{
 "computedAt": "2026-11-11T12:45:29.828Z",
 "methodologyHash": "481a93a7e14c460505a71c7e925dc618d444d96c518516070b68a93c413a0efd",
 "methodologyVersion": "1.1",
 "weights": [
  {
   "n": 1,
   "name": "Security-product evidence depth",
   "weight": 20
  },
  {
   "n": 2,
   "name": "Product-class coverage",
   "weight": 12
  },
  {
   "n": 3,
   "name": "Test-type depth",
   "weight": 15
  },
  {
   "n": 4,
   "name": "Engagement longevity",
   "weight": 10
  },
  {
   "n": 5,
   "name": "Third-party review signal",
   "weight": 12
  },
  {
   "n": 6,
   "name": "Vendor's own security posture",
   "weight": 10
  },
  {
   "n": 7,
   "name": "Team scale and specialisation",
   "weight": 9
  },
  {
   "n": 8,
   "name": "Transparency",
   "weight": 12
  }
 ],
 "vendors": [
  {
   "slug": "deviqa",
   "name": "DeviQA",
   "overall": 44.8,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "Three verified security-product QA items, two of them older than 60 months and counted at half. Of these, three name the client, three state team size or duration and one states a metric.",
     "evidenceIds": [
      "e-0001",
      "e-0002",
      "e-0003"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Endpoint protection and EDR.",
     "evidenceIds": [
      "e-0001"
     ]
    },
    "3": {
     "score": 6,
     "rationale": "Three test types evidenced on security products: functional, automation, api.",
     "evidenceIds": [
      "e-0001",
      "e-0002",
      "e-0003"
     ]
    },
    "4": {
     "score": 10,
     "rationale": "Longest evidenced engagement with a security vendor: 70 months (CYDEF).",
     "evidenceIds": [
      "e-0001"
     ]
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 1,
     "rationale": "Evidenced: a security page or named security officer. ISO 27001 is claimed without a certificate number.",
     "evidenceIds": [
      "e-0008"
     ]
    },
    "7": {
     "score": 6,
     "rationale": "Headcount 250 to 999, 3 points; QA-only company, 3 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": [
      "e-0005",
      "e-0074",
      "e-0007"
     ]
    },
    "8": {
     "score": 7.5,
     "rationale": "Three of four items present: public rate, named leadership with profiles, team locations; missing: published QA process page.",
     "evidenceIds": [
      "e-0005",
      "e-0009"
     ]
    }
   },
   "evidenceCount": 10,
   "topClasses": [
    "endpoint"
   ],
   "rank": 1,
   "ranked": true
  },
  {
   "slug": "qasource",
   "name": "QASource",
   "overall": 43.1,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "Three verified security-product QA items, one of them older than 60 months and counted at half. Of these, zero name the client, two state team size or duration and one states a metric.",
     "evidenceIds": [
      "e-0010",
      "e-0011",
      "e-0012"
     ]
    },
    "2": {
     "score": 4,
     "rationale": "Two product classes evidenced: Endpoint protection and EDR; Network security.",
     "evidenceIds": [
      "e-0010",
      "e-0011",
      "e-0012"
     ]
    },
    "3": {
     "score": 8,
     "rationale": "Four test types evidenced on security products: functional, automation, api, compatibility.",
     "evidenceIds": [
      "e-0010",
      "e-0011",
      "e-0012"
     ]
    },
    "4": {
     "score": 2,
     "rationale": "Longest evidenced engagement with a security vendor: 6 months.",
     "evidenceIds": [
      "e-0012"
     ]
    },
    "5": {
     "score": 3,
     "rationale": "One verified platform review of security-product QA work within 60 months; newest dated 2023-04-11.",
     "evidenceIds": [
      "e-0012"
     ]
    },
    "6": {
     "score": 7,
     "rationale": "Evidenced: ISO 27001 with reference IS 791318; a published test-data handling statement; a security page or named security officer.",
     "evidenceIds": [
      "e-0016"
     ]
    },
    "7": {
     "score": 3,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; QA-only company, 3 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": [
      "e-0015"
     ]
    },
    "8": {
     "score": 2.5,
     "rationale": "One of four items present: team locations; missing: public rate, named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0014",
      "e-0015"
     ]
    }
   },
   "evidenceCount": 7,
   "topClasses": [
    "endpoint",
    "network"
   ],
   "rank": 2,
   "ranked": true
  },
  {
   "slug": "qa-mentor",
   "name": "QA Mentor",
   "overall": 32.4,
   "dims": {
    "1": {
     "score": 2,
     "rationale": "One verified security-product QA item. Of these, zero name the client, one states team size or duration and zero state a metric.",
     "evidenceIds": [
