Independent ranking, methodology 1.1
QA vendors for cybersecurity products, ranked on evidence
For CTOs, VPs of Engineering and QA leads at security product companies choosing an outsourced testing partner.
No vendor paid to be listed, reviewed or ranked, and no vendor can edit its entry.
Methodology 1.0 was locked by hash on 2026-11-11, before collection started; version 1.1 added one scope-gate condition after collection, with weights unchanged. Scores were computed at 2026-11-11 12:45 UTC; see the changelog.
Short answer
DeviQA ranks first of 12 vendors with an overall score of 44.8 out of 100, and its classified security-product evidence covers endpoint protection and EDR. It leads by 2.0 points on engagement longevity, 10.0 against 8.0 for the next vendor. It does not lead the identity and access management facet, where Transition Technologies PSC ranks first on that facet's evidence.
Ranking
| Rank | Vendor | Overall | Top product classes | All evidence items | Not ideal for | Eight scores |
|---|---|---|---|---|---|---|
| 1 | DeviQALeader | 44.8 | Endpoint | 10 | Buyers of email, identity, data protection or mobile security products | Show
|
| 2 | QASource | 43.1 | Endpoint, Network | 7 | Buyers who need performance or load testing of a security product | Show
|
| 3 | QA Mentor | 32.4 | IAM | 4 | Buyers who need QA for endpoint, SIEM or network security products | Show
|
| 4 | Transition Technologies PSC | 31.0 | IAM | 5 | Buyers who need performance, API or compatibility testing of a security product | Show
|
| 5 | TestDevLab | 28.5 | IAM | 6 | Buyers who need an engagement longer than 12 months on a security product | Show
|
| 6 | ELEKS | 28.4 | Endpoint | 5 | Buyers who need QA across several security product classes | Show
|
| 7 | Codoid | 28.1 | IAM | 5 | Buyers who need QA for a product class other than IAM | Show
|
| 8 | ImpactQA | 22.1 | IAM | 5 | Buyers who need a vendor with several documented security-product QA cases | Show
|
| 9 | AgileEngine | 21.4 | SOAR and IR | 3 | Buyers who need performance or compatibility testing on a security product | Show
|
| 10 | TestArmy | 19.4 | Crypto | 3 | Buyers who need QA for endpoint, SIEM, network or other classes beyond… | Show
|
| 11 | Apriorit | 17.6 | None named | 6 | Buyers who need a named security product class | Show
|
| 12 | Indium Software | 16.0 | None named | 5 | Buyers who need a named security-product reference | Show
|
How scores are computed
Each vendor gets eight dimension scores from 0 to 10. The overall score is the sum of each dimension score divided by 10 and multiplied by its weight; the weights sum to 100. Every dimension score on a vendor page links to the evidence items that produced it.
| # | Dimension | Weight |
|---|---|---|
| 1 | Security-product evidence depth | 20 |
| 2 | Product-class coverage | 12 |
| 3 | Test-type depth | 15 |
| 4 | Engagement longevity | 10 |
| 5 | Third-party review signal | 12 |
| 6 | Vendor's own security posture | 10 |
| 7 | Team scale and specialisation | 9 |
| 8 | Transparency | 12 |
The scoring rules were hashed into a lock file before collection started. The full rules, the scope gate and the hash are on the methodology page. The scores and evidence are published as files on the data page.
Who is not in this ranking
Penetration-testing firms are excluded unless they publish QA work on a security product. Testing the security of a bank's or retailer's app is a different service from testing an EDR1 agent or a SIEM2 rule pipeline.
Efficacy labs that certify detection rates are a different service class and are not ranked. The difference is explained in QA vendors vs efficacy labs.
Seven candidates failed the scope gate, all on condition 1: no verifiable QA case or review on a security product. Each is listed with its source on not published.
- 1 EDR: Software that watches laptops, servers and phones for suspicious behavior, records what it sees, and alerts administrators so they can investigate and respond. Source
- 2 SIEM: A system that collects log data from many sources into one place so security teams can search it, correlate events and spot attacks. Source
Facet pages
Product classes
- Endpoint protection and EDR 3 vendors
- Identity and access management 5 vendors
Test types
- Test automation 8 vendors
- Compatibility testing 3 vendors
Regions
- North America 7 vendors
- Europe 8 vendors
- India 5 vendors
Guides
Buying guides first, then testing guides by product type. All guides.
