Ranking / Vendor profile

DeviQA

Overall score: 44.8 / 100, rank 1 of 12
Headquarters: Warsaw, Poland [e-0005]
Headcount range: 250 to 999 [e-0005][e-0074]
QA-only company: Yes, QA and testing only [e-0007]
Evidence verified on: 2026-11-11

Not ideal for

Situations where the published evidence does not support this vendor. Each line links to its source.

Buyers of email, identity, data protection or mobile security products: no case or review that names a product class covers them. [e-0001][e-0002][e-0003]
Buyers who need performance or compatibility testing on a security product: the published cases show functional, automation and API work only. [e-0001][e-0003]
Buyers who require an ISO 27001 certificate number or registry link: the certifications page states the standard without a reference. [e-0008]

Security-product QA evidence

Case studies and reviews that describe QA work on a product whose primary purpose is security. Penetration testing for other clients is excluded under the methodology.

e-0001
case-studyCase study for CYDEF, endpoint protection and EDR
deviqa.com · undated · B single source · verified 2026-11-11
Endpoint protection and EDR; tests: functional, automation; team: 3; duration: 70 months; client: CYDEF; vendor-reported metric: 98% test coverage achieved for the desktop agent
e-0002
reviewClutch review by CYDEF
clutch.co · 2021-05-20 · C indirect · verified 2026-11-11
tests: automation; team: 3; duration: 9 months; client: CYDEF
e-0003
reviewClutch review by Solebit
clutch.co · 2018-08-27 · B single source · verified 2026-11-11
tests: automation, api; duration: 42 months; client: Solebit

Score breakdown

Eight dimensions, each scored 0 to 10 by the frozen rules and multiplied by its weight. Bars are drawn from data/scores.json.

1 Security-product evidence depth weight 204.0 / 10
Three verified security-product QA items, two of them older than 60 months and counted at half. Of these, three name the client, three state team size or duration and one states a metric. [e-0001][e-0002][e-0003]
2 Product-class coverage weight 122.0 / 10
One product class evidenced: Endpoint protection and EDR. [e-0001]
3 Test-type depth weight 156.0 / 10
Three test types evidenced on security products: functional, automation, api. [e-0001][e-0002][e-0003]
4 Engagement longevity weight 1010.0 / 10
Longest evidenced engagement with a security vendor: 70 months (CYDEF). [e-0001]
5 Third-party review signal weight 120.0 / 10
No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.
6 Vendor's own security posture weight 101.0 / 10
Evidenced: a security page or named security officer. ISO 27001 is claimed without a certificate number. [e-0008]
7 Team scale and specialisation weight 96.0 / 10
Headcount 250 to 999, 3 points; QA-only company, 3 points; no dedicated security-product QA page, 0 points. [e-0005][e-0074][e-0007]
8 Transparency weight 127.5 / 10
Three of four items present: public rate, named leadership with profiles, team locations; missing: published QA process page. [e-0005][e-0009]

Product classes covered

Verified security-product QA items per class. A class counts only when the source names the product type, for example EDR¹ for endpoint or SIEM² for detection platforms.

Product class	Evidence items
Endpoint protection and EDR	1
SIEM, XDR and detection platforms	0, no evidence
Identity and access management	0, no evidence
Network security	0, no evidence
Email and web security	0, no evidence
Data protection and backup	0, no evidence
Vulnerability and exposure management	0, no evidence
SOAR and incident response	0, no evidence
Cryptography and key management	0, no evidence
Mobile and application security products	0, no evidence

Test types evidenced on security products: functional, automation and API. [e-0001][e-0002][e-0003]

1 EDR: Software that watches laptops, servers and phones for suspicious behavior, records what it sees, and alerts administrators so they can investigate and respond. Source
2 SIEM: A system that collects log data from many sources into one place so security teams can search it, correlate events and spot attacks. Source

Vendor's own security posture

Controls a security vendor usually asks of a QA partner that will handle builds and test data.

ISO 27001: Claimed, certificate reference not published [e-0008]
SOC 2: Not published
Test-data handling: Not published
Security page or officer: Security page [e-0008]

Transparency

The four items scored in dimension 8 of the methodology.

Public rate: $25 to $49 / hr [e-0005]
Leadership: Oleg Sadikov, CEO; Dmitry Reznik, CTO; Anastasiia Sokolinska, COO [e-0009]
QA process page: Not published
Team locations: Warsaw, Poland; London, United Kingdom; Lviv, Ukraine; Kharkiv, Ukraine; San Francisco, United States [e-0005]

Compare and browse

The two vendors nearest by overall score, and the facet pages that list this vendor.

DeviQA vs QASource QASource overall 43.1
DeviQA vs QA Mentor QA Mentor overall 32.4
Endpoint protection and EDR facet page
Test automation facet page
North America facet page
Europe facet page
RFP questions to send this vendor
How to shortlist a QA vendor for a security product
Full ranking of 12 vendors

Logged corrections: changelog. Raw evidence: data download.

Scores are computed from publicly available evidence as of the verifiedOn date on each item. They describe published evidence, not service quality. Re-verify with the vendor before contracting.