Nordic Testing Days 2026

As organizations rush to adopt Large Language Models (LLMs), many discover that building reliable, trustworthy applications is far from straightforward. Unlike traditional software, LLM outputs are non-deterministic, context-dependent, and vulnerable to issues like bias, hallucinations, and prompt injection. Ensuring quality requires more than testing—it demands a holistic approach that blends architecture, safety, observability, and continuous feedback. This talk explores practical strategies for embedding quality into LLM-powered systems from the ground up. We’ll cover methods for prompt design, evaluation frameworks, guardrails, and hybrid architectures that improve accuracy and safety. Attendees will leave with a clearer understanding of how to balance innovation with reliability and how to design AI applications that are not only powerful but also consistent, secure, and user-focused.


Key takeaways:

1. Testing LLMs requires new methods, not just old QA practices.Combine automation + human oversight for best results.
2. Build feedback and safety into the system from the start.
3. Quality is a continuous journey, not a release milestone.

Testers often need custom tools - data generators, mock services, internal dashboards, or CI helpers - but building them traditionally requires significant development effort and prioritization. With modern AI-assisted coding, we can now prototype and build these tools themselves, minimizing both engineering and maintenance efforts. In this session, I’ll show real examples of using vibe-coding to create internal testing workflows, interfaces, and CI/CD helpers. I’ll focus on where AI significantly accelerates development, where it introduces risks, and how to apply guardrails to keep these tools maintainable, secure and trustworthy.Rather than promoting “AI replaces engineers,” this talk presents AI as a practical productivity amplifier for experienced testers who understand their systems and constraints.


Key takeaways:

1. How to design and build tester-owned tools using vibe-coding without creating technical debtAttendees will learn how to approach AI-assisted development of internal testing tools (data generators, mock services, dashboards, CI helpers) with clear ownership boundaries, architectural decisions, and sustainability in mind.
2. A realistic mental model for AI-assisted coding in testing workflowsParticipants will gain a clear understanding of where vibe-coding provides real leverage for experienced testers, where it breaks down, and how to critically evaluate AI-generated code instead of blindly trusting it.
3. Practical guardrails for security, maintainability, and long-term useAttendees will leave with concrete strategies for applying constraints - such as validation, code structure, reviews, and documentation - to ensure AI-built tools remain trustworthy, auditable, and safe to evolve over time.

Performance issues often surface only when it’s too late - after deployment, when real users start to feel the impact. Load testing helps prevent that, but many teams still see it as a complex or time-consuming task. This workshop aims to show how accessible and powerful it can be using k6, an open-source, developer-friendly tool designed for modern performance testing.The session starts with a short introduction to the fundamentals of load testing: what it is, when to use it, and the different test types supported by k6 - average, stress, spike, soak, breakpoint and smoke. Participants will also get a quick overview of how k6 works under the hood and how it integrates into a development workflow.From there, we’ll move into a hands-on, guided session, beginning with a simple GET request and gradually expanding it into a complete load testing project. Each step introduces a new concept: adding thresholds and stages, randomizing requests, implementing assertions, handling errors, and organizing the project using npm and Prettier. We’ll then extend the script with multiple endpoints, visualize live results on the web dashboard, and perform authenticated requests using JWT tokens.Throughout the workshop, I’ll share real-world experiences and lessons learned from conducting load tests on different projects—what to watch out for, common pitfalls, and how to interpret the results effectively.Participants will leave with both the theoretical foundation and practical skills to start creating their own performance testing setup using k6. All examples will be built live, and attendees can follow along on their own laptops. Only basic JavaScript knowledge is required.


Key takeaways:

1. Understand the core principles of load testing and how to apply them effectively using k6 in real-world scenarios.
2. Gain hands-on experience building and running performance tests step by step—from a simple request to a full, maintainable testing suite.
3. Learn practical insights and troubleshooting techniques drawn from real project experiences, helping you avoid common pitfalls and get meaningful results faster.

