, Apache JMeter, Appium, Espresso, XCUITest | 1 |
| 29 |
| 5 | BugRaptors | Selenium, WebdriverIO, Cypress, Playwright | 2 |
| 26 |
| 6 | Abstracta | Appium, Gatling | 4 |
| 24 |
| 7 | Luxe Quality | Salesforce, Selenium, Cypress, Playwright, Cucumber, WebdriverIO, Robot Framework, TestComplete, Appium, Espresso, XCUITest, Postman, SoapUI, REST Assured | 2 |
| 21 |
| 8 | QAlified | Postman, SoapUI | 5 |
| 21 |
| 9 | a1qa | Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI | 3 |
| 20 |
| 10 | OnPath Testing | Selenium, Cypress, Postman, Cucumber, Apache JMeter | 3 |
| 17 |
| 11 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| 12 | Frugal Testing | Microsoft Dynamics 365, ServiceNow, Selenium, TestNG, Apache JMeter | 1 |
| 7 |
| 13 | Moolya | Selenium | 4 |
| 7 |
| 14 | SHIFT ASIA | Not published | 3 |
| 7 |
| 15 | Codoid | Selenium | 2 |
| 5 |
| 16 | Software Testing Bureau | Not published | 1 |
| 1 |
| 17 | BetterQA | Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured | 4 | Not published | 0 |
| 18 | ImpactQA | Oracle applications, SAP, Tricentis Tosca | 5 | Not published | 0 |
| Nearshore for the EU At least one delivery location in the EU or the EEA, or in Ukraine, Georgia, Serbia or Moldova. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 19 | Edgescan | Not published | 1 | Not published | 53 |
| 2 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 3 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 20 | Applause | Not published | 3 | Not published | 39 |
| 7 | Luxe Quality | Salesforce, Selenium, Cypress, Playwright, Cucumber, WebdriverIO, Robot Framework, TestComplete, Appium, Espresso, XCUITest, Postman, SoapUI, REST Assured | 2 |
| 21 |
| 9 | a1qa | Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI | 3 |
| 20 |
| 21 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| 11 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| 22 | QA Mentor | Selenium | Not published |
| 7 |
| 15 | Codoid | Selenium | 2 |
| 5 |
| 17 | BetterQA | Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured | 4 | Not published | 0 |
| 23 | Cobalt | Not published | 2 | Not published | 0 |
| Security focus Security testing is offered, together with either penetration testing or a verified ISO/IEC 27001 certificate, and at least one published case study. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 19 | Edgescan | Not published | 1 | Not published | 53 |
| 2 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 3 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 24 | Qualysec | Not published | 2 |
| 31 |
| 21 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| 11 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| 25 | NetSPI | Not published | 2 | Not published | 11 |
| 14 | SHIFT ASIA | Not published | 3 |
| 7 |
| 17 | BetterQA | Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured | 4 | Not published | 0 |
| 26 | Bishop Fox | Not published | 5 | Not published | 0 |
| 23 | Cobalt | Not published | 2 | Not published | 0 |
| Nearshore for the USA At least one delivery location in Canada, Mexico, Central America or South America. | |||||
| 1 | ScienceSoft | Selenium, Appium, REST Assured, Apache JMeter, SoapUI, Postman | 2 |
| 85 |
| 4 | QASource | Salesforce, Selenium, Playwright, Cypress, Apache JMeter, Appium, Espresso, XCUITest | 1 |
| 29 |
| 6 | Abstracta | Appium, Gatling | 4 |
| 24 |
| 8 | QAlified | Postman, SoapUI | 5 |
| 21 |
| 9 | a1qa | Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI | 3 |
| 20 |
| 25 | NetSPI | Not published | 2 | Not published | 11 |
| 16 | Software Testing Bureau | Not published | 1 |
| 1 |
| Embedded team model The dedicated team engagement model is offered, and at least one published case study. | |||||
| 2 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 3 | QA Madness | Cypress, Playwright, Selenium, Appium, Robot Framework, WebdriverIO, k6, Apache JMeter | 2 |
| 44 |
