Abuse Case
An abuse case describes how a system could be intentionally misused or attacked so that appropriate security measures can be designed and tested.
“A use case in which some actors with malicious intent are causing harm to the system or to other actors.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Abuse Case?
Abuse cases help identify threats by describing actions performed by malicious users instead of legitimate users. They support security testing by revealing vulnerabilities before release.
Purpose: Identify security risks from an attacker's perspective.
Relationship to use cases: Abuse cases complement normal use cases by describing harmful behavior.
Testing value: Abuse cases help derive security and penetration test scenarios.
Real World Example
An online banking login flow is being reviewed after fraud analysts report repeated attempts to discover valid customer accounts.
The concern is not whether ordinary login works; it is how the system behaves when someone intentionally misuses it. Abuse case points testing toward that hostile or risky behavior.
The tester probes rate limits, error messages, audit events, lockout behavior, and monitoring signals to see whether the system gives attackers useful feedback.
The team strengthens the controls because Abuse case helps them test the product from the perspective of misuse, not only normal customer journeys.
Practice Questions
Question 1
A team is designing a password reset feature. Which scenario BEST represents an abuse case?
Question 2
What is the PRIMARY purpose of writing abuse cases during test design?
Test your knowledge with real ISTQB-style questions
You’ve learned Abuse Case. Test your understanding with topic-specific questions in our Mock Exams.