46%
of developers actively distrust the accuracy of AI-generated code — while 84% use it or plan to.
What we do
Testing, automation and AI code assurance
What we write it in, how we work out which of it your problem actually needs, and what each one cannot do.
The problem, stated precisely
Your team adopted AI coding assistants somewhere in the last eighteen months. Throughput went up — that part is visible in your delivery metrics. What is not visible is what happened to the defect profile underneath, because the code review process, the test suite and the security scanning were all designed for code written at human speed by humans who could explain it.
The published evidence says the gap is real and measurable:
56%
of AI-generated code passes a security review. Cross-site scripting passes 15% of the time.
19%
slower. Experienced developers in a randomised controlled trial using AI tools — while believing they had been 20% faster.
31%
of breaches now begin with vulnerability exploitation, surpassing stolen credentials for the first time in 19 years.
DORA's 2026 research found the same tension from the other direction: higher AI adoption correlates with both increased delivery throughput and increased delivery instability, at the same time. Faster and more fragile is a coherent outcome, not a contradiction — and it is the one most teams are living in without having measured it.
DORA State of DevOps research · 10 Mar 2026 · REPORTED —Published by a research programme housed at a cloud vendor.
Three disciplines
Most engagements use all three, in a proportion that depends on what is actually at risk in your software — which is the part worth paying for, and the part a vendor selling one of these exclusively cannot get right.
Each section below ends with what that discipline cannot do. A testing partner who has never told you the limits of their own method has not finished thinking about it.
Manual and exploratory testing
- Exploratory charters
- Risk-based session testing
- Accessibility review
Automation checks that the things you thought of still work. It cannot notice the thing nobody thought of, and after AI-assisted development there is more of that than there used to be. Manual work here is structured and time-boxed, not a person clicking through a spreadsheet of steps.
Charter-based exploratory sessions
Time-boxed sessions against a written charter and a risk area, with notes and reproducible findings — not unscripted clicking. You get the session log, so you can see what was covered and what was not.
Workflow and state coverage
The paths a real user takes across features, including the partial, interrupted and resumed ones that unit and component tests never exercise.
Accessibility review by hand
Keyboard-only traversal, screen reader passes, and focus and reflow behaviour. Automated tooling reliably detects a minority of WCAG success criteria; the US Department of Justice has said on the record that automated remediation tools lack sufficient reliability for complex content.
Exit criteria you can act on
Findings ranked by risk and effort, with reproduction steps, so the output is a decision rather than a list.
On automated tooling being insufficient: US Department of Justice, ADA Title II web rule · 20 Apr 2026 · VERIFIED
What this cannot doManual testing does not scale as regression coverage and we will not sell it as though it does. If your problem is that the same 400 checks have to pass on every release, that is an automation problem and we will say so.
Test automation
- Playwright
- Selenium WebDriver
- TypeScript
- Java
- Python
- CI pipelines
Most teams do not need more automated tests. They need the ones they have to be fast, stable and trusted, because a suite nobody believes is worse than no suite — it trains a team to click merge on a red build. We build suites and, more often, we rescue them.
Playwright
Our default for new browser and API suites: parallel execution, auto-waiting that removes a whole category of flake, tracing that makes a failure diagnosable from CI alone, and cross-browser coverage without a grid to maintain.
Selenium WebDriver
Where the estate is already there, the grid is established, or the language and browser matrix requires it. A working Selenium suite is not a problem to be migrated — rewriting one that works is usually somebody billing you for their preference.
Flake control and runtime
Quarantine, retry policy that does not hide real failures, and the specific work of getting a suite from an hour to something that can gate a merge. Flake is a trust problem before it is a technical one.
Layering and CI integration
Tiered suites wired into the pipeline so the right set runs at the right gate: fast checks on every commit, the full run before release. Includes API and contract level, because pushing everything through the browser is why suites get slow.
What this cannot doWe will not quote a suite for a codebase we have not assessed, and we will not promise a coverage percentage. Coverage as a single number is a poor metric and committing to one produces tests written to move it.
