A cloud e-commerce application passed all of its functional tests, yet after launch users discovered they could apply the same single-use discount code thousands of times by replaying the request. Which testing practice would most likely have found this before release?

Abuse cases, also called misuse cases, describe how an attacker or dishonest user could interact with a system in ways the designers did not intend. They are derived from use cases by asking what could go wrong: replaying requests, skipping steps, changing quantities or prices, racing parallel requests, or repeating one-time actions. Testing against abuse cases targets business logic flaws, which automated scanners and functional tests routinely miss because each request is individually valid. A single-use discount redeemed thousands of times is a textbook example, and an abuse case such as redeeming one code repeatedly or concurrently would have exposed the missing server-side state check. Load testing measures performance and capacity under heavy traffic; it might even send the same request many times, but it evaluates response times and errors, not whether the business rule was violated. Unit testing of the discount calculation confirms the arithmetic for one valid use and passes perfectly in this scenario. Usability testing observes ordinary customers to improve the experience; by design it does not attempt deliberate misuse. Exam caveat: abuse cases are written during requirements and design and then become test cases, linking threat modeling to software assurance. Operational check: confirm each high-value feature has documented abuse cases with matching automated tests, including replay and concurrency tests for single-use or limited resources.