Mutation testing

What it means

Mutation testing is a way of testing your tests. A tool makes small deliberate changes to the code, such as flipping a comparison or removing a condition, and then runs the test suite. If the tests still pass, they did not notice the change, and that gap is reported. The idea comes from software quality research and is used in many languages.

Each change is a mutant. A mutant the tests catch is killed. One that survives points at behaviour the tests do not really check. The result is a score for how well the tests would detect real mistakes, not just whether they pass today.

Why it matters

Code coverage can mislead. A line can run during a test without any check on what it did. Mutation testing asks the harder question of whether a wrong result would be noticed. A suite with high coverage and many surviving mutants gives false confidence. Tests that pass no matter what the code does are worse than no tests, because people trust them.

For security this matters at access checks. If you flip a permission check from deny to allow and every test still passes, nothing guards that rule. Mutation results show where regressions could slip in unnoticed. Prioritise those areas first. Start with access checks.

How it shows up

You meet it through tools such as Stryker for JavaScript and C#, PIT for Java, and others for most languages. They are slow, because the suite runs once per mutant, so teams run them on the most important modules or on changed code only.

Mistakes: running it across the whole codebase and giving up at the runtime, chasing a 100 per cent score, and not looking at survivors that sit in security-critical code. Start with authentication, authorisation and payment logic. It checks your tests; it is not a replacement for penetration testing.