A CI/CD pipeline for a cloud application runs unit and integration tests confirming that each feature behaves as specified, but nothing measures response time under load, behavior during failover, or security properties. What is missing from the test strategy?

Functional testing verifies what a system does: given inputs, does each feature produce the specified outputs. Non-functional testing verifies how well it does it, covering qualities such as performance under load, scalability, availability and failover behavior, and security properties such as authentication strength and resistance to attack. The pipeline described already runs functional tests through its unit and integration suites; the gap is the absence of load testing, resilience or failover testing, and security testing, which in cloud environments matter because elasticity, regional failure and exposure to the internet are routine conditions. Functional testing is therefore the part that is already present, not the missing piece. Regression testing reruns existing tests to confirm that new changes have not broken earlier behavior; it is valuable, but in this pipeline it would replay the same functional checks and still never measure load or security. User acceptance testing confirms with business users that the features meet their needs, which again concerns function rather than qualities such as speed or resistance to attack. Exam caveat: security testing is a form of non-functional testing, and the 2026 outline places it within CI/CD rather than as a separate stage. Operational check: confirm the pipeline includes load test thresholds, a failover test in a staging environment and automated security scans, each able to fail the build.