      "e-0071"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Identity and access management.",
     "evidenceIds": [
      "e-0071"
     ]
    },
    "3": {
     "score": 2,
     "rationale": "One test type evidenced on security products: automation.",
     "evidenceIds": [
      "e-0071"
     ]
    },
    "4": {
     "score": 8,
     "rationale": "Longest evidenced engagement with a security vendor: 48 months.",
     "evidenceIds": [
      "e-0071"
     ]
    },
    "5": {
     "score": 3,
     "rationale": "One verified platform review of security-product QA work within 60 months; newest dated 2024-01-08.",
     "evidenceIds": [
      "e-0071"
     ]
    },
    "6": {
     "score": 0,
     "rationale": "ISO 27001 is claimed without a certificate number or registry link, which scores zero under the rule.",
     "evidenceIds": [
      "e-0073"
     ]
    },
    "7": {
     "score": 6,
     "rationale": "Headcount 250 to 999, 3 points; QA-only company, 3 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": [
      "e-0072",
      "e-0079",
      "e-0073"
     ]
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0072"
     ]
    }
   },
   "evidenceCount": 4,
   "topClasses": [
    "iam"
   ],
   "rank": 3,
   "ranked": true
  },
  {
   "slug": "ttpsc",
   "name": "Transition Technologies PSC",
   "overall": 31,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "Two verified security-product QA items. Of these, one names the client, two state team size or duration and zero state a metric.",
     "evidenceIds": [
      "e-0050",
      "e-0051"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Identity and access management.",
     "evidenceIds": [
      "e-0050",
      "e-0051"
     ]
    },
    "3": {
     "score": 2,
     "rationale": "One test type evidenced on security products: automation.",
     "evidenceIds": [
      "e-0050",
      "e-0051"
     ]
    },
    "4": {
     "score": 8,
     "rationale": "Longest evidenced engagement with a security vendor: 41 months.",
     "evidenceIds": [
      "e-0050"
     ]
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 0,
     "rationale": "No certificate reference, SOC 2 statement, data-handling statement or security page found.",
     "evidenceIds": []
    },
    "7": {
     "score": 4,
     "rationale": "Headcount 1,000 to 9,999, 4 points; not QA-only, 0 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": [
      "e-0052",
      "e-0077"
     ]
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0052"
     ]
    }
   },
   "evidenceCount": 5,
   "topClasses": [
    "iam"
   ],
   "rank": 4,
   "ranked": true
  },
  {
   "slug": "testdevlab",
   "name": "TestDevLab",
   "overall": 28.5,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "One verified security-product QA item, one of them older than 60 months and counted at half. Of these, one names the client, zero state team size or duration and zero state a metric.",
     "evidenceIds": [
      "e-0057"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Identity and access management.",
     "evidenceIds": [
      "e-0057"
     ]
    },
    "3": {
     "score": 2,
     "rationale": "One test type evidenced on security products: compatibility.",
     "evidenceIds": [
      "e-0057"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 1,
     "rationale": "Evidenced: a security page or named security officer. ISO 27001 is claimed without a certificate number.",
     "evidenceIds": [
      "e-0059",
      "e-0060"
     ]
    },
    "7": {
     "score": 9,
     "rationale": "Headcount 250 to 999, 3 points; QA-only company, 3 points; dedicated security-product QA page, 3 points.",
     "evidenceIds": [
      "e-0058",
      "e-0078",
      "e-0059",
      "e-0060",
      "e-0061"
     ]
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0058"
     ]
    }
   },
   "evidenceCount": 6,
   "topClasses": [
    "iam"
   ],
   "rank": 5,
   "ranked": true
  },
  {
   "slug": "eleks",
   "name": "ELEKS",
   "overall": 28.4,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "One verified security-product QA item. Of these, one names the client, one states team size or duration and zero state a metric.",
     "evidenceIds": [
      "e-0033"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Endpoint protection and EDR.",
     "evidenceIds": [
      "e-0033"
     ]
    },
    "3": {
     "score": 4,
     "rationale": "Two test types evidenced on security products: performance, compatibility.",
     "evidenceIds": [
      "e-0033"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 3,
     "rationale": "Evidenced: SOC 2 Type II stated (2025). ISO 27001 is claimed without a certificate number.",
     "evidenceIds": [
      "e-0035"
     ]
    },
    "7": {
