Skip to Content

2. Testing types

Last modified by Tiina Silvonen on 2026/11/06 08:43

 

Software can be tested from different perspectives and at different levels. Different testing types identify different kinds of problems, and several types are usually needed to provide sufficient confidence in the quality of a system.

Testing can broadly be divided into functional testing and non-functional testing. 

2.1 Functional testing

Functional testing verifies that the system behaves according to its defined requirements and that its features work as expected. 

Unit testing

Unit testing focuses on individual pieces of software, such as functions, methods, classes, or components, in isolation from the rest of the system.

Unit tests are typically implemented by developers and are well suited for automated testing.

Example: Verify that a calculation function returns the correct result for given input values. 

Integration testing

Integration testing verifies that different components and interfaces work correctly together. The focus is on the interaction between parts of the system rather than the internal behaviour of an individual component.

Integrations may include communication between application components, databases, APIs, or external services.

Example: Verify that an application can successfully send data through an API and store the result in a database.

System testing

System testing verifies the behaviour of the complete application or system as a whole. It ensures that the different parts of the system work together and that the system fulfils its defined requirements.

System testing can cover complete workflows that cross several components or services.

Example: Verify that a user can log in, enter information, save it, and later retrieve the saved information successfully. 

Acceptance testing

Acceptance testing verifies that the system meets the agreed requirements and user or business needs. It is typically performed from the perspective of the customer, Product Owner, end user, or another relevant stakeholder.

Acceptance testing helps determine whether the functionality is ready to be accepted and released.

Example: Verify that a completed feature fulfils the acceptance criteria agreed for the corresponding user story. 

2.2 Non-functional testing

Non-functional testing evaluates the quality characteristics of a system rather than individual functions. Depending on the system, relevant areas can include accessibility, performance, security, usability, and compatibility. 

Accessibility testing

Accessibility testing verifies that a digital service can be used by as many people as possible, including users who use assistive technologies or cannot use a mouse, see visual content, or hear audio content.

Accessibility should be considered throughout development rather than only tested at the end.

Example: Verify that the main functionality of a web application can be operated using only a keyboard.

Performance testing

Performance testing evaluates characteristics such as response times, speed, scalability, and behaviour under load.

The required level of performance testing depends on the expected usage and criticality of the service.

Example: Verify that a service continues to respond within an acceptable time when many users access it simultaneously. 

Security testing

Security testing helps identify vulnerabilities and verifies that the application and its data are protected against unauthorized access, modification, or disclosure.

The scope of security testing should be based on the risks and security requirements of the application. Testing can include areas such as:

  • authentication and authorization
  • access control
  • input validation
  • dependency vulnerabilities
  • application security vulnerabilities
  • handling and protection of sensitive data

Security testing should be integrated into software development and CI/CD where appropriate. At the University of Helsinki, available services include Dependency Track for identifying known vulnerabilities in software components and SonarQube for static application security testing.

The scope of security testing depends on the system and its risks. Testing may include authentication, authorization, access control, input handling, and other security-related functionality.

Example: Verify that one user cannot access another user's data without the required permissions. 

For security practices, available security services, and more detailed guidance, see Security and Data Confidentiality.

Usability testing

Usability testing evaluates whether users can understand and use the system effectively and efficiently.

Testing should focus on realistic user tasks and workflows rather than only individual interface elements.

Example: Verify that a user can find and complete an important function without additional instructions.

Compatibility testing

Compatibility testing verifies that the application works correctly in the environments it is expected to support. Depending on the application, this can include different browsers, operating systems, devices, and screen sizes.

Tools such as BrowserStack can be used to test applications across different browser and device combinations. Read more of Browserstack here

Example: Verify that a web application works correctly on both mobile and desktop devices and on the supported browsers. 

Choosing the appropriate testing types

Not every project needs every type of testing to the same extent. The appropriate combination should be selected based on:

  • the application's purpose and criticality
  • identified risks
  • technical architecture and integrations
  • user requirements
  • security and privacy requirements
  • accessibility requirements
  • expected usage and load
  • supported browsers, devices, and environments
  • available resources

The selected testing types and their scope should be documented as part of test planning. The source document similarly includes the test scope, methods, levels, environments, data, risks, and acceptance criteria as considerations when planning testing.