GenAI for QA — agents built and deployed
- Agent design
- Tool and API integration
- Evaluation harnesses
- CI deployment
We build our own GenAI tooling for QA and we deploy it for clients. Agents are genuinely good at the wide, repetitive, judgement-light parts of testing: reading a diff and proposing where coverage is missing, generating and maintaining test data, triaging a failure queue, drafting reproduction steps. Used there, an agent widens the search enormously.
Agents scoped to a real task
A coverage-gap agent, a failure-triage agent, a test-data agent — each with a defined job, defined inputs, and a defined handoff to a person. Not a general-purpose assistant bolted onto your pipeline.
Deployed into your pipeline, not a demo
Wired into CI with your source control, defect tracker and test runner, with the access boundaries written down. Deployed to your infrastructure — we do not require that your code leave it.
An evaluation harness, always
Every agent ships with a measurement of how often it is right, on your data, and where it fails. An unevaluated agent is a confident guess at scale, and Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027 on exactly that basis.
Handover, not dependency
You get the prompts, the harness, the deployment and the documentation. If you want to run it without us afterwards, that is the intended outcome.
40%+
of agentic AI projects are expected to be cancelled by the end of 2027 — on escalating cost, unclear value and inadequate risk controls.
What this cannot doWe do not let an agent sign off on a release, and neither should you. Agent output is an input to a human decision — every finding that reaches your report is verified by one of our engineers first. That is the line the whole practice is built on, and building agents is what makes us confident about where to draw it.
Diagnose · two weeks, fixed fee
AI Code Assurance Diagnostic
A measured answer to a question most teams are guessing at. The method, in detail — the reader is an engineering leader and detail is the proof.
Defect profile comparison.
Your defect data before and after AI tool adoption, segmented by severity, component and escape rate. This is the number nobody has.
Coverage mapped against AI-authored paths.
Where test coverage sits relative to the code paths that AI assistance actually touched — which is rarely where teams assume.
Targeted security review.
Weighted toward the classes where AI performs worst rather than a generic scan: injection, cross-site scripting, authentication and authorisation handling, secrets, and dependency risk.
Review process assessment.
Whether your code review process is still doing what it did before, given that 45.2% of developers report debugging AI-generated code takes longer than debugging their own.
45.2% — Stack Overflow Developer Survey 2025 · 2025 · VERIFIED
Prioritised remediation roadmap.
Ranked by risk and effort, with estimates, so it is a plan rather than a list of complaints.
What you get
- A written findings report — evidence-linked, no unsupported assertions
- A risk-ranked remediation roadmap with effort estimates
- A 90-minute walkthrough with your engineering leadership, live, questions welcome
- A fixed-price quote for the remediation build, if you want one. No obligation, no pressure, no expiring discount.
What we need from you
- Read access to the repository or repositories in scope
- Access to your defect tracker, ideally covering 6+ months before AI adoption
- One hour each with the engineering lead and whoever owns the release process
- Your CI configuration
- No production data. We work in synthetic or masked data by default and will say so in the SOW.
What this is not
This is not a penetration test, a SOC 2 audit, or a staff-augmentation contract. It is not a tool we are reselling. If your problem is that you need two testers for six months, we are the wrong vendor and we will tell you that on the first call.
Scope and terms
Two weeks fixed fee
- Priced before anything starts. One fee for the whole diagnostic, agreed in writing before we open your repository. You do not carry the risk of our estimate being wrong.
- 50% on signature, 50% on delivery of the report
- Two weeks from access granted
- If we cannot get access within two weeks of signature, we reschedule rather than burn the window.
- No retainer commitment, no auto-renewal, no expiring discount.
How this gets bought
Most of this work arrives inside one of the three engagements on the home page — the diagnostic above finds what is wrong, the quality gate build fixes it, the retainer keeps it fixed. That is the path we recommend, because it puts a measurement before the spend.
If you already know what you need — a suite rescued, an agent built and deployed, an exploratory pass before a release you are nervous about — say so in your first email and we will scope it directly. Fixed price, quoted before any work starts.
What we will not sell you is testers by the hour. That is staff augmentation, it competes on rate with suppliers we cannot and should not undercut, and it produces no outcome either of us can point at afterwards. If that is genuinely what you need, we will tell you so in the first reply and you will have lost five minutes.
Tell us what is breaking.
Tell us what you adopted, what keeps breaking, and what you have already tried. If we cannot help, we will say so.