     "score": 0,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; not QA-only, 0 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": []
    },
    "8": {
     "score": 7.5,
     "rationale": "Three of four items present: public rate, published QA process page, team locations; missing: named leadership with profiles.",
     "evidenceIds": [
      "e-0034",
      "e-0036"
     ]
    }
   },
   "evidenceCount": 5,
   "topClasses": [
    "endpoint"
   ],
   "rank": 6,
   "ranked": true
  },
  {
   "slug": "codoid",
   "name": "Codoid",
   "overall": 28.1,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "Two verified security-product QA items. Of these, zero name the client, one states team size or duration and two state a metric.",
     "evidenceIds": [
      "e-0045",
      "e-0046"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Identity and access management.",
     "evidenceIds": [
      "e-0045",
      "e-0046"
     ]
    },
    "3": {
     "score": 6,
     "rationale": "Three test types evidenced on security products: functional, automation, performance.",
     "evidenceIds": [
      "e-0045",
      "e-0046"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 0,
     "rationale": "ISO 27001 is claimed without a certificate number or registry link, which scores zero under the rule.",
     "evidenceIds": [
      "e-0049"
     ]
    },
    "7": {
     "score": 3,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; QA-only company, 3 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": [
      "e-0049"
     ]
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0047"
     ]
    }
   },
   "evidenceCount": 5,
   "topClasses": [
    "iam"
   ],
   "rank": 7,
   "ranked": true
  },
  {
   "slug": "impactqa",
   "name": "ImpactQA",
   "overall": 22.1,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "One verified security-product QA item. Of these, one names the client, zero state team size or duration and one states a metric.",
     "evidenceIds": [
      "e-0041"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Identity and access management.",
     "evidenceIds": [
      "e-0041"
     ]
    },
    "3": {
     "score": 2,
     "rationale": "One test type evidenced on security products: automation.",
     "evidenceIds": [
      "e-0041"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 0,
     "rationale": "No certificate reference, SOC 2 statement, data-handling statement or security page found.",
     "evidenceIds": []
    },
    "7": {
     "score": 3,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; QA-only company, 3 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": [
      "e-0043"
     ]
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0042",
      "e-0044"
     ]
    }
   },
   "evidenceCount": 5,
   "topClasses": [
    "iam"
   ],
   "rank": 8,
   "ranked": true
  },
  {
   "slug": "agileengine",
   "name": "AgileEngine",
   "overall": 21.4,
   "dims": {
    "1": {
     "score": 2,
     "rationale": "One verified security-product QA item. Of these, zero name the client, zero state team size or duration and zero state a metric.",
     "evidenceIds": [
      "e-0038"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: SOAR and incident response.",
     "evidenceIds": [
      "e-0038"
     ]
    },
    "3": {
     "score": 6,
     "rationale": "Three test types evidenced on security products: functional, automation, api.",
     "evidenceIds": [
      "e-0038"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 0,
     "rationale": "No certificate reference, SOC 2 statement, data-handling statement or security page found.",
     "evidenceIds": []
    },
    "7": {
     "score": 0,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; not QA-only, 0 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": []
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0039"
     ]
    }
   },
   "evidenceCount": 3,
   "topClasses": [
    "soar-ir"
   ],
   "rank": 9,
   "ranked": true
  },
  {
   "slug": "testarmy",
   "name": "TestArmy",
   "overall": 19.4,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "One verified security-product QA item, one of them older than 60 months and counted at half. Of these, one names the client, zero state team size or duration and zero state a metric.",
     "evidenceIds": [
      "e-0054"
     ]
    },
    "2": {
     "score": 2,
     "rationale": "One product class evidenced: Cryptography and key management.",
     "evidenceIds": [
      "e-0054"
     ]
    },
    "3": {
     "score": 2,
     "rationale": "One test type evidenced on security products: functional.",
     "evidenceIds": [
      "e-0054"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 0,
