QA and software testing roadmap for 2027: manual to automation

A software testing roadmap for 2027 has eight stages: testing fundamentals, test design and bug reports, SQL and API testing, one automation framework, CI integration, performance and security basics, testing AI features and a test portfolio. The International Software Testing Qualifications Board (ISTQB) Foundation Level syllabus (version 4.0.1) describes five test levels: component, component integration, system, system integration and acceptance testing.

Last updated: 11 November 2026.

What do testers need to know first?

Testers first need the vocabulary of test levels, test types and defect reports, because every later tool applies it. The ISTQB Certified Tester Foundation Level Syllabus v4.0.1 (15 September 2024) says test levels are groups of test activities that are organised and managed together, and describes five:

• Component testing, also called unit testing, tests components in isolation and is normally done by developers.
• Component integration testing tests the interfaces and interactions between components.
• System testing tests the overall behaviour of an entire system or product.
• System integration testing tests the interfaces between the system under test and other systems and external services.
• Acceptance testing validates that the system meets the user's business needs and is ready for deployment.

The syllabus addresses four test types. Functional testing evaluates what the test object should do, and non-functional testing evaluates "how well the system behaves" across characteristics that ISO/IEC 25010 classifies as performance efficiency, compatibility, usability, reliability, security, maintainability, portability and safety. Black-box testing is specification-based and white-box testing is structure-based. Confirmation testing confirms that an original defect has been fixed, and regression testing confirms that a change has caused no adverse consequences.

A defect report, the syllabus says, typically includes a unique identifier, a title with a short summary, the date and author, the test object and environment, the context, a description of the failure with the steps that detected it, expected and actual results, severity, priority, status and references. The syllabus adds that regression test suites are run many times, which makes them a strong candidate for automation.

What are the stages of a software testing roadmap?

The roadmap has eight stages, and each has a practice task and a proof of skill. The table summarises them. The API testing tools comparison covers the tools for stage 3.

The REST API guide explains methods and status codes, and the SQL joins guide covers the queries used for database checks.

How do you test an API with pytest?

An API is tested with pytest by starting the service, sending requests and asserting on status codes and response bodies. pytest's documentation says the framework makes it easy to write small, readable tests and can scale to support complex functional testing for applications and libraries. The example below tests a tiny order API written with Python's standard library, so nothing needs installing except pytest. The first block is the system under test and a fixture that starts it on a free port:

import json, threading, urllib.error, urllib.request
from http.server import BaseHTTPRequestHandler, HTTPServer
import pytest

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        found = self.path == "/orders/1001"
        self.send_response(200 if found else 404)
        self.end_headers()
        self.wfile.write(json.dumps({"status": "shipped"} if found else {"error": "not found"}).encode())

@pytest.fixture(scope="module")
def base_url():
    server = HTTPServer(("127.0.0.1", 0), Handler)
    threading.Thread(target=server.serve_forever, daemon=True).start()
    yield f"http://127.0.0.1:{server.server_port}"
    server.shutdown()

The second block, in the same file, holds a helper and the tests: a parametrised status-code test and a check of one field in the body.

def get(url):
    try:
        with urllib.request.urlopen(url) as r:
            return r.status, json.load(r)
    except urllib.error.HTTPError as e:
        return e.code, json.load(e)

@pytest.mark.parametrize("path, status", [("/orders/1001", 200), ("/orders/9999", 404)])
def test_status_codes(base_url, path, status):
    assert get(base_url + path)[0] == status

def test_order_body(base_url):
    assert get(base_url + "/orders/1001")[1]["status"] == "shipped"

With Python 3.12.13 and pytest 9.2.0, pytest -v reported (the run-time part of the summary line is omitted):

test_orders_api.py::test_status_codes[/orders/1001-200] PASSED
test_orders_api.py::test_status_codes[/orders/9999-404] PASSED
test_orders_api.py::test_order_body PASSED
3 passed

Changing the expected status to "delivered" shows what a failure looks like, and the output has the two fields a bug report needs, expected and actual:

E       AssertionError: assert 'shipped' == 'delivered'
E         - delivered
E         + shipped
FAILED test_fail_demo.py::test_order_body - AssertionError: assert 'shipped' ...
1 failed, 2 passed

A passing suite proves little until it has failed on a planted bug, which is why stage 4 asks for both. The server here is a stand-in written for the test, so a real project would point the same tests at its own API.

Should you learn Playwright or Selenium first for testing?

Learn the one that matches the team's language and browsers, because each tool's documentation lists different strengths. The table compares what the documentation states, with usage from the Stack Overflow Developer Survey 2026 (10,604 respondents on code testing tools).

Playwright is a test framework with its own runner. Selenium automates browsers and needs a test runner such as pytest around it. The Stack Overflow figures count survey respondents who did extensive development work with each tool in the past year, and shares overlap, so they show use among developers and not what QA job postings ask for. The table compares documented features, not speed or reliability.

Choose by situation. A team already writing tests in Java, C#, Ruby or Kotlin may stay with Selenium, which lists all of them. A new project in Python or TypeScript can use Playwright, which documents both. A front-end team that wants component and accessibility checks in one platform may prefer Cypress. A requirement to run on Safari points to Selenium, which lists Safari, while Playwright lists the WebKit engine. These points come from each project's own documentation.

How do CI, performance and security testing fit in?

Run the same command in a pipeline that a tester runs locally. GitHub's documentation for building and testing Python includes a "Testing with pytest and pytest-cov" workflow that installs pytest and runs the tests in GitHub Actions. The CI/CD pipelines explainer and the DevOps engineer roadmap cover the pipeline side.