| 9 | a1qa | Selenium, Playwright, Cypress, WebdriverIO, Appium, Apache JMeter, Postman, Cucumber, k6, REST Assured, TestComplete, Katalon, SoapUI | 3 |
| 20 |
| 11 | QAwerk | Selenium, Robot Framework, Appium, TestNG, JUnit | 3 |
| 13 |
| 18 | ImpactQA | Oracle applications, SAP, Tricentis Tosca | 5 | Not published | 0 |
| Performance engineering Performance testing is offered as a service, and at least one published case study reports a throughput or latency metric. | |||||
| 4 | QASource | Salesforce, Selenium, Playwright, Cypress, Apache JMeter, Appium, Espresso, XCUITest | 1 |
| 29 |
| 5 | BugRaptors | Selenium, WebdriverIO, Cypress, Playwright | 2 |
| 26 |
| 6 | Abstracta | Appium, Gatling | 4 |
| 24 |
| 21 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| 14 | SHIFT ASIA | Not published | 3 |
| 7 |
| Device lab coverage A published device lab of 100 real devices or more, with a source. | |||||
| 2 | DeviQA | Playwright, Cypress, Selenium, Appium, k6 | 5 |
| 44 |
| 21 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| 27 | Latis Global | Not published | Not published | Not published | 0 |
| Accessibility specialists Accessibility testing is offered as a service, and at least one published case study reports an accessibility conformance metric. | |||||
| 28 | Vervali Systems | Not published | 1 |
| 11 |
| Crowdtesting at scale The crowdtesting engagement model is offered, and a published tester pool of 10,000 people or more, with a source. | |||||
| 20 | Applause | Not published | 3 | Not published | 39 |
| Fast onboarding A published onboarding time of 14 days or less, with a source. | |||||
| 21 | QATestLab | Salesforce, Selenium, Appium, Robot Framework, TestComplete, Apache JMeter, SoapUI, Postman | 2 |
| 17 |
| Regulated industries At least two verified certificates from ISO 13485, HITRUST CSF, PCI QSA and ISO/IEC 27001. | |||||
| 17 | BetterQA | Selenium, Playwright, Cypress, WebdriverIO, Appium, Jest, pytest, k6, Apache JMeter, Postman, REST Assured | 4 | Not published | 0 |
| Other companies in this axis No applicability tag met its criterion for these profiles. | |||||
| 29 | Q-Pros | Not published | Not published |
| 20 |
| 30 | Testrig Technologies | Salesforce, Selenium, Cypress, Playwright, Tricentis Tosca, Katalon, Appium, TestComplete, Robot Framework, REST Assured, Postman, Apache JMeter, SoapUI, k6, Cucumber | Not published |
| 7 |
What changed since
- Entered the list since this snapshot: berezha-security-group, ask-your-qa, bit-sentinel, devoteam-cyber-trust, euro-testing, imbus, qualityminds, tarlogic, visionware, cystack, testlauncher, cheq-systems, indium-software, coderio, testriq, rtts, vsec.
- Left the list since this snapshot: none.
- Changed position: Edgescan from 19 to 2, DeviQA from 2 to 3, QA Madness from 3 to 4, Applause from 20 to 6, a1qa from 9 to 8, QATestLab from 21 to 9, QAwerk from 11 to 10, QA Mentor from 22 to 12, Codoid from 15 to 13, BetterQA from 17 to 14, Cobalt from 23 to 16, QASource from 4 to 23, BugRaptors from 5 to 24, Abstracta from 6 to 25, QAlified from 8 to 26, OnPath Testing from 10 to 27, Frugal Testing from 12 to 28, Moolya from 13 to 29, SHIFT ASIA from 14 to 30, Software Testing Bureau from 16 to 31, ImpactQA from 18 to 32, Qualysec from 24 to 33, NetSPI from 25 to 34, Bishop Fox from 26 to 35, Latis Global from 27 to 38, Vervali Systems from 28 to 40, Q-Pros from 29 to 42, Testrig Technologies from 30 to 44.
Every change of composition and order between versions is recorded in the changelog.
Published by QA RatingPublished on September 3, 2026Updated on September 3, 2026
Every fact about a company comes from a listed source. A field without a source stays empty. A certificate counts as confirmed only when a registry, certificate or auditor report backs it; a certificate the company only claims about itself is published separately, under that label. Vendors can request a correction at hello@qa-rating.com. A correction is applied when it comes with a public source.