How do you define yourself as a leader? How do you see your leadership? In this personal pitstop we will go over what being a leader means to you. At work, at home, or at your hobby, your leadership skills matter.  They play a huge role in how you perceive the world around you, and how others perceive you. As a leadership coach, I’ve picked up a lot of knowledge on how to help and train people on their leadership skills. In this workshop I’m sharing my best tips.We’ll look at where in your process you currently are, and where you would like to go. We will do this via small games, assessments, and observations from the group. As a group we will help each other. We will set (achievable) goals for you to work on in your ‘Leadership Plan’ that you will take home.


Key takeaways:

1. Assess and identify your leadership styleUnderstand your communication style
2. Create an achievable Leadership Plan to take home (that works!)

Pull requests, aka merge requests, are a goldmine of information that many testers are missing out on. Although pull requests are often seen as a tool mainly for developers, they offer testers an equal opportunity to provide feedback. When joining the review process testers can contribute to the software quality before changes are added to the codebase. They can use their unique perspective to uncover insights that go beyond the code. They will learn more about the bigger picture of the application. And ultimately, testers can apply these observations to their testing and help the team prevent bugs.In this talk, Andrea will introduce how testers can get involved in the pull request review process. She will demonstrate how testers can shift left and proactively engage with the source code changes. The step-by-step approach covers everything from checking policies and standards. It also includes looking at build pipelines, code changes, and unit tests. Starting with the basics, the session gives clear examples at every stage, making it easy to follow along.Andrea will highlight practical examples and insights drawn from real-life experiences, providing actionable tips on how to get the most out of pull request reviews. The session illustrates how testers can analyze pull requests for quality, learn more about the source code, and make a real impact through their feedback.At the end of the session, attendees will have a hands-on guide to reviewing pull requests. They will be ready to take a closer look at their team’s work and discover new insights, just as curious koalas explore branches to find tasty leaves of eucalyptus. It’s time for testers and their teams to realise the untapped potential of making pull request reviews a shared responsibility.


Key takeaways:

1. Understand the elements of a pull request and know about the basic principles of the Git workflow
2. Learn how to shift-left and contribute to the pull request review process
3. By the end of the session, participants will be able to start reviewing pull requests

SummarySecurity testing sounds like it might be best left to the “experts”, whoever they are, but I will share how we can include it in our day-to-day testing. From exploratory testing to API and automated testing, there are things that we can and should be doing.Through this workshop we will learn about the scope of security testing, find out about the automated tools available and then spend some time practicing basic security testing techniques like SQL Injection, Insecure Direct Object Reference and using browser developer tools.Setup- Attendees will need to bring a laptop or pair up. Any browser is fine but Chrome recommended. - Screen & HDMI/equivalent for presenting slide & demos.ActivitiesFor a 2 hour workshop:- IDOR / URL manipulation- Bypassing UI using developer tools- Cross site scripting (XSS)- SQL injectionIf a 4 hour workshop is preferred, I can add in additional activities including analysing session data and a Capture the Flag exercise.

Key takeaways:

1. Recognise that security testing is something that you can & should be doing
2. Identify the "low hanging fruit" security bugs in software
3. Execute basic penetration tests against an online system

Most of us unknowingly carry limiting beliefs about our abilities, often in the very areas where we have the most room to grow! A talented developer won't apply for a senior role because they think “I'm just not a natural leader”, never considering that leadership can be learned. Or a designer brushes off feedback believing, "Either you have an eye for design or you don't." Sound familiar?These are not signs of missing innate talent, but rather the result of a fixed mindset, a belief that your innate talent is set in stone. The good news is that this belief can be changed by adopting a growth mindset, a belief that you are capable of growing and improving. Drawing on insights from Dr. Carol S. Dweck’s pioneering research, this talk explores how a fixed mindset makes us avoid challenges and crumble at criticism, while a growth mindset helps us see both as fuel for improvement. I'll break down the real difference between fixed and growth mindset and we'll do an interactive exercise where you'll experience the shift yourself.The best part? Your potential isn't fixed. You will walk away with a practical strategy to stop protecting your ego and start building the skills necessary to get that senior role and tackling the challenges you've been avoiding.


Key takeaways:

Participants will leave this session with:

1. An understanding of how we overestimate our knowledge
2. A clear distinction between fixed mindset and growth mindset
3. Practical strategies for adopting a growth mindset