Even without a vulnerability, weak capacity, lock-ups, and queue buildup take a service down; that is an availability issue and can stress security controls. Load testing measures response time, error rate, and bottlenecks with agreed virtual users, ramps, and scenarios. A campaign, registration window, or a new API cut creates this need. Load testing is not pentest; session, cache, and WAF thresholds still change under load, so security teams should see the result. Unauthorized heavy traffic is not applied in production.

TARGON does not position load testing as running a tool and leaving charts. Scenarios are cut from real flows (login, search, payment); results are interpreted across application, database, and network. It is not mixed with DDoS testing: one is authorized resilience and performance, the other is an attack-style protection experiment or report review. Taking load testing from TARGON joins performance and security in the same delivery discipline; scope, monitoring, and stop thresholds are set in the contract.

Discuss Pentest Scope