Some sources, e.g. ISTQB, claim that security testig is a functional one. This would be compliant with ISO 9126 (which the ISTQB is based on) but it goes against most other sources - as far as I know, security is a non functional requirement. In ISO 25010, security is one of the quality characteristics (non functional).

I believe security testing is non functional testing as we do not test functionality, we examine the system from this perspective the same way we test performance.

  • 1
    Is there a question you want to ask and have answered? The way this is written it comes off as a statement. Is this a question that can be answered in a non-subjective way? Commented Jun 3, 2015 at 23:29

1 Answer 1


ISO 25010 is an updated revision of ISO 9126. Security is considered non-functional.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.