Performance testing checks the non-functional characteristic the ISTQB syllabus calls performance efficiency. Grafana's k6 documentation describes k6 as an open-source, developer-friendly and extensible performance testing tool with a JavaScript API. Apache JMeter describes itself as open source software, a 100% pure Java application designed to load test functional behaviour and measure performance.

For security basics, the OWASP Web Security Testing Guide describes itself as the premier cybersecurity testing resource for web application developers and security professionals, and ZAP (Zed Attack Proxy) describes itself as free and open source. Test only applications you own or have written permission to test.

How do you test AI features?

Testing an AI feature means allowing for output that varies from run to run: run the same input several times and count the failures, instead of relying on one pass. ISTQB's Certified Tester AI Testing (CT-AI) v2.0 certification focuses on testing AI-based systems, including machine learning and generative AI systems, and addresses probabilistic behaviour, non-determinism and reliance on data. Its page says CT-AI v1.0 is replaced, with the English version available until 21 April 2027, and it points to a separate Certified Tester Testing with Generative AI (CT-GenAI) certification.

The OWASP Top 10 for LLM Applications 2025 lists LLM01:2025 Prompt Injection and LLM02:2025 Sensitive Information Disclosure first, which gives a first set of test cases for a chatbot. foundit's July 2026 hiring trends report for India, published in August 2026, says AI roles rose from roughly 1% to 4% of fresher postings in a year, with AI QA & Testing at 5% of AI-led fresher jobs.

Is QA a good career in 2027, and can a manual tester move to automation?

QA remains a recognised career with demand signals, and a manual tester can move to automation by keeping test design skills and adding code. The US Bureau of Labor Statistics projects overall employment of software developers, quality assurance analysts and testers to grow 10 percent from 2025 to 2035; that is a United States figure for a combined group. In India, foundit's July 2026 report lists QA / Test Engineer at a 7.6% share of top roles for 4 to 6 years of experience.

The move to automation starts with the checks that repeat. The ISTQB syllabus calls regression suites a strong candidate for automation, and its list of automation risks includes unrealistic expectations, underestimated maintenance effort, using a tool when manual testing is more appropriate and relying on a tool while ignoring human critical thinking. Exploratory testing and bug reporting stay manual skills. An earlier overview of the field is in Demystifying Automation Testing.

What are the limits of this roadmap?

A roadmap does not replace practice on a real application. The Stack Overflow shares and the foundit and BLS figures are market signals, not promises of work. The pytest example tests a stand-in server, the browser frameworks are compared from their documentation, and tool versions change often. Pay is not covered because pay varies by employer, city and experience.

Where does this roadmap fit in a forward deployed engineer programme?

The Forward Deployed Engineer (FDE) Cohort is a Leap by Masai programme for engineers with hands-on technical experience, run as an in-person start in Goa, an online build phase and an in-person hackathon in Bangalore for qualifying participants, covering production Python, APIs, cloud deployment, LLMs, retrieval, agents, security and client engagement. Its online phase includes containers and CI/CD, retrieval with evals, and a block on security, monitoring, cost and load testing, which overlap with stages 5 to 7. It is aimed at engineers and is not a testing course.

Frequently asked questions

Is QA a good career in 2027?

QA has demand signals, though they are not a promise of work. The US Bureau of Labor Statistics projects 10 percent growth from 2025 to 2035 for software developers, quality assurance analysts and testers combined, and foundit's July 2026 report lists QA / Test Engineer at a 7.6% share of top roles for 4 to 6 years of experience in India.

Should a beginner learn Playwright or Selenium first?

A beginner should learn whichever of Playwright and Selenium fits the team's language and browsers. Playwright documents TypeScript, Python, .NET and Java and supports Chromium, WebKit and Firefox, while Selenium lists Java, Python, C#, Ruby, JavaScript and Kotlin and controls Chrome, Firefox, Edge and Safari. In the Stack Overflow Developer Survey 2026, 24.9% of respondents used Playwright and 12.0% used Selenium.

Can a manual tester move to automation?

A manual tester can move to automation. Keep test design, exploratory testing and bug reporting, and add code in steps: automate the repeated regression checks first, with a framework such as pytest. ISTQB's syllabus calls regression suites a strong candidate for automation, and warns against relying on a tool while ignoring human critical thinking.

What is the difference between regression testing and confirmation testing?

Confirmation testing confirms that an original defect has been successfully fixed, for example by running the tests that failed because of it. Regression testing confirms that a change, including a fix that has already been confirmation tested, has caused no adverse consequences elsewhere. ISTQB's Foundation Level syllabus defines both.

What should a software bug report contain?

A bug report should contain a unique identifier, a short title, the date and author, the test object and environment, the context, the steps that reproduce the failure with logs or screenshots, the expected and actual results, severity, priority and status. ISTQB's Foundation Level syllabus lists these fields for defect reports.

What does the ISTQB Foundation Level certificate cover for a beginner?

The ISTQB Certified Tester Foundation Level (CTFL) v4.0 certification demonstrates practical knowledge of the fundamental concepts of software testing. ISTQB says it suits testers, test analysts, test engineers and software developers, and that it is a prerequisite for other ISTQB certifications where Foundation Level is required.

Next step

Write the stage 2 bug reports this week, then automate the five regression checks with pytest or Playwright and run them in CI. The Forward Deployed Engineer Cohort page lists the CI/CD, evaluation and load testing blocks for engineers who want a guided build phase, and the cloud engineer roadmap covers the environments that tests eventually run in.