Software Testing and QA Engineering Services for Web and Mobile Apps
This is quality engineering embedded in the delivery team, not a manual regression pass bolted on at the end of a sprint. Our QA engineers write and maintain the automated suites, own the test data, run the gates in your CI pipeline, and verify code regardless of whether a person or a model wrote it. Mixcore Studio has been building web and mobile software for over eight years with a team of around twenty and more than 320 projects delivered, and testers sit inside those teams rather than beside them.
The reason the job description changed is measurable. Veracode's 2026 GenAI Code Security Report, published on 28 July 2026, states that AI now authors roughly half of all committed code in organisations that have adopted AI coding tools, and that the average security pass rate for that code is 56%, essentially unchanged from 55% a year earlier. Google's 2025 DORA report found AI associated with improved delivery throughput and, at the same time, increased delivery instability. Writing code got cheaper. Being confident it is correct did not.
What changed in software testing between 2023 and 2026
The manual regression pass as a primary deliverable is finished as a service line. It was the first thing teams automated and the first thing AI absorbed, and buying it by the head is now the weakest position in the market. What replaced it is a narrower, more senior role: risk-based test design, test data strategy, pipeline gates, and verification of machine-authored changes.
Adoption of AI inside QA itself is shallower than the marketing suggests. Capgemini's World Quality Report 2025-26, the seventeenth edition, found 43% of organisations experimenting with generative AI in QA but only 15% having scaled it enterprise-wide, and 58% reporting difficulty adopting AI-powered testing tools. Generative AI is now the top-ranked skill for quality engineers at 63%. Any vendor describing a fully AI-driven QA function in 2026 is describing a pilot.
Verifying code that AI wrote
Veracode's 2026 report breaks the failure down by category, and the shape matters more than the headline. Cryptographic algorithm use passed at 87% and SQL injection at 83%, so the classes with decades of training data are handled reasonably well. Log injection passed at 12% and cross-site scripting at 15%. The best-performing model tested, GPT-5.5, reached 68%. Around 44% of AI code-generation tasks introduced a risky vulnerability.
What we do with that in practice:
- AI-authored diffs get the same gates or stricter ones — static analysis with Semgrep, dependency and secret scanning, and dynamic testing with OWASP ZAP on the changed surface, not on a quarterly schedule.
- Tests and implementation do not share an author — if a model writes the code and the same model writes the assertions, you have a tautology rather than a check. Human-authored acceptance criteria and mutation testing keep the oracle independent.
- Targeted review where the data says failure concentrates — output encoding, logging paths, authorisation checks and input handling get read line by line rather than skimmed.
- Review capacity is planned and costed — treating pull request review as free residual time is how instability enters. Stack Overflow's 2025 Developer Survey of about 49,000 respondents found 66% naming AI output that is "almost right, but not quite" as their top frustration, and 45.2% saying debugging AI-generated code takes more time.
Test data is usually the real constraint
Most stalled QA programmes we inherit are not short of test cases. They are short of realistic, legally usable data to run them against. Capgemini's World Quality Report 2025-26 found 60% of organisations still struggling with secure, scalable test data management, and synthetic test data use rising from 14% in 2024 to 25% in 2025, making it the top generative AI use case in testing.
We treat data as a first-class part of the suite: masked extracts from production where the legal basis allows it, synthetic generation for edge cases and volumes production cannot supply, referential integrity maintained across services, and ephemeral environments provisioned with Testcontainers so a suite starts from a known state every run. The same report notes that 94% of organisations review production data but roughly half cannot convert it into quality improvements, so we wire production error rates and incident findings back into the regression set rather than leaving them in a dashboard.
What we put into your delivery pipeline
- End-to-end and component tests — Playwright for web across Chromium, Firefox and WebKit, Appium for native iOS and Android, with flaky tests quarantined and tracked rather than retried until green.
- Contract tests between services — Pact or schema-based checks so a backend change cannot silently break a mobile client already in the app stores.
- Performance and load — k6 scenarios run in CI against agreed thresholds, so a regression shows up on a pull request rather than at launch.
- Accessibility checks — axe-core in the pipeline plus manual keyboard and screen reader passes on the flows that matter, since automated rules catch only part of WCAG.
- Component inventory — a CycloneDX software bill of materials generated on every build, which is a prerequisite for the regulatory duties below.
- Metrics you can audit — change failure rate, defect escape rate, review latency and mean time to restore, reported from your own systems rather than from a vendor scorecard.