     "rationale": "ISO 27001 is claimed without a certificate number or registry link, which scores zero under the rule.",
     "evidenceIds": [
      "e-0056"
     ]
    },
    "7": {
     "score": 0,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; not QA-only, 0 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": []
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0056"
     ]
    }
   },
   "evidenceCount": 3,
   "topClasses": [
    "crypto"
   ],
   "rank": 10,
   "ranked": true
  },
  {
   "slug": "apriorit",
   "name": "Apriorit",
   "overall": 17.6,
   "dims": {
    "1": {
     "score": 4,
     "rationale": "Two verified security-product QA items. Of these, zero name the client, one states team size or duration and zero state a metric.",
     "evidenceIds": [
      "e-0062",
      "e-0063"
     ]
    },
    "2": {
     "score": 0,
     "rationale": "No product class is named in the verified security-product evidence.",
     "evidenceIds": []
    },
    "3": {
     "score": 0,
     "rationale": "No test type is evidenced on a security product.",
     "evidenceIds": []
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 3,
     "rationale": "One verified platform review of security-product QA work within 60 months; newest dated 2023-12-05.",
     "evidenceIds": [
      "e-0063"
     ]
    },
    "6": {
     "score": 0,
     "rationale": "No certificate reference, SOC 2 statement, data-handling statement or security page found.",
     "evidenceIds": []
    },
    "7": {
     "score": 0,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; not QA-only, 0 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": []
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0067"
     ]
    }
   },
   "evidenceCount": 6,
   "topClasses": [],
   "rank": 11,
   "ranked": true
  },
  {
   "slug": "indium-software",
   "name": "Indium Software",
   "overall": 16,
   "dims": {
    "1": {
     "score": 2,
     "rationale": "One verified security-product QA item. Of these, zero name the client, zero state team size or duration and one states a metric.",
     "evidenceIds": [
      "e-0025"
     ]
    },
    "2": {
     "score": 0,
     "rationale": "No product class is named in the verified security-product evidence.",
     "evidenceIds": []
    },
    "3": {
     "score": 4,
     "rationale": "Two test types evidenced on security products: automation, api.",
     "evidenceIds": [
      "e-0025"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 0,
     "rationale": "No certificate reference, SOC 2 statement, data-handling statement or security page found.",
     "evidenceIds": []
    },
    "7": {
     "score": 0,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; not QA-only, 0 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": []
    },
    "8": {
     "score": 5,
     "rationale": "Two of four items present: public rate, team locations; missing: named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0028"
     ]
    }
   },
   "evidenceCount": 5,
   "topClasses": [],
   "rank": 12,
   "ranked": true
  },
  {
   "slug": "qualitest",
   "name": "Qualitest",
   "overall": 10,
   "dims": {
    "1": {
     "score": 2,
     "rationale": "One verified security-product QA item. Of these, zero name the client, zero state team size or duration and one states a metric.",
     "evidenceIds": [
      "e-0068"
     ]
    },
    "2": {
     "score": 0,
     "rationale": "No product class is named in the verified security-product evidence.",
     "evidenceIds": []
    },
    "3": {
     "score": 2,
     "rationale": "One test type evidenced on security products: automation.",
     "evidenceIds": [
      "e-0068"
     ]
    },
    "4": {
     "score": 0,
     "rationale": "No engagement length with a security vendor is stated in the verified evidence.",
     "evidenceIds": []
    },
    "5": {
     "score": 0,
     "rationale": "No verified Clutch, GoodFirms or G2 review of security-product QA work dated within 60 months.",
     "evidenceIds": []
    },
    "6": {
     "score": 0,
     "rationale": "No certificate reference, SOC 2 statement, data-handling statement or security page found.",
     "evidenceIds": []
    },
    "7": {
     "score": 0,
     "rationale": "Headcount not confirmed by two consistent sources, 0 points; not QA-only, 0 points; no dedicated security-product QA page, 0 points.",
     "evidenceIds": []
    },
    "8": {
     "score": 2.5,
     "rationale": "One of four items present: team locations; missing: public rate, named leadership with profiles, published QA process page.",
     "evidenceIds": [
      "e-0069"
     ]
    }
   },
   "evidenceCount": 3,
   "topClasses": [],
   "rank": 13,
   "ranked": false
  }
 ]
}