- How to choose a QA vendor for a security product
A shortlist procedure for security product companies outsourcing QA, built on the ranking's eight evidence dimensions and its not-ideal-for lines.
- QA vendors vs efficacy labs
Why labs that certify detection rates are a different service class from outsourced QA vendors, and why this ranking does not list them.
- RFP questions for a QA vendor
RFP questions that map to the evidence the ranking scores: security-product cases, test types, engagement length, certificates, data handling and exit terms.
- Detection regression testing
How to keep detection rules and false-positive behaviour stable across releases: test events per rule, data path tests, CI runs and triage.
- Performance testing security software agents
Baselines with and without the agent, workloads, scan storms and per-build budgets for security agents.
- Security product QA checklist
A checklist of what QA should cover for endpoint agents, detection platforms and identity products, mapped to the ranking's test-type dimension.
- Test automation for security products
What to automate first, what stays manual, OS images, flaky tests and code ownership for security products.
- QA for backup and DLP software
Restore drills, backup of changing data, immutability checks and DLP policy tests on synthetic data.
- Testing EDR agents across OS versions
How to test an endpoint agent across operating system versions: compatibility matrix, performance baseline, upgrade and rollback, coexistence and reporting.
- Testing email security products
Mail flow, benign corpus, verdict consistency, attachment, link, quarantine and SPF, DKIM, DMARC tests.
- QA for firewall and VPN software
Rule regression, tunnel reconnect, kill switch, leak and throughput tests for firewall and VPN builds.
- Testing MFA factors and edge cases
MFA test cases for TOTP, push, recovery, lockout and step-up, and what to ask a QA vendor.
- Testing SIEM log ingestion and detection rules
What to test in a SIEM product from ingestion to rules, and what to ask a QA vendor.
- Testing SSO and SCIM in identity products
Test cases for SAML, OIDC and SCIM in an identity product, and what to ask a QA vendor.
- Testing vulnerability scanner products
Target labs, missed and spurious findings, scan cost and check update regression for scanner products.
Questions buyers ask
What is the difference between QA for a security product and penetration testing?
QA for a security product tests whether the product works: the agent installs on every supported OS, rules fire, logins succeed, updates roll back. Penetration testing attacks a system to find exploitable weaknesses. This ranking scores only the first. Scope gate.
Why does this ranking exclude penetration testing firms?
A firm that tests the security of a bank's app has shown nothing about testing an EDR agent or a SIEM pipeline. Pentest work for a client that is not a security product company never counts as evidence here. Firms with no QA case on a security product fail gate condition 1. Candidates not published.
How do independent product test labs differ from outsourced QA vendors?
An efficacy lab certifies detection rates against its own test set and publishes a score or certificate. A QA vendor works inside your release cycle against your requirements and hands results to your engineers. The two answer different questions, so labs are not ranked. QA vendors vs efficacy labs.
What evidence shows a QA vendor has tested security products before?
A case study or a verified platform review that names the product type, the test types, the team size and the engagement length. Logos, awards and listicle placements are not scored. Each vendor page lists its evidence with links and a confidence grade. Evidence download.
How should a security product company shortlist QA vendors?
Open the facet page for your product class, read the not-ideal-for line of each candidate, then open the evidence behind dimensions 1, 3 and 4. Send the RFP to two or three vendors whose evidence matches your product class and test types. Shortlisting guide.
Which test types matter most for endpoint, SIEM and identity products?
For endpoint agents: compatibility across OS builds and performance cost on the host. For SIEM and detection platforms: detection and false-positive regression. For identity products: functional and API testing of login and permission flows. Dimension 3 counts which of six test types a vendor has evidenced. QA checklist.
How do I check how a vendor handles confidential product data?
Ask for an ISO 27001 certificate number you can check with the issuing certification body, the SOC 2 report period and auditor, and a written statement on where builds and test data are stored. Dimension 6 scores only what a vendor publishes with a reference. RFP questions.
How often should a QA vendor choice be reviewed?
Review it when your product adds a class or a platform the vendor has no evidence for, and at each contract renewal. Each refresh of this ranking re-verifies evidence older than 12 months, inside the methodology's 18-month limit, and every change is dated in the changelog. Changelog.
Scores are computed from publicly available evidence as of the verifiedOn date on each item. They describe published evidence, not service quality. Re-verify with the vendor before contracting.