6.5Quadrant 4: Performance, Security, and Load Testing (Technology-Facing, Critiquing the Product)

What It Includes

• Performance testing (response times, throughput)
• Load testing (behavior under heavy traffic)
• Stress testing (behavior beyond expected load)
• Security testing (penetration testing, SAST/DAST)
• Reliability testing (chaos engineering, failover)

Characteristics

• Automated with human analysis: Tools generate data, humans interpret results
• Run before major releases: Not on every PR (too expensive)
• Specialized skills: Often requires dedicated performance or security expertise
• Non-functional focus: Not about features working, but about how well they work

QA's Role in Q4

• Define performance budgets (LCP < 2.5s, API p95 < 500ms)
• Run load tests and analyze results
• Coordinate security scans and triage findings
• Monitor production performance as a continuous activity

Example

// k6 load test (Q4)
import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
  vus: 100,        // 100 virtual users
  duration: '5m',  // Run for 5 minutes
  thresholds: {
    http_req_duration: ['p(95)<500'],  // 95% of requests under 500ms
    http_req_failed: ['rate<0.01'],    // Less than 1% failure rate
  },
};

export default function () {
  const res = http.get('https://staging.example.com/api/products');
  check(res, {
    'status is 200': (r) => r.status === 200,
    'response time < 500ms': (r) => r.timings.duration < 500,
  });
  sleep(1);
}