Ask a tester this: “You are given a login form. How do you start testing?” For the most part, you’ll find the answer falls along two distinct lines of investigation. You’ll either be told “First, I would try to log in successfully” or you will be told “First, I will try typing in an invalid password, then an invalid username, and then I’ll try entering nothing.”

This is not a question of whether or not the first tester would have also done those tests. They likely would have. It’s rather a question of what they started with: the success scenario or failure scenarios. So let’s talk about that.