Testing that produces compliance evidence
Regulatory obligations have become procurement questions, and several of them are testable assertions rather than legal opinions. From 11 September 2026 the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities to ENISA and the relevant national CSIRT within 24 hours, including for products already on the EU market. You cannot meet a 24-hour clock without already knowing what is in your build, which is why the bill of materials goes in now rather than by 11 December 2027 when the Annex I requirement formally applies.
On the AI side the map moved this summer. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It pushed Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded obligations to 2 August 2028. This is a deferral, not a repeal. What did not move is Article 50 transparency, in force from 2 August 2026 with a grace period to 2 December 2026 for systems already on the market, so if your product has a generative feature then AI-interaction disclosure and machine-readable marking of generated content are things we can write test cases against today. NIS2 separately requires regulated entities to manage the security of their direct supplier and service-provider relationships, which the directive expects them to reflect in contractual arrangements, backed by penalties for essential entities reaching EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. That is how a development supplier inherits requirements it is not directly in scope for. As a Vietnam-based supplier we also operate under Vietnam's own Law on Artificial Intelligence, effective 1 March 2026, whose Article 11 imposes comparable disclosure and machine-readable marking duties. We are engineers, not lawyers. Your counsel decides what applies; we build and test the mechanisms that let you evidence it.
When a dedicated QA team is the wrong choice
Before product-market fit, when the interface changes weekly, most end-to-end automation is written and thrown away. A pre-seed team is usually better served by a small smoke suite over the two or three flows that must never break, strong error monitoring, and real users, and we will say so rather than staff a pod against it.
If code is merging without meaningful review, adding testers downstream does not fix the problem, it queues behind it. The defect is upstream and the honest fix is upstream. Equally, an embedded model needs repository, CI and ticket access. If procurement or security cannot grant that, a periodic audit engagement will produce more value than an embedded team working through a hand-off queue.
And if what you actually want is a manual regression pass priced per person per month, we are the wrong vendor. That work exists more cheaply elsewhere, and the buyers we work with have moved on from it. The industry-wide reason is visible in the numbers: HCL's chief executive C. Vijayakumar told investors to expect 3-5% annual revenue deflation from AI in the coming year (The Register, 28 April 2026), and enterprise buyers are steadily shifting toward outcome-based contracting. A quality function priced purely as bodies-per-month is a shrinking product, and we would rather sell you the defect escape rate.
Our expertise
- Automated regression suites
- Verification of AI-authored code
- Test data and synthetic data
- Performance and load testing
- Native iOS and Android testing
- Security and compliance gates
Frequently asked questions
Is manual testing dead in 2026?
Manual testing is not dead, but the manual regression pass as a primary deliverable is. Repetitive scripted execution is the part automation and AI absorbed first. Exploratory testing, usability judgement, and deciding what "correct" means for an ambiguous requirement remain human work, and those are the manual activities we still staff and charge for.
How do you test code that an AI assistant generated?
With the same gates as human-written code or stricter ones, and never with tests written by the same model that wrote the implementation. Veracode's 2026 GenAI Code Security Report measured a 56% average security pass rate for AI-generated code, with log injection at 12% and cross-site scripting at 15%, so we concentrate review on output encoding, logging paths, authorisation and input handling rather than spreading attention evenly.
Does AI-assisted development mean we need fewer QA engineers?
The evidence points the other way for verification specifically. Google's 2025 DORA report found AI associated with both improved throughput and increased delivery instability, and METR's randomised controlled trial of experienced open-source developers found they took 19% longer with AI tools while believing they had been about 20% faster. Review and verification became the constrained function, so the seniority mix shifts rather than the headcount simply falling.
What does a QA engineer from Vietnam cost, and how should we structure the contract?
QA rates in Vietnam vary by seniority and by city, and the rate guides that circulate are vendor-authored rather than independently audited, so we would rather quote you in writing against your actual scope than repeat a band from them. Rates outside Ho Chi Minh City are generally lower. What matters more over a multi-year engagement is the trajectory: local IT wage inflation is a live cost pressure, so ask any supplier for an explicit rate escalation cap, and ask for an output or outcome tier alongside any per-person rate.
Can your testing produce the evidence EU regulation now requires?
We build the technical parts. A CycloneDX software bill of materials on every build is what makes the EU Cyber Resilience Act's 24-hour exploited-vulnerability report, mandatory from 11 September 2026, actually achievable. Where a product has a generative feature, EU AI Act Article 50 disclosure and machine-readable marking, in force from 2 August 2026, become test cases. Your legal counsel determines what applies to you; we make it verifiable.
Contacts
We are always happy to talk with you.
Feel free to contact us in any suitable way
Request a quote
Let's discuss your project!
Please, provide us with a brief description of what you
already have and what you are going to achieve.
Mail us contact@brainiacminds.com