Skip to content
Go back

A Test Strategy Is Risk Allocation, Not a Geometric Shape

Updated:
Commentary

Originally published onLinkedIn on 7 Apr 2023.

Carolina Ramirez’s comparison of software-testing strategies deserves credit for putting several influential models—the pyramid, honeycomb, trophy, and hourglass—into one accessible account. The underlying models also have identifiable creators and contexts: Mike Cohn introduced the test-automation pyramid; André Schaffer and Rickard Dybeck proposed the honeycomb for Spotify microservices; and Kent C. Dodds developed the testing trophy for frontend applications.

Seeing the diagrams together suggests a tempting question: which shape is correct? That is the wrong level of comparison. Each diagram compresses assumptions about architecture, failure cost, test speed, observability, and maintenance. A test strategy should recover those assumptions before copying the geometry.

The strategy is the allocation of verification effort against risk. The shape is only a summary produced afterwards.

Why the diagrams disagree

The classic pyramid recommends many small tests, fewer service-level tests, and a small number of expensive UI tests. Its economic argument remains useful: fast, localized feedback is cheap to run and easy to diagnose, while broad system tests are slower and often more fragile.

The honeycomb starts from a different system boundary. In Spotify’s microservice context, much of the meaningful complexity lived in interactions. Schaffer and Dybeck therefore emphasized integration tests around service edges, kept a smaller number of implementation-detail tests, and avoided tests dependent on live external systems where possible.

The trophy responds to frontend economics. Dodds argues that integration tests often provide a strong balance between confidence and cost, with static checks as a broad base and a smaller number of end-to-end tests for complete behaviour.

These positions are not mutually exclusive laws. They answer different questions about where defects hide and where useful observations can be made cheaply. If the unit boundary captures the important invariant, unit tests have high leverage. If risk emerges mainly at contracts, isolated unit coverage may be abundant yet unpersuasive. If the browser is the only place where several technologies and user-visible states meet, some end-to-end evidence is unavoidable.

Test labels hide several independent dimensions

Terms such as unit, integration, and end to end often mix unrelated properties:

An integration test can run in milliseconds against in-memory collaborators, or for minutes against shared infrastructure. A browser test can isolate one component or traverse an entire distributed workflow. A property-based unit test can explore a larger input domain than a single end-to-end example. Counting tests by label therefore gives little evidence about the portfolio.

A strategy should instead describe what each test proves, which failures it can expose, and what it costs to maintain and interpret.

Start with the failure model

For each important risk, ask five questions:

  1. Consequence: What happens if this behaviour is wrong?
  2. Fault location: Where could the responsible defect enter?
  3. Observation: What is the cheapest trustworthy oracle?
  4. Environment: Which real dependencies are necessary to expose the failure?
  5. Feedback: How quickly and precisely must the result reach the responsible engineer?

The answers usually produce a mixed portfolio:

RiskUseful evidenceCommon limitation
Pure calculation is wrongexamples, properties, differential checksreference or property can share the defect
Components disagree on a contractschema and consumer-driven contract testsdeployed configuration may still differ
Persistence semantics are wrongcomponent test with a real databaseproduction scale and migration history differ
User cannot complete a critical journeybounded end-to-end testslow diagnosis and environmental noise
System degrades under loadworkload model and performance experimentrepresentativeness of traffic and infrastructure
Monitoring fails to detect harmcontrolled fault injectionexperiment scope and operational risk

No single shape expresses all of these obligations. The portfolio can still have a visual profile, but it will be an empirical consequence of the system rather than a target ratio chosen in advance.

Allocate evidence, not test counts

A strategy based on percentages—70% unit, 20% integration, 10% end to end—invites the wrong optimization. Teams can satisfy it by creating many trivial unit tests while leaving a critical boundary unverified. Test count also treats a one-line example and a stateful generative model as equivalent units.

Better allocation questions include:

This also changes how a suite is reviewed. A slow test is not automatically bad if it is the only credible observation of a critical workflow. A fast test is not automatically valuable if it checks an implementation detail that changes with every refactor.

A strategy must be allowed to change

Architecture, traffic, team ownership, and tooling evolve. A portfolio that was rational for a monolith may become misleading after decomposition into services. A browser suite may become cheaper after improved tracing and isolation. A once-stable external dependency may require contract monitoring. Production incidents may reveal an untested class of state transitions.

The strategy should therefore preserve its reasons. When a test is added, moved, or deleted, the team should be able to say which risk and evidence relationship changed. Diagrams can help communicate the current portfolio, but they should not freeze an old economic model into policy.

Ramirez’s comparison is valuable as a map of testing ideas. The next step is to read each model as a contextual argument rather than a universal template. Choose test boundaries from the cheapest credible oracle for each important risk, then inspect the resulting portfolio. If it resembles a pyramid, trophy, honeycomb, or none of them, that is a secondary fact. The primary question is whether the evidence supports the release decisions the organization intends to make.


Share this note

Previous Note
Selecting Fewer MCP Tools Is Not the Same as Enforcing Least Privilege
Next Note
Property-Based Testing Starts with the Property, Not the Generator