Exploratory testing
Unscripted, time-boxed testing by a person following risk and curiosity.
Mandatory for 11 of 46 product types. Usually run by a QA engineer.
What it catches
- unexpected behaviour
- usability gaps
- wrong assumptions
What it misses
- coverage proof
- repeatability
Which product types need it and why
| Product type | Status | Reason or condition |
|---|---|---|
| dating app | mandatory | Risks: Fraud or abuse by users |
| kids app | mandatory | Risks: Physical or psychological harm to a user |
| LLM-based assistant | mandatory | Risks: Users or operators act on wrong numbers, Physical or psychological harm to a user |
| loyalty program app | mandatory | Risks: Fraud or abuse by users |
| online marketplace | mandatory | Risks: Fraud or abuse by users |
| machine learning model service | mandatory | Risks: Physical or psychological harm to a user, Users or operators act on wrong numbers |
| mobile game | mandatory | Risks: Money leaves or fails to arrive, Physical or psychological harm to a user |
| peer-to-peer payment app | mandatory | Risks: Fraud or abuse by users |
| ride-hailing app | mandatory | Risks: Fraud or abuse by users |
| social network | mandatory | Risks: Physical or psychological harm to a user |
| wearable companion app | mandatory | Risks: Physical or psychological harm to a user |
| clinical trial management software | recommended | Becomes mandatory when a study uses adaptive randomisation or complex eligibility. |
| crypto exchange | recommended | Becomes mandatory when customer data has leaked or impersonation reports rise. |
| electronic health record system | recommended | Becomes mandatory when a new facility or specialty goes live with order sets not seen before. |
| email marketing platform | recommended | Becomes mandatory when list merges, re-subscribes or segment edits leave subscribers with the wrong status. |
| mental health app | recommended | Becomes mandatory when evidence links a missed crisis path in this kind of app to harm, or the app adds an automated chat that replies to users in distress. |
| mobile banking app | recommended | Becomes mandatory when scam reimbursement claims rise after a payments flow change. |
| neobank | recommended | Becomes mandatory when customer growth outpaces the fraud team's review queue. |
| patient portal | recommended | Becomes mandatory when staff assign proxy access by hand or adolescents get their own accounts. |
| pharmacy delivery app | recommended | Becomes mandatory when reorder or one-tap refill ships. |
| software as a medical device | recommended | Becomes mandatory when a field complaint describes a dose or alarm path the requirements did not cover. |
| subscription box service | recommended | Becomes mandatory when retention offers are added to the cancel flow. |
| telemedicine app | recommended | Becomes mandatory when the app adds asynchronous visits where a clinician prescribes from a questionnaire alone. |
| accounting and invoicing SaaS | optional | Sessions around year-end close, locked periods and backdated entries may find ledger states scripted cases miss. |
| data pipeline | optional | Optional: finds scheduling edge cases scripted cases miss. |
| desktop application | optional | Optional: finds machine states scripted cases miss. |
| e-signature service | optional | Optional: finds envelope states that scripted cases miss. |
| ecommerce store | optional | May help: finds odd paths such as editing the cart in two tabs or reusing a single-use code. |
| ERP system | optional | Optional: helps find posting paths the scripted cases miss. |
| EV charging app | optional | May help: physical misuse at the charger produces states no script covers. |
| expense management tool | optional | Sessions around split expenses, mixed personal and business charges and refunds on a corporate card may find states scripted cases miss. |
| fleet and logistics tracking | optional | May help: road conditions produce gaps and jumps no fixture covers. |
| government services portal | optional | May help where support tickets mention lost progress. |
| grocery delivery app | optional | May help find basket and slot states the scripted cases miss. |
| identity and access management service | optional | Optional: finds privilege paths that scripted cases miss. |
| insurance app | optional | Sessions around endorsements, mid-term changes and claims on lapsed policies may find premium or coverage states scripted cases miss. |
| smart home or IoT app | optional | May help: home networks vary more than any lab setup. |
| language learning app | optional | May help if streak or trial abuse appears in support tickets. |
| lending platform | optional | Session-based exploration of payoff quotes, partial payments and early settlement may find schedule edge cases the unit cases miss. |
| SDK or client library | optional | Optional: finds crash paths that scripted cases miss. |
| event ticketing platform | optional | May help find seat-hold states the scripted cases miss. |
| stock trading app | optional | Unscripted sessions around halts, splits and options expiry may find order states that scripted cases miss. |
| travel booking app | optional | May help find booking-change states the scripted cases miss. |
| video conferencing tool | optional | Optional: finds role combinations that scripted cases miss. |
| buy now pay later service | not needed | Not needed: no attached risk is better found by unscripted sessions than by the refund and decline cases. Becomes recommended when a new plan length or product type launches. |
| messaging app | not needed | Not needed: users only chat with contacts they already have. Becomes recommended when the app adds public channels or discovery of strangers. |
Done conditions used on playbook pages
Each mandatory cell has its own done condition, written for that product type.
- dating app (Consumer apps): A tester posing as a scammer tries to move a match to an outside payment or chat channel, and the app warns the other member or blocks the attempt as the written rules say.
- kids app (Education): A tester posing as an adult stranger cannot find, message or voice-chat a child profile, and a child cannot send their name or location in free text.
- LLM-based assistant (Infrastructure and developer products): A session log covers policy questions, crisis phrases and off-topic requests, and records each answer next to the approved policy text.
- loyalty program app (Commerce): A session log lists attempts at credential stuffing, detaching a linked stored value card, duplicate receipt scans, referral loops and refund-after-redeem, with the outcome of each and a ticket for every success.
- online marketplace (Commerce): A session log records attempts at fake-seller onboarding, refund abuse, off-platform payment requests in messages and review manipulation, with the platform's response to each.
- machine learning model service (Infrastructure and developer products): A session log covers low-quality, edge and adversarial inputs, records each false match found and links it to a filed issue.
- mobile game (Consumer apps): A tester acting as a child tries to buy currency and chat with strangers, and each attempt stops at a parental gate.
- peer-to-peer payment app (Fintech): A tester acting as a scammer tries fake support contacts, payment requests with misleading notes and refund tricks, and each working path is logged as a defect.
- ride-hailing app (Commerce): A session log lists attempts at fake trips, promo stacking and account takeover with the outcome of each, and every successful attempt has a ticket.
- social network (Consumer apps): A session log from a test teen account shows that after engaging with self-harm and diet content the feed and search do not keep suggesting it, signed off by the trust and safety lead.
- wearable companion app (Healthcare): A session log covers walking out of range, toggling Bluetooth, force-quitting the app, low band battery and a second phone sending repeated pairing requests within range, and states what the user saw in each case and whether band alerts kept working.
Tools
Alphabetical. Not recommendations.
No tool in the list serves this test type.