The non-functional tests nobody runs until production breaks

We had a client ship a healthcare portal in 2021. They'd done unit tests, integration tests, a full regression suite. The build was green. The demo looked great. Three weeks after launch, an audit found that patient records were being transmitted over an unencrypted internal API call. Not the main one, a secondary endpoint that pulled appointment summaries. Nobody had run a compliance test against it because the team assumed HTTPS at the load balancer covered everything. It didn't. The remediation cost six figures and the timeline slipped by two months. That's what non-functional testing actually is. Not a checkbox. Not a nice-to-have sprint task that gets deprioritized when deadlines tighten. It's the category of testing that catches the failures your users discover on their worst day. What counts as non-functional testing Functional tests verify that features work. You click "submit," the form submits. Non-functional tests ask harder questions. How fast does it submit under load? Wha