In addition to security testing, it seems that performance testing has come to the forefront of requests from out clients. As we now go beyond basic 'it works' functionality, clients are not worried about taking it to the next level. They've come to realize that performance has become more important as expectations continue to increase from their end users. Whereas 3-4 seconds used to be 'good enough', now users expect 1-2 seconds response time and even less for frequent usage scenarios. One of our clients recently told us that they had 10000 users and they wanted to simulate all users logging in simultaneously. After convincing them that this scenario was highly unlikely, I decided to put together a list of performance testing considerations.